citizone2015.tk Open in urlscan Pro
2606:4700:3035::6812:2c28 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://citizone2015.tk/
Submission: On April 26 via automatic, source certstream-suspicious (April 26th 2020, 6:11:06 am UTC)

Summary HTTP 32 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 8 domains to perform 32 HTTP transactions. The main IP is 2606:4700:3035::6812:2c28, located in United States and belongs to CLOUDFLARENET, US. The main domain is citizone2015.tk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 26th 2020. Valid for: 5 months.

This is the only time citizone2015.tk was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
15	2606:4700:303... 2606:4700:3035::6812:2c28	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:815::200a	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:815::2001	15169 (GOOGLE) (GOOGLE)
32	6

15 2606:4700:3035::6812:2c28 (United States)

ASN13335 (CLOUDFLARENET, US)

citizone2015.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	citizone2015.tk citizone2015.tk	174 KB
7	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	132 KB
3	doubleclick.net googleads.g.doubleclick.net
2	gstatic.com fonts.gstatic.com	24 KB
2	googleapis.com fonts.googleapis.com	2 KB
1	googletagservices.com www.googletagservices.com	27 KB
1	google.com adservice.google.com	839 B
1	google.de adservice.google.de	839 B
32	8

	Domain	Requested by
15	citizone2015.tk	citizone2015.tk pagead2.googlesyndication.com
5	pagead2.googlesyndication.com	citizone2015.tk pagead2.googlesyndication.com
3	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	fonts.gstatic.com	pagead2.googlesyndication.com
2	fonts.googleapis.com	citizone2015.tk
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
32	9

This site contains links to these domains. Also see Links.

Domain
educationhost.co.uk
www.educationhost.co.uk

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-26` - `2020-10-09`	5 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://citizone2015.tk/
Frame ID: 8E96AAFE442DADC406FCC6A0C649366B
Requests: 29 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200422/r20190131/zrt_lookup.html
Frame ID: C7033E0DC44F2FE88381D0D22F3A3993
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2128318741198334&output=html&h=280&slotname=9612153600&adk=2458629886&adf=54630664&w=1200&fwrn=4&fwrnh=100&lmt=1587881151&rafmt=1&psa=0&guci=1.2.0.0.2.2.0.0&format=1200x280&url=https%3A%2F%2Fcitizone2015.tk%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1587881433337&bpp=42&bdt=234&idt=106&shv=r20200422&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=6421072198224&frm=20&pv=2&ga_vid=1643059320.1587881433&ga_sid=1587881433&ga_hid=1010920503&ga_fc=0&iag=0&icsg=175103&dssz=10&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=573&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21065473&oid=3&pvsid=2146545103837841&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8336&bc=31&ifi=1&uci=a!1&fsb=1&xpc=DgRc4kGLHG&p=https%3A//citizone2015.tk&dtd=124
Frame ID: 0FAA19E4B5AC846AA7F2BBF0FF6D1E16
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2128318741198334&output=html&adk=1812271804&adf=3025194257&lmt=1587881151&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fcitizone2015.tk%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1587881433428&bpp=4&bdt=325&idt=66&shv=r20200422&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280&nras=1&correlator=6421072198224&frm=20&pv=1&ga_vid=1643059320.1587881433&ga_sid=1587881433&ga_hid=1010920503&ga_fc=0&iag=0&icsg=699391&dssz=11&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21065473&oid=3&pvsid=2146545103837841&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8208&bc=31&ifi=1&uci=a!1&fsb=1&dtd=74
Frame ID: 19E949E8C291C053FDE1E559BDAC0B15
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html
Frame ID: 4A62C1EBAC6F11C400CC7CF185BC4E50
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

32
Requests

100 %
HTTPS

100 %
IPv6

8
Domains

9
Subdomains

6
IPs

2
Countries

361 kB
Transfer

998 kB
Size

2
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://educationhost.co.uk/student-web-hosting/
Title: Student

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/business-hosting/
Title: Web Hosting

Search URL Search Domain Scan URL

URL: https://www.educationhost.co.uk/whmcs/index.php?rp=/store/ssl-certificates
Title: SSL Certificates

Search URL Search Domain Scan URL

URL: https://www.educationhost.co.uk/whmcs/index.php?rp=/store/website-builder
Title: Website builder

Search URL Search Domain Scan URL

URL: https://www.educationhost.co.uk/whmcs/index.php?rp=/store/email-services
Title: E-mail services

