urlscan.io logo urlscan.io
SecurityTrails logo

refund2.weshareall.co.kr Open in urlscan Pro
158.247.204.166  Public Scan

Go To Rescan Add Verdict Report
URL: https://refund2.weshareall.co.kr/
Submission: On March 28 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 3 countries across 11 domains to perform 39 HTTP transactions. The main IP is 158.247.204.166, located in Seoul, Korea, Republic Of and belongs to AS-CHOOPA, US. The main domain is refund2.weshareall.co.kr.
TLS certificate: Issued by R3 on March 28th 2023. Valid for: 3 months.
This is the only time refund2.weshareall.co.kr was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

14    158.247.204.166 (Seoul, Korea, Republic Of)

ASN20473 (AS-CHOOPA, US)
PTR: 158.247.204.166.vultrusercontent.com
refund2.weshareall.co.kr
1    2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
6    2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cdn.ampproject.org
1    2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
5    2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
adservice.google.com
1    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
www.googleadservices.com
1    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
partner.googleadservices.com
1    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.de
3    2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
3    2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
Apex Domain
Subdomains		 Transfer
14 weshareall.co.kr
refund2.weshareall.co.kr
77 KB
9 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 108
tpc.googlesyndication.com — Cisco Umbrella Rank: 135
202 KB
4 google.com
adservice.google.com — Cisco Umbrella Rank: 68
www.google.com — Cisco Umbrella Rank: 2
3 KB
4 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 29
12 KB
3 google.de
adservice.google.de — Cisco Umbrella Rank: 8820
www.google.de — Cisco Umbrella Rank: 6058
1 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 168
partner.googleadservices.com — Cisco Umbrella Rank: 886
3 KB
1 gstatic.com
fonts.gstatic.com
44 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
65 KB
1 ampproject.org
cdn.ampproject.org — Cisco Umbrella Rank: 396
8 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 194
11 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1 KB
39 11
Domain Requested by
14 refund2.weshareall.co.kr refund2.weshareall.co.kr
6 pagead2.googlesyndication.com refund2.weshareall.co.kr
pagead2.googlesyndication.com
tpc.googlesyndication.com
4 googleads.g.doubleclick.net 1 redirects pagead2.googlesyndication.com
www.googletagmanager.com
3 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
3 www.google.com 1 redirects refund2.weshareall.co.kr
tpc.googlesyndication.com
2 www.google.de refund2.weshareall.co.kr
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 www.googleadservices.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 www.googletagmanager.com refund2.weshareall.co.kr
1 cdn.ampproject.org refund2.weshareall.co.kr
1 cdnjs.cloudflare.com refund2.weshareall.co.kr
1 fonts.googleapis.com refund2.weshareall.co.kr
39 15

This site contains no links.

Subject Issuer Validity Valid
refund2.weshareall.co.kr
R3		 2023-03-28 -
2023-06-26		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
misc-sni.google.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
www.googleadservices.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
*.google.de
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
*.google.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
www.google.de
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-03-06 -
2023-05-29		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://refund2.weshareall.co.kr/
Frame ID: B1C8E12816ECC0739B3680F7F5F5E761
Requests: 32 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230323/r20190131/zrt_lookup.html
Frame ID: 49741B0A2C915D3C3BEECC4B989F0127
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4141220719940098&output=html&adk=1812271804&adf=3025194257&lmt=1679969026&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x810_l%7C500x810_r&format=0x0&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1679969026411&bpp=4&bdt=677&idt=90&shv=r20230323&mjsv=m202303210101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1318945145031&frm=20&pv=2&ga_vid=1243297295.1679969027&ga_sid=1679969027&ga_hid=111612590&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44777876%2C44759837%2C44759876%2C31073099%2C31073105%2C31073262&oid=2&pvsid=4372523904794128&tmod=1528256991&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=118
Frame ID: A75D3D83E13AC5B8FEC633C86EF335F9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: DE2414F971E2846F40A8AC091CB51423
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 921794D746D6D83270A8A1C9CC1561B2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

