oneclickroot.com Open in urlscan Pro
2606:4700:3031::6815:3306 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.oneclickroot.com/download-apk/
Effective URL:
https://oneclickroot.com/download-apk/
Submission Tags: falconsandbox
Submission: On June 06 via api (June 6th 2021, 5:27:56 pm UTC) from US

Summary HTTP 217 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 43 IPs in 7 countries across 33 domains to perform 217 HTTP transactions. The main IP is 2606:4700:3031::6815:3306, located in United States and belongs to CLOUDFLARENET, US. The main domain is oneclickroot.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 1st 2021. Valid for: a year.

This is the only time oneclickroot.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700:303... 2606:4700:3031::6815:3306	13335 (CLOUDFLAR...) (CLOUDFLARENET)
56	2606:4700:303... 2606:4700:3033::ac43:d826	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	143.204.98.56 143.204.98.56	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:3::485 2a04:4e42:3::485	54113 (FASTLY) (FASTLY)
11	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2	151.139.242.29 151.139.242.29	33438 (HIGHWINDS2) (HIGHWINDS2)
1	2606:4700:303... 2606:4700:3034::6815:4303	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
3	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:dd1d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	52.85.170.51 52.85.170.51	16509 (AMAZON-02) (AMAZON-02)
1	2600:1901:0:b... 2600:1901:0:bc29::	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
28	2a03:2880:f04... 2a03:2880:f045:10:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2606:2800:234... 2606:2800:234:46c:e8b:1e2f:2bd:694	15133 (EDGECAST) (EDGECAST)
4	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1	52.85.170.61 52.85.170.61	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:400c:c04::9c	15169 (GOOGLE) (GOOGLE)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1	52.85.170.33 52.85.170.33	16509 (AMAZON-02) (AMAZON-02)
6	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	198.145.13.14 198.145.13.14	2044 (IINET-2044) (IINET-2044)
6	2a03:2880:f14... 2a03:2880:f145:82:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2 6	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
20	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	37.157.6.253 37.157.6.253	198622 (ADFORM) (ADFORM)
1	213.202.235.10 213.202.235.10	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1 1	34.246.227.69 34.246.227.69	16509 (AMAZON-02) (AMAZON-02)
2 2	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
2 2	185.64.189.115 185.64.189.115	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:61f8:e3:2497:5dcb	16509 (AMAZON-02) (AMAZON-02)
1	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
217	43

2 2606:4700:3031::6815:3306 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.oneclickroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
oneclickroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

56 2606:4700:3033::ac43:d826 (United States)

ASN13335 (CLOUDFLARENET, US)

oneclickroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.oneclickroot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.56 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-56.fra50.r.cloudfront.net

script.tapfiliate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.139.242.29 (United States)

ASN33438 (HIGHWINDS2, US)

images.dmca.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::6815:4303 (United States)

ASN13335 (CLOUDFLARENET, US)

translations.sking.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:dd1d (United States)

ASN13335 (CLOUDFLARENET, US)

static.getclicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.170.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-170-51.bud50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:bc29:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

cdn.mxpnl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a03:2880:f045:10:face:b00c:0:3 (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:46c:e8b:1e2f:2bd:694 (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.170.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-170-61.bud50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.170.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-170-33.bud50.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.145.13.14 (Portland, United States)

ASN2044 (IINET-2044, US)
PTR: getclicky.com

in.getclicky.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a03:2880:f145:82:face:b00c:0:25de (Amsterdam, Netherlands)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.253 (Denmark)

ASN198622 (ADFORM, DK)
PTR: s1.adform.net

track.seadform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.202.235.10 (Düsseldorf, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

m.exactag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.246.227.69 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.252.103 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.189.115 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:61f8:e3:2497:5dcb (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