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/reseller-hosting/
Title: Reseller web hosting

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/education-web-hosting/
Title: Education Web Hosting

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/research-servers/
Title: Research servers

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/minecraft-education/
Title: Minecraft for education

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/about/
Title: About

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/blog/
Title: Blog

Search URL Search Domain Scan URL

URL: https://www.educationhost.co.uk/whmcs/knowledgebase.php
Title: FAQs

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/domains/
Title: Domains

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/legal/
Title: Legal

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/whmcs/clientarea.php
Title: Client Area

Search URL Search Domain Scan URL

URL: https://educationhost.co.uk/contact/
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.educationhost.co.uk/whmcs/clientarea.php
Title: Log into the Client Area

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
citizone2015.tk/ 9 KB
2 KB 209ms
151ms Document
text/html 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d05ecc61dc0d9b480223e8ad5baf1ca930a70759042265313c2293ed9df7bea8

Request headers

:method: GET
:authority: citizone2015.tk
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Sun, 26 Apr 2020 06:10:33 GMT
content-type: text/html
set-cookie: __cfduid=d0144e5f087d7186b85034c9eea43c0bd1587881432; expires=Tue, 26-May-20 06:10:32 GMT; path=/; domain=.citizone2015.tk; HttpOnly; SameSite=Lax
last-modified: Sun, 26 Apr 2020 06:05:51 GMT
vary: Accept-Encoding,User-Agent
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 589e242bffdb324c-FRA
content-encoding: br
cf-request-id: 0256b4ef760000324cf80b3200000001

GET
H2 200 css
fonts.googleapis.com/ 3 KB
641 B 45ms
19ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans&display=swap

Requested by

Host: citizone2015.tk
URL: https://citizone2015.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1b484d46c585707d69102873172a893ffabd34b2b7e17fedf7b19015dbf251a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Apr 2020 06:10:33 GMT
server: ESF
date: Sun, 26 Apr 2020 06:10:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Apr 2020 06:10:33 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 44ms
18ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Slab&display=swap

Requested by

Host: citizone2015.tk
URL: https://citizone2015.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

64f723b19b5aefe4d5c199a492efcbb964107dcef8577a14908166abe9224173

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 26 Apr 2020 06:10:33 GMT
server: ESF
date: Sun, 26 Apr 2020 06:10:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 26 Apr 2020 06:10:33 GMT

GET
H2 200 bootstrap4.min.css
citizone2015.tk/css/ 141 KB
18 KB 172ms
169ms Stylesheet
text/css 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/bootstrap4.min.css
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 09:33:54 GMT
server: cloudflare
etag: W/"235ed-59010749ee480-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a8f324c-FRA
cf-request-id: 0256b4f04a0000324cf80bf200000001

GET
H2 200 bootstrap-theme.css
citizone2015.tk/css/ 26 KB
3 KB 139ms
135ms Stylesheet
text/css 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/bootstrap-theme.css
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4ea52f9efdd111f33ef6c3eaabc8289e386cac408f1c10b015b773071b4a616

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:42 GMT
server: cloudflare
etag: W/"6614-58ffbca96d880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a92324c-FRA
cf-request-id: 0256b4f04a0000324cf80c0200000001

GET
H2 200 animate.min.css
citizone2015.tk/css/ 55 KB
4 KB 145ms
142ms Stylesheet
text/css 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/animate.min.css
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 342b6776d042ef9d48de530b210a2d2d557487e4f22f27d28f069a2520c9dee8

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:42 GMT
server: cloudflare
etag: W/"dc95-58ffbca96d880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a93324c-FRA
cf-request-id: 0256b4f04a0000324cf80c1200000001

GET
H2 200 style.css
citizone2015.tk/css/ 62 KB
11 KB 149ms
146ms Stylesheet
text/css 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/style.css
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7bb08471a1e46e719fa6b1b3841665be1a74119bb2587c8a0bcfc6ffcb9d177

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 11:06:02 GMT
server: cloudflare
etag: W/"f6ff-59011be1d7a80-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a96324c-FRA
cf-request-id: 0256b4f04a0000324cf80c2200000001

GET
H2 200 font-awesome.min.css
citizone2015.tk/css/ 30 KB
7 KB 143ms
141ms Stylesheet
text/css 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/font-awesome.min.css
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5cfcdebf8f38725bebe6f58ff39a6d044806bca0220a1e0b7e3257f9ad7392d1