기본 페이지 - 제목

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

39
Requests

97 %
HTTPS

86 %
IPv6

11
Domains

15
Subdomains

14
IPs

3
Countries

424 kB
Transfer

1207 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&label=AhvYCJnZuJcDEP-cibUo&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&gtm_ee=1&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=AksiZP6sHoPA9u8P-YuKuAc&sscte=1&crd=&pscrd=Ek9DaEVJOFAyRW9RWVF6NjdnMGJydThOZXVBUkltQU9XWTExTVpwbFJQQ3lONE9iMnMzNUk2VlRyUWNVOHYyLTlBU05TTEFYLUg5bkdsNElzGlhDaEFJOFAyRW9RWVFvTGo1X2Fhczktdy1FaTRBY0I1OEx1b2VTaUM2X1R2SHJnc1ZkYTgxZXdRQ1dUQU10RWYxdGtYVDhvcVhkaFJ0MkR5ckY3YkNWWV9J HTTP 302
  • https://www.google.com/pagead/1p-conversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&label=AhvYCJnZuJcDEP-cibUo&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&gtm_ee=1&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOFAyRW9RWVF6NjdnMGJydThOZXVBUkltQU9XWTExTVpwbFJQQ3lONE9iMnMzNUk2VlRyUWNVOHYyLTlBU05TTEFYLUg5bkdsNElzGlhDaEFJOFAyRW9RWVFvTGo1X2Fhczktdy1FaTRBY0I1OEx1b2VTaUM2X1R2SHJnc1ZkYTgxZXdRQ1dUQU10RWYxdGtYVDhvcVhkaFJ0MkR5ckY3YkNWWV9J&is_vtc=1&ocp_id=AksiZP6sHoPA9u8P-YuKuAc&cid=CAQSKQDUE5ymFJUwjgit_zaux0ICMXq7XJFiE2LTmBQf2PuseLfrD2ypKJ8T&random=1646395857 HTTP 302
  • https://www.google.de/pagead/1p-conversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&label=AhvYCJnZuJcDEP-cibUo&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&gtm_ee=1&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOFAyRW9RWVF6NjdnMGJydThOZXVBUkltQU9XWTExTVpwbFJQQ3lONE9iMnMzNUk2VlRyUWNVOHYyLTlBU05TTEFYLUg5bkdsNElzGlhDaEFJOFAyRW9RWVFvTGo1X2Fhczktdy1FaTRBY0I1OEx1b2VTaUM2X1R2SHJnc1ZkYTgxZXdRQ1dUQU10RWYxdGtYVDhvcVhkaFJ0MkR5ckY3YkNWWV9J&is_vtc=1&ocp_id=AksiZP6sHoPA9u8P-YuKuAc&cid=CAQSKQDUE5ymFJUwjgit_zaux0ICMXq7XJFiE2LTmBQf2PuseLfrD2ypKJ8T&random=1646395857&ipr=y&prhg=0

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
refund2.weshareall.co.kr/ 		52 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
d7b3e9b1e989259688764e7da0c722a2e6e5d2bb4f38fd49a134483eb700f473