scontent-frt3-2.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

scontent-frt3-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	oneclickroot.com 1 redirects www.oneclickroot.com oneclickroot.com	362 KB
31	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	343 KB
28	fbcdn.net static.xx.fbcdn.net scontent-frt3-2.xx.fbcdn.net scontent-frt3-1.xx.fbcdn.net	757 KB
21	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net	80 KB
11	google.com 2 redirects apis.google.com adservice.google.com www.google.com	93 KB
9	gstatic.com fonts.gstatic.com www.gstatic.com	151 KB
6	facebook.com www.facebook.com	46 KB
4	googletagservices.com www.googletagservices.com	139 KB
4	google.de adservice.google.de www.google.de	2 KB
4	google-analytics.com www.google-analytics.com	19 KB
3	twitter.com platform.twitter.com syndication.twitter.com	132 KB
3	bing.com bat.bing.com	9 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	62 KB
3	googleapis.com fonts.googleapis.com	2 KB
2	pubmatic.com 2 redirects image6.pubmatic.com	1 KB
2	openx.net 2 redirects rtb.openx.net	763 B
2	googleadservices.com www.googleadservices.com partner.googleadservices.com	15 KB
2	facebook.net connect.facebook.net	67 KB
2	cloudflare.com cdnjs.cloudflare.com	89 KB
2	getclicky.com static.getclicky.com in.getclicky.com	6 KB
2	wp.com stats.wp.com pixel.wp.com	3 KB
2	dmca.com images.dmca.com	3 KB
1	innovid.com ag.innovid.com	297 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com	460 B
1	everesttech.net 1 redirects pixel.everesttech.net	376 B
1	quantserve.com cms.quantserve.com	464 B
1	exactag.com m.exactag.com	1 KB
1	seadform.net track.seadform.net
1	googletagmanager.com www.googletagmanager.com	35 KB
1	mxpnl.com cdn.mxpnl.com	25 KB
1	sking.co translations.sking.co	64 KB
1	jsdelivr.net cdn.jsdelivr.net	1 KB
1	tapfiliate.com script.tapfiliate.com	4 KB
217	33

	Domain	Requested by
56	oneclickroot.com	oneclickroot.com
26	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
20	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
14	googleads.g.doubleclick.net	pagead2.googlesyndication.com www.googleadservices.com googleads.g.doubleclick.net
11	pagead2.googlesyndication.com	oneclickroot.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
8	fonts.gstatic.com	fonts.googleapis.com
6	www.google.com	2 redirects oneclickroot.com googleads.g.doubleclick.net tpc.googlesyndication.com
6	www.facebook.com	connect.facebook.net static.xx.fbcdn.net
5	cm.g.doubleclick.net	googleads.g.doubleclick.net
4	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
4	www.google-analytics.com	oneclickroot.com www.google-analytics.com
3	bat.bing.com	oneclickroot.com bat.bing.com
3	fonts.googleapis.com	oneclickroot.com googleads.g.doubleclick.net
3	apis.google.com	oneclickroot.com apis.google.com
2	image6.pubmatic.com	2 redirects
2	rtb.openx.net	2 redirects
2	www.google.de	oneclickroot.com
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	platform.twitter.com	oneclickroot.com platform.twitter.com
2	connect.facebook.net	oneclickroot.com connect.facebook.net
2	cdnjs.cloudflare.com	oneclickroot.com cdnjs.cloudflare.com
2	images.dmca.com	oneclickroot.com
2	www.oneclickroot.com	1 redirects oneclickroot.com
1	scontent-frt3-1.xx.fbcdn.net	www.facebook.com
1	scontent-frt3-2.xx.fbcdn.net	www.facebook.com
1	ag.innovid.com	googleads.g.doubleclick.net
1	pixel.rubiconproject.com	1 redirects
1	pixel.everesttech.net	1 redirects
1	cms.quantserve.com	googleads.g.doubleclick.net
1	m.exactag.com	googleads.g.doubleclick.net
1	track.seadform.net	googleads.g.doubleclick.net
1	www.gstatic.com	googleads.g.doubleclick.net
1	syndication.twitter.com	platform.twitter.com
1	in.getclicky.com	static.getclicky.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	vars.hotjar.com	static.hotjar.com
1	www.googleadservices.com	www.googletagmanager.com
1	script.hotjar.com	static.hotjar.com
1	pixel.wp.com	oneclickroot.com
1	www.googletagmanager.com	oneclickroot.com
1	cdn.mxpnl.com	oneclickroot.com
1	static.hotjar.com	oneclickroot.com
1	static.getclicky.com	oneclickroot.com
1	stats.wp.com	oneclickroot.com
1	translations.sking.co	oneclickroot.com
1	cdn.jsdelivr.net	oneclickroot.com
1	script.tapfiliate.com	oneclickroot.com
217	49

This site contains links to these domains. Also see Links.