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:42 GMT
server: cloudflare
etag: W/"7906-58ffbca96d880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a98324c-FRA
cf-request-id: 0256b4f04a0000324cf80c3200000001

GET
H2 200 outline.css
citizone2015.tk/css/ 1 KB
408 B 145ms
142ms Stylesheet
text/css 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/outline.css
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 99943ee7ceae72abfe1b6e06758f5e4b1578fec0bc95a3b7ee9a94ebd79f6d6a

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 11:51:36 GMT
server: cloudflare
etag: W/"425-5901261130200-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: text/css
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a9c324c-FRA
cf-request-id: 0256b4f04a0000324cf80c4200000001

GET
H2 200 logo.jpg
citizone2015.tk/images/ 7 KB
7 KB 149ms
148ms Image
image/jpeg 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citizone2015.tk/images/logo.jpg
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae56ecd7196ff9c4db8b85960f155e97f589d085d2af070024dc85ac220fd462

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 12:41:28 GMT
server: cloudflare
etag: "1a98-5901313694e00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 589e242d4aac324c-FRA
content-length: 6808
cf-request-id: 0256b4f04a0000324cf80ca200000001

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 107 KB
39 KB 43ms
20ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: citizone2015.tk
URL: https://citizone2015.tk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ee24571df9bff632625eece6598e8ae8c5749228a935cce27059ee7a4bd7a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 39074
x-xss-protection: 0
server: cafe
etag: 10571670388425089980
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 26 Apr 2020 06:10:33 GMT

GET
H2 200 jquery.min.js Show response
citizone2015.tk/js/ 82 KB
28 KB 178ms
176ms Script
application/javascript 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/js/jquery.min.js
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:44 GMT
server: cloudflare
etag: W/"14979-58ffbcab55d00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4a9f324c-FRA
cf-request-id: 0256b4f04a0000324cf80c5200000001

GET
H2 200 bootstrap.min.js Show response
citizone2015.tk/js/ 48 KB
12 KB 145ms
143ms Script
application/javascript 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/js/bootstrap.min.js
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 09:43:52 GMT
server: cloudflare
etag: W/"bf30-590109843a600-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4aa0324c-FRA
cf-request-id: 0256b4f04a0000324cf80c6200000001

GET
H2 200 superfish.min.js Show response
citizone2015.tk/js/ 4 KB
2 KB 141ms
138ms Script
application/javascript 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/js/superfish.min.js
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0d9211815bb3d3d55626b254f24353727cdad4557910c62c47c85cc1523847a7

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:44 GMT
server: cloudflare
etag: W/"1141-58ffbcab55d00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4aa8324c-FRA
cf-request-id: 0256b4f04a0000324cf80c7200000001

GET
H2 200 wow.min.js Show response
citizone2015.tk/js/ 8 KB
3 KB 143ms
141ms Script
application/javascript 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/js/wow.min.js
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 167d7ca784f3d3948837ea87c90fae712a158e7f34d02fc8dcdc091aefa62c7f

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:46 GMT
server: cloudflare
etag: W/"20ea-58ffbcad3e180-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4aaa324c-FRA
cf-request-id: 0256b4f04a0000324cf80c8200000001

GET
H2 200 custom.js Show response
citizone2015.tk/js/ 1 KB
565 B 149ms
147ms Script
application/javascript 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/js/custom.js
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b70ddb4c4113dc2a9f78f9fdb871471e59c6d2d4ac158382950d1389d866c81

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 07:46:20 GMT
server: cloudflare
etag: W/"4a7-5900ef3eeab00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 589e242d4aab324c-FRA
cf-request-id: 0256b4f04a0000324cf80c9200000001

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
839 B 33ms
14ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=citizone2015.tk

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
839 B 34ms
14ms Script
application/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=citizone2015.tk

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/ 217 KB
82 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5940cce884179e3fe35babb32a8dad574f56dd03d76e6189d9c4f31c9d778cf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 83571
x-xss-protection: 0
server: cafe
etag: 1371397039064648979
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 26 Apr 2020 06:10:33 GMT

GET
DATA 200
OK truncated
/ 427 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2e9db75f1bb05cc6984dd84d9ac24f94f5ffab590ad3a566d426d3042f4d5d78

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 32ms
10ms Font
font/woff2 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans&display=swap
Origin: https://citizone2015.tk