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
20
cache-control
max-age=0
content-encoding
gzip
content-length
12396
content-type
text/html; charset=UTF-8
date
Tue, 28 Mar 2023 02:03:45 GMT
expires
Tue, 28 Mar 2023 02:03:21 GMT
link
<https://refund2.weshareall.co.kr/wp-json/>; rel="https://api.w.org/", <https://refund2.weshareall.co.kr/wp-json/wp/v2/pages/134>; rel="alternate"; type="application/json", <https://refund2.weshareall.co.kr/>; rel=shortlink
server
nginx
vary
Accept-Encoding
x-cache
HIT
x-ua-compatible
IE=edge
style.min.css
refund2.weshareall.co.kr/wp-includes/css/dist/block-library/ 		93 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-includes/css/dist/block-library/style.min.css?ver=6.1.1
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-172a9"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
classic-themes.min.css
refund2.weshareall.co.kr/wp-includes/css/ 		217 B
349 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-includes/css/classic-themes.min.css?ver=1
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-d9"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
widget-areas.min.css
refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/css/components/ 		3 KB
855 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.2.4
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-d1e"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
main.min.css
refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/css/ 		19 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.2.4
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-4c6e"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
style.css
refund2.weshareall.co.kr/wp-content/themes/generatepress-child/ 		2 KB
1015 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/themes/generatepress-child/style.css?ver=1679968246
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
2363e1c5309c6b30b039e6b355e4b7cc007f86badce8601ce401e69ea19489aa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-613"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%3A300%2Cregular%2Citalic%2C600%2C700&display=auto&ver=3.2.4
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
97d876b0796d55e1a4d9dec67f958fd62674617e5417b92e4584c0397974e9d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 28 Mar 2023 00:04:20 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 28 Mar 2023 02:03:45 GMT
public.css
refund2.weshareall.co.kr/wp-content/plugins/recent-posts-widget-with-thumbnails/ 		1 KB
672 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/plugins/recent-posts-widget-with-thumbnails/public.css?ver=7.1.1
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
585bd5564b22ffef23d4c9bafc646cdb1e5864b1bf69ff2bc434edd67af5296b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-43a"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
navigation-branding-flex.min.css
refund2.weshareall.co.kr/wp-content/plugins/gp-premium/menu-plus/functions/css/ 		3 KB
778 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/plugins/gp-premium/menu-plus/functions/css/navigation-branding-flex.min.css?ver=2.1.2
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
7c8eb7fd8354e29e58e77290872b6e05a65404a4d16fe26996b72b6f2f606281