Domain
oneclickjailbreak.com
www.facebook.com
twitter.com
www.youtube.com
www.dmca.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-04-01` - `2022-03-31`	a year	crt.sh
tapfiliate.com Amazon	`2020-11-20` - `2021-12-21`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
images.dmca.com Go Daddy Secure Certificate Authority - G2	`2020-03-13` - `2022-04-04`	2 years	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
*.apis.google.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.hotjar.com Amazon	`2020-12-25` - `2022-01-23`	a year	crt.sh
*.mxpnl.com RapidSSL RSA CA 2018	`2019-07-29` - `2021-07-28`	2 years	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-04-12` - `2021-10-12`	6 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-05-26` - `2021-08-24`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-05` - `2021-11-09`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.getclicky.com Sectigo RSA Domain Validation Secure Server CA	`2020-08-03` - `2022-08-03`	2 years	crt.sh
www.google.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.seadform.net DigiCert SHA2 Secure Server CA	`2020-10-05` - `2021-11-03`	a year	crt.sh
*.exactag.com Sectigo ECC Domain Validation Secure Server CA	`2019-08-28` - `2021-09-13`	2 years	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.innovid.com RapidSSL RSA CA 2018	`2020-02-07` - `2022-04-07`	2 years	crt.sh

This page contains 17 frames:

Primary Page: https://oneclickroot.com/download-apk/
Frame ID: C233B18E6740E5C43F3FA130449C80EB
Requests: 115 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210601/r20190131/zrt_lookup.html
Frame ID: 5E3F4BB9DA46F0B700958713289604EF
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Foneclickroot.com
Frame ID: 7FAA5CF8D73171AE431E458B105710A8
Requests: 2 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Frame ID: E118DACE308D972B0BBF1C1097FDCB0F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&adk=1812271804&adf=3025194257&lmt=1623000457&plat=1%3A16809992%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456961&bpp=3&bdt=341&idt=162&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=846926675092&frm=20&pv=2&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=186
Frame ID: E932F101D31093AB9FD56174A80486E6
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=7752804668&adk=772853018&adf=938969183&pi=t.ma~as.7752804668&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=390x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456964&bpp=2&bdt=345&idt=208&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=130&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sME1KIdDhD&p=https%3A//oneclickroot.com&dtd=213
Frame ID: B9279D8953BA071A42372907A2594E26
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221
Frame ID: F8BED35DB40E18D13AD747463C076DB9
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11
Frame ID: B28032E9FEC2A879AE11EE6E724596BD
Requests: 11 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js
Frame ID: B4226B6C5A2748F8E59155C8FEBFC435
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: C79A9655C3A2DED1FBD0B72066BA38AC
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js
Frame ID: CD84E41F59983036020F65629ACBD738
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si
Frame ID: 299048F7FF71096ADF67C0FAB660B345
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 8B12F0AC98680A951D0C1A888F8252CC
Requests: 9 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D442973669095021%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df374b443a869c4%2526domain%253Doneclickroot.com%2526origin%253Dhttps%25253A%25252F%25252Foneclickroot.com%25252Ff1c65382d85b184%2526relation%253Dparent.parent%26container_width%3D390%26height%3D370%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FOneClickRoot%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dfalse%26small_header%3Dfalse%26tabs%3Dtimeline%26width%3D390
Frame ID: 1BA6ED0B39B530E0555352931609AE99
Requests: 43 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js
Frame ID: E5F7B0225FFDC15EB04CB423A304972F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 1E15878D898D8C41F21BEC6BABAC8512
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2C71A9FB520F60610E1B54B4BCE4DEA2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.oneclickroot.com/download-apk/ HTTP 301
https://oneclickroot.com/download-apk/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googlesyndication\.com\//i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /apis\.google\.com\/js\/[a-z]*\.js/i

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/platform\.twitter\.com\/widgets\.js/i

Page Statistics

217
Requests

95 %
HTTPS

65 %
IPv6

33
Domains

49
Subdomains

43
IPs

7
Countries

2513 kB
Transfer

7887 kB
Size

17
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://oneclickjailbreak.com/
Title: One Click Jailbreak