Response headers

date: Wed, 15 Apr 2020 23:49:44 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 886849
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 9132
x-xss-protection: 0
expires: Thu, 15 Apr 2021 23:49:44 GMT

GET
H2 200 fontawesome-webfont.woff2
citizone2015.tk/css/fonts/ 75 KB
76 KB 136ms
135ms Font
application/octet-stream 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citizone2015.tk/css/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://citizone2015.tk/css/font-awesome.min.css
Origin: https://citizone2015.tk

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
cf-cache-status: MISS
last-modified: Tue, 13 Aug 2019 08:54:42 GMT
server: cloudflare
etag: W/"12d68-58ffbca96d880-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
status: 200
cache-control: max-age=14400
cf-ray: 589e242e6d44324c-FRA
cf-request-id: 0256b4f1040000324cf80d3200000001

GET
H2 200 BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2RlV9Su1cai.woff
fonts.gstatic.com/s/robotoslab/v11/ 15 KB
15 KB 31ms
9ms Font
font/woff 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v11/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2RlV9Su1cai.woff

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce677696c57a6b97fee81d149546716b76f236cf7bb35845fa771feb91914f95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Roboto+Slab&display=swap
Origin: https://citizone2015.tk

Response headers

date: Thu, 23 Apr 2020 17:38:20 GMT
x-content-type-options: nosniff
last-modified: Tue, 04 Feb 2020 23:46:05 GMT
server: sffe
age: 217933
status: 200
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 15244
x-xss-protection: 0
expires: Fri, 23 Apr 2021 17:38:20 GMT

GET
H2 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200422/r20190131/ Frame C703 0
0 9ms
5ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200422/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200422/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://citizone2015.tk/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://citizone2015.tk/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Thu, 23 Apr 2020 07:38:20 GMT
expires: Thu, 07 May 2020 07:38:20 GMT
content-type: text/html; charset=UTF-8
etag: 4094386822458569044
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4444
x-xss-protection: 0
cache-control: public, max-age=1209600
age: 253933
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 200 ctabg.png
citizone2015.tk/css/images/ 937 B
1 KB 141ms
140ms Image
image/png 2606:4700:3035::6812:2c28
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citizone2015.tk/css/images/ctabg.png
Requested by: Host: citizone2015.tk
URL: https://citizone2015.tk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6812:2c28 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bf489917ec877fafb063a1fa9e1ffb1bf971f9067aed424b8487ce38ed0c8da

Request headers

Referer: https://citizone2015.tk/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
cf-cache-status: MISS
last-modified: Wed, 14 Aug 2019 12:44:04 GMT
server: cloudflare
etag: "3a9-590131cb5ad00"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 589e242eadac324c-FRA
content-length: 937
cf-request-id: 0256b4f1250000324cf80d6200000001

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 0FAA 0
0 23ms
22ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2128318741198334&output=html&h=280&slotname=9612153600&adk=2458629886&adf=54630664&w=1200&fwrn=4&fwrnh=100&lmt=1587881151&rafmt=1&psa=0&guci=1.2.0.0.2.2.0.0&format=1200x280&url=https%3A%2F%2Fcitizone2015.tk%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1587881433337&bpp=42&bdt=234&idt=106&shv=r20200422&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=6421072198224&frm=20&pv=2&ga_vid=1643059320.1587881433&ga_sid=1587881433&ga_hid=1010920503&ga_fc=0&iag=0&icsg=175103&dssz=10&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=573&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21065473&oid=3&pvsid=2146545103837841&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8336&bc=31&ifi=1&uci=a!1&fsb=1&xpc=DgRc4kGLHG&p=https%3A//citizone2015.tk&dtd=124

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2128318741198334&output=html&h=280&slotname=9612153600&adk=2458629886&adf=54630664&w=1200&fwrn=4&fwrnh=100&lmt=1587881151&rafmt=1&psa=0&guci=1.2.0.0.2.2.0.0&format=1200x280&url=https%3A%2F%2Fcitizone2015.tk%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&adsid=NT&dt=1587881433337&bpp=42&bdt=234&idt=106&shv=r20200422&cbv=r20190131&ptt=9&saldr=aa&abxe=1&correlator=6421072198224&frm=20&pv=2&ga_vid=1643059320.1587881433&ga_sid=1587881433&ga_hid=1010920503&ga_fc=0&iag=0&icsg=175103&dssz=10&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=573&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21065473&oid=3&pvsid=2146545103837841&rx=0&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=8336&bc=31&ifi=1&uci=a!1&fsb=1&xpc=DgRc4kGLHG&p=https%3A//citizone2015.tk&dtd=124
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://citizone2015.tk/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://citizone2015.tk/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 26 Apr 2020 06:10:33 GMT
server: cafe
content-length: 46
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 26-Apr-2020 06:25:33 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
expires: Sun, 26 Apr 2020 06:10:33 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 74 KB
27 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a902f3f6bb291138692567054de342c7482edfe90db9f3d2bab061351320386