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-a06"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
jquery.min.js
refund2.weshareall.co.kr/wp-includes/js/jquery/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-includes/js/jquery/jquery.min.js?ver=3.6.1
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:47 GMT
server
nginx
etag
W/"642247f7-15e54"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
jquery-migrate.min.js
refund2.weshareall.co.kr/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:47 GMT
server
nginx
etag
W/"642247f7-2bd8"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ 		57 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
4537434
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
10301
last-modified
Mon, 04 May 2020 16:10:08 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e60-e4d2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BsKcaFwbl3kml2bv8%2FHD14qc2xmpeo9xVnvfJFcwPN27pjjlHlUsdH%2FNZ78PxOukz1bjcAQiFQCejahvesypeNuCwM4d%2FCKKJI9i6mSGsqfWHBv5yyPDLOySTnCNc6s%2B%2F98tLmcsSwlyZn1VXIATXwRs"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7aec4c6af88539cd-FRA
expires
Sun, 17 Mar 2024 02:03:45 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		140 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4141220719940098
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa5f3d278210142e012a866784dcaf7afe43133c413d4db08c5fc78f59a318d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://refund2.weshareall.co.kr/
Origin
https://refund2.weshareall.co.kr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48717
x-xss-protection
0
server
cafe
etag
7512498540711556973
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 28 Mar 2023 02:03:46 GMT
amp-auto-ads-0.1.js
cdn.ampproject.org/v0/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d5bbad916e1cb3ac783edb5f862190cc83c06ee0a12bb9dcd982b5d27ae83477
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
date
Tue, 28 Mar 2023 02:03:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7580
x-xss-protection
0
server
sffe
etag
"1f8d9f2f90c092c6"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=604800, stale-while-revalidate=604800
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Tue, 28 Mar 2023 02:03:46 GMT
js
www.googletagmanager.com/gtag/ 		176 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-10848718463
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6bce7e7d967968305ccc816282baaf9ee36603bac6b0fec07acd8459289a762d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65760
x-xss-protection
0
last-modified
Tue, 28 Mar 2023 01:21:01 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 28 Mar 2023 02:03:46 GMT
sticky.min.js
refund2.weshareall.co.kr/wp-content/plugins/gp-premium/menu-plus/functions/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/plugins/gp-premium/menu-plus/functions/js/sticky.min.js?ver=2.1.2
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
033c75b293fe53bd9330531b8ff1ed4bcc4722563ea908d73e0b6e4b115202fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-2146"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
menu.min.js
refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/js/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.2.4
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-1b1c"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
navigation-search.min.js
refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/js/ 		2 KB
937 B 		Script
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.2.4
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
f4d0c6a094ec876c2dbea780dac5655e44bc1ec2b0c9c492f8513581879c89c5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-858"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
lazyload.min.js
refund2.weshareall.co.kr/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://refund2.weshareall.co.kr/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
158.247.204.166 Seoul, Korea, Republic Of, ASN20473 (AS-CHOOPA, US),
Reverse DNS
158.247.204.166.vultrusercontent.com
Software
nginx /
Resource Hash
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
last-modified
Tue, 28 Mar 2023 01:50:46 GMT
server
nginx
etag
W/"642247f6-2063"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v34/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A300%2Cregular%2Citalic%2C600%2C700&display=auto&ver=3.2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://refund2.weshareall.co.kr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 21 Mar 2023 08:37:39 GMT
x-content-type-options
nosniff
age
581167
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44856
x-xss-protection
0
last-modified
Mon, 15 Aug 2022 18:20:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 20 Mar 2024 08:37:39 GMT
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/ 		350 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4141220719940098
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a3b86663206c30b00ff18a0032c061a51e8f3928f08df639c4be350c6a9d8a52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
119752
x-xss-protection
0
server
cafe
etag
2938051785674395397
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 28 Mar 2023 02:03:46 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230323/r20190131/ Frame 4974 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20230323/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4141220719940098