Search URL Search Domain Scan URL

URL: https://www.facebook.com/OneClickRoot
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/oneclickroot
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCdlsuVdD-7rh9vNPPnVfrig
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.dmca.com/Protection/Status.aspx?ID=c83b9835-eb61-44c5-ab79-2a578455c80b&refurl=https://oneclickroot.com/download-apk/
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.oneclickroot.com/download-apk/ HTTP 301
https://oneclickroot.com/download-apk/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 145

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 160

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKZxc0bTo7WCGsRru5LeVXoxgj_Z12SnOVQZFsCXbLOH3eG1oAJG7VbVVLC3apzBk9YCUGtGKyzU0tJp3TDfdfkgSnZCpiA&google_gid=CAESEIOPPLlkjfLA-bQ5wDhCbwo&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUwwRmlnQUFCYVZaTXgyZg&google_push=AYg5qPKZxc0bTo7WCGsRru5LeVXoxgj_Z12SnOVQZFsCXbLOH3eG1oAJG7VbVVLC3apzBk9YCUGtGKyzU0tJp3TDfdfkgSnZCpiA

Request Chain 161

https://rtb.openx.net/sync/dds?google_gid=CAESECqbQqNkHQLZryx048MfREc&google_cver=1&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI HTTP 302
https://rtb.openx.net/sync/dds?google_gid=CAESECqbQqNkHQLZryx048MfREc&google_cver=1&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI&ox_sc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI&google_hm=MWcujeF6xrkbYfCOzKiyAA==

Request Chain 162

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBlsQveCRtRc7avug2VYRRk&google_cver=1&google_push=AYg5qPKHt6oHccxnIMk7d6d1Y8R60RykxqVc3NKaxeeldFV3vADWj0QT-V9ZcxdmUwHtTX3iyVGJPT-VTPYP3PdyFAGkez8UC6US HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBlsQveCRtRc7avug2VYRRk&google_cver=1&google_push=AYg5qPKHt6oHccxnIMk7d6d1Y8R60RykxqVc3NKaxeeldFV3vADWj0QT-V9ZcxdmUwHtTX3iyVGJPT-VTPYP3PdyFAGkez8UC6US&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=VE1r86OrRhWZtxUYIgQTeA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKHt6oHccxnIMk7d6d1Y8R60RykxqVc3NKaxeeldFV3vADWj0QT-V9ZcxdmUwHtTX3iyVGJPT-VTPYP3PdyFAGkez8UC6US

Request Chain 163

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOqPlyDEzevUmL8V95PmdtU&google_cver=1&google_push=AYg5qPJiPokc2IGk6V3lJrPH7HVK6iLcZxflg68BSFY8bVqsgv2Am9qrXRB0NnQDYEvSPisBZqQojEsjNvWEiJlECRvk52TkqYg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BMR0tHRFMtMU8tMzBOMg==&google_push=AYg5qPJiPokc2IGk6V3lJrPH7HVK6iLcZxflg68BSFY8bVqsgv2Am9qrXRB0NnQDYEvSPisBZqQojEsjNvWEiJlECRvk52TkqYg

Request Chain 164

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8 HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8

Request Chain 169

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

217 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

404

Primary Request / Show response
oneclickroot.com/download-apk/
Redirect Chain

https://www.oneclickroot.com/download-apk/
https://oneclickroot.com/download-apk/

58 KB
15 KB

679ms
669ms

Document
text/html

2606:4700:3031::6815:3306
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3306 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58836dc18d0e1c202d01dab37c404008b52182e946fa5043bbc3a2df6284ed59

Request headers

:method: GET
:authority: oneclickroot.com
:scheme: https
:path: /download-apk/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-type: text/html; charset=UTF-8
link: <https://oneclickroot.com/wp-json/>; rel="https://api.w.org/", <https://oneclickroot.com/wp-json/wp/v2/pages/62620>; rel="alternate"; type="application/json", <https://oneclickroot.com/?p=62620>; rel=shortlink
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; path=/
vary: Accept-Encoding,User-Agent
cf-cache-status: DYNAMIC
cf-request-id: 0a83f6b30c0000c2868112d000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uE4U1TMuMBugirllYTqP7FDYOqqQS1x%2Fdj7Ks8Sv%2FrBdz8GaFqASHawZjI1Q542WaBweb19mOTxP6k3%2BhFQDO%2ByO8F3D%2BXd38aQuCsCm2vN8EiXYBX3ZYNsCV3WFVHBvjB7IfeoBNhwnIw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65b35a31aa70c286-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