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1587573036175118"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 27875
x-xss-protection: 0
expires: Sun, 26 Apr 2020 06:10:33 GMT

GET
H2 200 ads
googleads.g.doubleclick.net/pagead/ Frame 19E9 0
0 17ms
16ms Document
text/html 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2128318741198334&output=html&adk=1812271804&adf=3025194257&lmt=1587881151&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fcitizone2015.tk%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1587881433428&bpp=4&bdt=325&idt=66&shv=r20200422&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280&nras=1&correlator=6421072198224&frm=20&pv=1&ga_vid=1643059320.1587881433&ga_sid=1587881433&ga_hid=1010920503&ga_fc=0&iag=0&icsg=699391&dssz=11&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21065473&oid=3&pvsid=2146545103837841&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8208&bc=31&ifi=1&uci=a!1&fsb=1&dtd=74

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2128318741198334&output=html&adk=1812271804&adf=3025194257&lmt=1587881151&plat=1%3A32776%2C2%3A32776%2C8%3A134250504%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C40%3A32&guci=1.2.0.0.2.2.0.0&format=0x0&url=https%3A%2F%2Fcitizone2015.tk%2F&ea=0&flash=0&pra=7&wgl=1&adsid=NT&dt=1587881433428&bpp=4&bdt=325&idt=66&shv=r20200422&cbv=r20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280&nras=1&correlator=6421072198224&frm=20&pv=1&ga_vid=1643059320.1587881433&ga_sid=1587881433&ga_hid=1010920503&ga_fc=0&iag=0&icsg=699391&dssz=11&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=21065473&oid=3&pvsid=2146545103837841&rx=0&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=8208&bc=31&ifi=1&uci=a!1&fsb=1&dtd=74
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://citizone2015.tk/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://citizone2015.tk/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 26 Apr 2020 06:10:33 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 26-Apr-2020 06:25:33 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
expires: Sun, 26 Apr 2020 06:10:33 GMT
cache-control: private

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 7 KB
6 KB 35ms
17ms XHR
application/json 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200422&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19c8b1dbc2a2e841db4888acf1af9a74922f4c9629a77357e55bb0bd7a7c75a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5228
x-xss-protection: 0

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
112 B 15ms
14ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ovlp&adf=54630664&client=ca-pub-2128318741198334&eid=21065473&et=2&fwrattr=true&io=0&saldr=aa&oa=0.00&rafmt=1&roa=0&slot=9612153600&sp=0%2C0&tgt=ins%2Faswift_0_expand.0&tr=200%2C573%2C1400%2C853&url=https%3A%2F%2Fcitizone2015.tk%2F&vp=1600x1200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Apr 2020 06:10:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
6 KB 59ms
39ms Script
text/javascript 2a00:1450:4001:815::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200422/r20190131/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sun, 26 Apr 2020 06:10:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1582746470043195"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 5456
x-xss-protection: 0
expires: Sun, 26 Apr 2020 06:10:33 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/209/ Frame 4A62 0
0 6ms
6ms Document
text/html 2a00:1450:4001:815::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/209/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/209/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://citizone2015.tk/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://citizone2015.tk/