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ca070dfc7785775cbf5cce16064029ee534259de42c6d9de10e476e710000e93
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://refund2.weshareall.co.kr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
32357
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
4549
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 27 Mar 2023 17:04:29 GMT
etag
2378337311435320485
expires
Mon, 10 Apr 2023 17:04:29 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10848718463/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10848718463/?random=1679969026442&cv=11&fst=1679969026442&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10848718463
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f864b05aaaa68171d878002e07cbfbea01375a2805534fd230f359a08d293e6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1249
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.googleadservices.com/pagead/conversion/10848718463/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/10848718463/?random=1679969026454&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&label=AhvYCJnZuJcDEP-cibUo&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&gtm_ee=1&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10848718463
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
278737f279745fe8ea1b7c1a82f2a23a7677a48d0f1d8cf7cee90115ae113d89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1580
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookie.js
partner.googleadservices.com/gampad/ 		399 B
609 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=refund2.weshareall.co.kr&callback=_gfp_s_&client=ca-pub-4141220719940098
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ea22b0558a34519e13e08eb0e516742705966055d5e7e0923b9c77fad4206a55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
257
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ 		107 B
531 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=refund2.weshareall.co.kr
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
456 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=refund2.weshareall.co.kr
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame A75D 		11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4141220719940098&output=html&adk=1812271804&adf=3025194257&lmt=1679969026&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=500x810_l%7C500x810_r&format=0x0&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1679969026411&bpp=4&bdt=677&idt=90&shv=r20230323&mjsv=m202303210101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1318945145031&frm=20&pv=2&ga_vid=1243297295.1679969027&ga_sid=1679969027&ga_hid=111612590&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759927%2C44777876%2C44759837%2C44759876%2C31073099%2C31073105%2C31073262&oid=2&pvsid=4372523904794128&tmod=1528256991&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=118
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
959a18a91424e7ba503552128f6a0f9b60bc34bdaebbf1c5f71ba42615758a4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://refund2.weshareall.co.kr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
4655
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 28 Mar 2023 02:03:46 GMT
expires
Tue, 28 Mar 2023 02:03:46 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
www.google.com/pagead/1p-user-list/10848718463/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/10848718463/?random=1679969026442&cv=11&fst=1679968800000&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2794316171&rmt_tld=0&ipr=y
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Mar 2023 02:03:46 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/10848718463/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/10848718463/?random=1679969026442&cv=11&fst=1679968800000&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2794316171&rmt_tld=1&ipr=y
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Mar 2023 02:03:46 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-conversion/10848718463/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Fre...
  • https://www.google.com/pagead/1p-conversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.k...
  • https://www.google.de/pagead/1p-conversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr...
42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-conversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&label=AhvYCJnZuJcDEP-cibUo&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&gtm_ee=1&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOFAyRW9RWVF6NjdnMGJydThOZXVBUkltQU9XWTExTVpwbFJQQ3lONE9iMnMzNUk2VlRyUWNVOHYyLTlBU05TTEFYLUg5bkdsNElzGlhDaEFJOFAyRW9RWVFvTGo1X2Fhczktdy1FaTRBY0I1OEx1b2VTaUM2X1R2SHJnc1ZkYTgxZXdRQ1dUQU10RWYxdGtYVDhvcVhkaFJ0MkR5ckY3YkNWWV9J&is_vtc=1&ocp_id=AksiZP6sHoPA9u8P-YuKuAc&cid=CAQSKQDUE5ymFJUwjgit_zaux0ICMXq7XJFiE2LTmBQf2PuseLfrD2ypKJ8T&random=1646395857&ipr=y&prhg=0
Requested by
Host: refund2.weshareall.co.kr
URL: https://refund2.weshareall.co.kr/
Protocol
H2
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 28 Mar 2023 02:03:46 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 28 Mar 2023 02:03:46 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.de/pagead/1p-conversion/10848718463/?random=1350940317&cv=11&fst=1679969026454&bg=ffffff&guid=ON&async=1&gtm=45be33r0&u_w=1600&u_h=1200&url=https%3A%2F%2Frefund2.weshareall.co.kr%2F&label=AhvYCJnZuJcDEP-cibUo&hn=www.googleadservices.com&frm=0&tiba=%EA%B8%B0%EB%B3%B8%20%ED%8E%98%EC%9D%B4%EC%A7%80%20-%20%EC%A0%9C%EB%AA%A9&gtm_ee=1&auid=1732541613.1679969026&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOFAyRW9RWVF6NjdnMGJydThOZXVBUkltQU9XWTExTVpwbFJQQ3lONE9iMnMzNUk2VlRyUWNVOHYyLTlBU05TTEFYLUg5bkdsNElzGlhDaEFJOFAyRW9RWVFvTGo1X2Fhczktdy1FaTRBY0I1OEx1b2VTaUM2X1R2SHJnc1ZkYTgxZXdRQ1dUQU10RWYxdGtYVDhvcVhkaFJ0MkR5ckY3YkNWWV9J&is_vtc=1&ocp_id=AksiZP6sHoPA9u8P-YuKuAc&cid=CAQSKQDUE5ymFJUwjgit_zaux0ICMXq7XJFiE2LTmBQf2PuseLfrD2ypKJ8T&random=1646395857&ipr=y&prhg=0
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230323&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
46340b8ba9fc29d3b76d49e6ad94b57f716d23eab72dd1c983fa740090b30ad4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:46 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11240
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202303210101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4141220719940098&plah=refund2.weshareall.co.kr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 28 Mar 2023 02:03:47 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame DE24 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://refund2.weshareall.co.kr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
20014
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 27 Mar 2023 20:30:13 GMT
expires
Tue, 26 Mar 2024 20:30:13 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 9217 		783 B
954 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
2ae1a0f4006f5a8f531574458bc30c6abf6895db9ef018f4f88eeb743a2d2a08
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-h2BypF40B6wbGpiWozsZyQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://refund2.weshareall.co.kr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
513
content-security-policy
script-src 'report-sample' 'nonce-h2BypF40B6wbGpiWozsZyQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 28 Mar 2023 02:03:47 GMT
expires
Tue, 28 Mar 2023 02:03:47 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
sodar
pagead2.googlesyndication.com/pagead/ Frame 9217 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230323&jk=4372523904794128&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers
t4_aWeuLa_BO9IGQ3R3HcB0TaFNoER_W7PQrl5RFgV0.js
pagead2.googlesyndication.com/bg/ Frame DE24 		36 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/t4_aWeuLa_BO9IGQ3R3HcB0TaFNoER_W7PQrl5RFgV0.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b78fda59eb8b6bf04ef48190dd1dc7701d13685368111fd6ecf42b979445815d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Sun, 26 Mar 2023 18:13:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
114622
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14115
x-xss-protection
0
last-modified
Mon, 20 Mar 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 25 Mar 2024 18:13:25 GMT
generate_204
tpc.googlesyndication.com/ Frame DE24 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?QWUEnA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:03:47 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230323&jk=4372523904794128&bg=!mZqlms7NAAbO2UOH7tk7ADkAdvg8WjvUTgVz-7qvT3AZNYjQO5kXxEGN3UiaXteX4ZFEL3IkPB6ix_mI-_sQdrvOce0EfccvZzoCAAAAWVIAAAADaAEHCgBlVWwZSqUcCK5JfvRFZVpDspeNKt6nQwTQIDs_oQpntjfa73nWIspuZGnvWz9-UHEJ4h6VsnxJQ0s19zPBWugTCl14XDNgr9JOTwi42Hy1CTPAgL_sCiZLXLDiP1iB6dAHo2s33h-ZAqxQLR0LHXCV_b-0lCHQrVwARV8yPavCfL_s6EBxy995aJo8_glSPqqE3Wmkcccz994UpQVXBLVwySuGxTV1cx4LAFI1Gq4mMdyj0y5nar-xqmmvE0_QtX6k_cOaVnG7WghPKh7Raowc7bRxzFO66kwVsxjB5AkSebiH-MiFRm5pJA_Hb4Se8P2Hcim6nzL4OGYTAYd_CkJIA46xjVLVB7AnQAIg7CcRXDKSNTZ5Qy61S9CfWQiBrwouxmny9OLMV3U_zK8WgiN-G5AoRIhDhAidfcsrRbwS_0Vo8WgiDn1Lln7WV306k6bnQj7FSu3TO7b3eI0FaqYXWW0EqTAk3-HBjDlBPv03e7EB2dHpHeflChc9oLWJNcQ26LWI6s3BdJJwaRUk0whGG4WMum-trPXu1TrDxYnIkR0X3Dx2_ds1EjlD1kXP4-k7la9wI6RxydL9Hw3PzCGUMF5LMNnr4U54GCAmKHULQLjacVyTrrOK0ygy2RWrOOqJltzktk3Ut4uLIjP1TgUj6O71tVaItlZJEIsbUDfJ0xzqh8lUpiWVOShJxG9zMwNOsK1d7jv5Wj-wQRdx70RFrxFKFqJJe99qACstbsj8tAdTwZQSyXxQ1UDKKOtP3BqIXzZM4Fy_9c5Bxvd3CIzZbpQjzdG54xWy4vzV7wdLwiU9hJsi6cZV0xc2nil5BEv952PUAbBem3_EBxOklg6t0pjzC_FpruIGXRvck5bngiQBTru_bigd9Hj3v02Lt6doWDkPWOKye_5QlUjtg2XW4Qmat5plFRk-XH3eKcRn0a7-L8M8jv9g7rW86jxJN_d6073vuABHPXRlZKkFRPMsUFkTG-vG2bMWc-jORn-TQcE3tpRa6aAT8bx8UDNEqOYWiqVAoEblxWZx_q3B0fpoFPcJ7so
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://refund2.weshareall.co.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 boolean| credentialless undefined| $ function| jQuery function| gtag object| dataLayer function| generateStickyDebounce function| _createClass function| _classCallCheck function| RocketBrowserCompatibilityChecker object| RocketPreloadLinksConfig object| generatepressMenu object| generatepressNavSearch object| lazyLoadOptions object| AMP object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_tag_data object| google_reactive_ads_global_state object| adsbygoogle object| google_sa_queue function| google_process_slots function| google_spfd number| google_unique_id object| google_sv_map number| google_rum_task_id_counter string| google_user_agent_client_hint object| google_tag_manager object| GooglebQhCsO function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ boolean| _gfp_a_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages function| LazyLoad object| GoogleGcLKhOms object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| google_image_requests