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 5727
date: Sun, 26 Apr 2020 02:38:24 GMT
expires: Mon, 26 Apr 2021 02:38:24 GMT
last-modified: Tue, 25 Feb 2020 17:32:01 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 12729
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
58 B 14ms
13ms Image
image/gif 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=209&t=2&li=gda_r20200422&jk=2146545103837841&bg=!7-yl7PRYGZBs1DkAU4wCAAAAPFIAAAAMmQFbin_7X6Yx30aKcRXMfN-u-zTl-G9iCp1LZ2FReG9zR7rlPTjNBi6krZJTGSNYGLS9STTDtVfDKib6UmZ-RIVimHwd_OIqYwWFKd6lL4AxEik4n1pmJoq319mOdXL4inL2kcd8v4z3vqO_mhcVZoiYYKuCn_S9mg38gJkN-St_P7wowgGNDyKCTX0vD4ECSQeufeSHL_UEwLX_bSr0XpVcStstEigevjidMd_oIUpF3AognAgpYIgKGDk9kWURD4Wea4R1qYyQmtd4eSYPvD7JysUUfWbdQlPeScFsA9W97IRuiuYwi6fO6sHvKvuTqXnnMxgAqwlQE6_6OHxrgpxQxuHSSjVXKR6cE4NV_VL-oxD7DDdQMMoDoPe8NfmMuMqH_T7Tu4dO_KzjxhjQaWRgUrRg5-hGOelD9rf6qQlNDh2vr69-8w0Sar_jbkWI7E6mYnhIpKKInEMDjTs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://citizone2015.tk/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 26 Apr 2020 06:10:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.doubleclick.net/	1970-01-19 09:04:42	Name: test_cookie Value: CheckForPermission
			.citizone2015.tk/	1970-01-19 09:47:53	Name: __cfduid Value: d0144e5f087d7186b85034c9eea43c0bd1587881432

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
citizone2015.tk
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
www.googletagservices.com
2606:4700:3035::6812:2c28
2a00:1450:4001:801::2002
2a00:1450:4001:815::2001
2a00:1450:4001:815::200a
2a00:1450:4001:81e::2003
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0d9211815bb3d3d55626b254f24353727cdad4557910c62c47c85cc1523847a7
0ee24571df9bff632625eece6598e8ae8c5749228a935cce27059ee7a4bd7a4a
167d7ca784f3d3948837ea87c90fae712a158e7f34d02fc8dcdc091aefa62c7f
19c8b1dbc2a2e841db4888acf1af9a74922f4c9629a77357e55bb0bd7a7c75a6
1b484d46c585707d69102873172a893ffabd34b2b7e17fedf7b19015dbf251a7
2a902f3f6bb291138692567054de342c7482edfe90db9f3d2bab061351320386
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
2e9db75f1bb05cc6984dd84d9ac24f94f5ffab590ad3a566d426d3042f4d5d78
342b6776d042ef9d48de530b210a2d2d557487e4f22f27d28f069a2520c9dee8
4b70ddb4c4113dc2a9f78f9fdb871471e59c6d2d4ac158382950d1389d866c81
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5940cce884179e3fe35babb32a8dad574f56dd03d76e6189d9c4f31c9d778cf9
5bf489917ec877fafb063a1fa9e1ffb1bf971f9067aed424b8487ce38ed0c8da
5cfcdebf8f38725bebe6f58ff39a6d044806bca0220a1e0b7e3257f9ad7392d1
64f723b19b5aefe4d5c199a492efcbb964107dcef8577a14908166abe9224173
99943ee7ceae72abfe1b6e06758f5e4b1578fec0bc95a3b7ee9a94ebd79f6d6a
a47f17d6ebbf4621d8fe87ab790d8d8fb5c3086629194d9ff2d64faaa6e46ab6
a7bb08471a1e46e719fa6b1b3841665be1a74119bb2587c8a0bcfc6ffcb9d177
ae56ecd7196ff9c4db8b85960f155e97f589d085d2af070024dc85ac220fd462
c4ea52f9efdd111f33ef6c3eaabc8289e386cac408f1c10b015b773071b4a616
ce677696c57a6b97fee81d149546716b76f236cf7bb35845fa771feb91914f95
d05ecc61dc0d9b480223e8ad5baf1ca930a70759042265313c2293ed9df7bea8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f16ab224bb962910558715c82f58c10c3ed20f153ddfaa199029f141b5b0255c

citizone2015.tk Open in urlscan Pro 2606:4700:3035::6812:2c28 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

32 Requests

100 %HTTPS

100 %IPv6

8 Domains

9 Subdomains

6 IPs

2 Countries

361 kBTransfer

998 kBSize

2 Cookies

17 Outgoing links

Redirected requests

32 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

citizone2015.tk Open in urlscan Pro
2606:4700:3035::6812:2c28 Public Scan

Screenshot
Live screenshot

Full Image

32
Requests

100 %
HTTPS

100 %
IPv6

8
Domains

9
Subdomains

6
IPs

2
Countries

361 kB
Transfer

998 kB
Size

2
Cookies

32 HTTP transactions
1 data transactions