4 Cookies

Domain/Path Name / Value
.weshareall.co.kr/ Name: _gcl_au
Value: 1.1.1732541613.1679969026
.weshareall.co.kr/ Name: __gads
Value: ID=395c54a6172891fb-223f49ca70dd00b9:T=1679969026:RT=1679969026:S=ALNI_Mad_ZwiLCZ6vnP8rKJSaVdbZC7aUg
.weshareall.co.kr/ Name: __gpi
Value: UID=00000bcd687e94aa:T=1679969026:RT=1679969026:S=ALNI_MY9Uho1vNWyp_6nCYUXVTazDLqOSA
.doubleclick.net/ Name: IDE
Value: AHWqTUmg9R22E1LIi7ZOkOdU_EIljS3OyKVwFuurm69n4GPg3iqpZHqITS-CNwl4S60

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
cdn.ampproject.org
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
refund2.weshareall.co.kr
tpc.googlesyndication.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
142.250.186.98
158.247.204.166
2606:4700::6811:180e
2a00:1450:4001:800::2002
2a00:1450:4001:801::2001
2a00:1450:4001:806::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:810::2002
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:829::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:830::200a
2a00:1450:4001:831::2008
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
033c75b293fe53bd9330531b8ff1ed4bcc4722563ea908d73e0b6e4b115202fd
0468af8d74ba377eec707308168b6bfcd146fe0a2669a11a9af0128ad85b3bc2
2363e1c5309c6b30b039e6b355e4b7cc007f86badce8601ce401e69ea19489aa
278737f279745fe8ea1b7c1a82f2a23a7677a48d0f1d8cf7cee90115ae113d89
2ae1a0f4006f5a8f531574458bc30c6abf6895db9ef018f4f88eeb743a2d2a08
46340b8ba9fc29d3b76d49e6ad94b57f716d23eab72dd1c983fa740090b30ad4
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
585bd5564b22ffef23d4c9bafc646cdb1e5864b1bf69ff2bc434edd67af5296b
5a5f39391fbf5b06db84b8f9716d53de575ee97a627d2c5f12f79a991a671eb5
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6bce7e7d967968305ccc816282baaf9ee36603bac6b0fec07acd8459289a762d
775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1
7c8eb7fd8354e29e58e77290872b6e05a65404a4d16fe26996b72b6f2f606281
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
8aa5f3d278210142e012a866784dcaf7afe43133c413d4db08c5fc78f59a318d
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
959a18a91424e7ba503552128f6a0f9b60bc34bdaebbf1c5f71ba42615758a4f
97d876b0796d55e1a4d9dec67f958fd62674617e5417b92e4584c0397974e9d9
a3b86663206c30b00ff18a0032c061a51e8f3928f08df639c4be350c6a9d8a52
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b78fda59eb8b6bf04ef48190dd1dc7701d13685368111fd6ecf42b979445815d
c324ef26b20264369e4568dc9ef1c5cb1f325f6bc4e8b7c01f7fe93fa353276a
ca070dfc7785775cbf5cce16064029ee534259de42c6d9de10e476e710000e93
cc7403bab52ed166e24ea9324241045af370be482f5b594468f4a6ac6e7e7981
d5bbad916e1cb3ac783edb5f862190cc83c06ee0a12bb9dcd982b5d27ae83477
d7b3e9b1e989259688764e7da0c722a2e6e5d2bb4f38fd49a134483eb700f473
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab
ea22b0558a34519e13e08eb0e516742705966055d5e7e0923b9c77fad4206a55
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4d0c6a094ec876c2dbea780dac5655e44bc1ec2b0c9c492f8513581879c89c5
f864b05aaaa68171d878002e07cbfbea01375a2805534fd230f359a08d293e6c