Redirect headers

date: Sun, 06 Jun 2021 17:27:35 GMT
content-type: text/html; charset=UTF-8
expires: Sun, 06 Jun 2021 18:27:36 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://oneclickroot.com/download-apk/
vary: User-Agent
cf-cache-status: DYNAMIC
cf-request-id: 0a83f6b1820000c286a4205000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lbrxLa7Wg6%2FjcYDZh%2BF%2BV4DdetgkssfAPwhd%2BX7W23VEhg17szFrBKXDFgMa7aW%2BbPAQsm3bxBSWH808%2FXwXq4wXbtIJ1h4SQQ5DyeeoQXKNhXKW5VNPHIu%2F%2BO5V6zaLnUxKdnRR%2B3iGxW8ZF9Y%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 65b35a2f3cedc286-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H3-29 200 style.min.css
oneclickroot.com/wp-includes/css/dist/block-library/ 57 KB
8 KB 47ms
33ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde

Request headers

:path: /wp-includes/css/dist/block-library/style.min.css?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2122793
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5be0000644309109000000001
last-modified: Thu, 15 Apr 2021 03:46:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3BZD7eev3UYOj27JU6xIhiULwJ0Zv0PqS%2FxyNvOMHwBOb3RJGPqE8u29LSN3%2F7rXMLZIXXNJ2Ro9hSMsSJoRdI3%2Bool90Nr1E%2BHVHa8HVJdy6ckqBTKdJqi0uOYy0OWtzIT252q6LxTz9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f86a6443-FRA
expires: Sat, 12 Jun 2021 03:47:45 GMT

GET
H3-29 200 styles.css
oneclickroot.com/wp-content/plugins/contact-form-7/includes/css/ 2 KB
1 KB 34ms
20ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 284401fd9cc6074e6211119acdfbb4abb56b1d4c0be4323ccce1d6f6da7642ea

Request headers

:path: /wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 930347
cf-polished: origSize=2640
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bd00006443eb3f4000000001
last-modified: Wed, 26 May 2021 23:00:38 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=hFxh3avy0lIVdBi0kDstxhyPBTFRiYF5ZcF%2FZMCgLshBoLysivgPozL8wkvfVT4v24CDjJPC0Og1WVNiGuee3%2FO0G5%2F9%2FlfJAEfoqCA6tMuq9AtKXjZa0TUDCz%2BBe00pMxOjaGOjd1Bexw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8696443-FRA
expires: Fri, 25 Jun 2021 23:01:50 GMT

GET
H3-29 200 cookie-law-info-public.css
oneclickroot.com/wp-content/plugins/cookie-law-info/public/css/ 3 KB
1 KB 33ms
19ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.0.3
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1f4247657f994f6c9520c982ab95f953ee1c052706594d74f521cae670cf8be

Request headers

:path: /wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css?ver=2.0.3
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 930347
cf-polished: origSize=3109
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bd00006443f49b5000000001
last-modified: Wed, 26 May 2021 23:00:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ZDgXZ1LJ0kbQt3DzGUW1h9PDxMdDIQ%2FP%2FyzFvVjXjXy%2FXK0Onc8Ttd3L1H8POXPTu%2BywppL3CAxUh%2F%2Fj%2B3um23zvmiRwhIt%2FjlC3cOFm5LJRMQY%2F7jMGTiGPODo8VcjReI8qAwBEK8cL1w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8676443-FRA
expires: Fri, 25 Jun 2021 23:01:50 GMT

GET
H3-29 200 cookie-law-info-gdpr.css
oneclickroot.com/wp-content/plugins/cookie-law-info/public/css/ 22 KB
4 KB 53ms
39ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.0.3
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d641d794ffeb8ab4a93449307f4da1d4cb4a9c7020ad7da4c2f630b03de6d1f7

Request headers

:path: /wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css?ver=2.0.3
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 930347
cf-polished: origSize=28525
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5c10000644322abd000000001
last-modified: Wed, 26 May 2021 23:00:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=h3P7fcdZr7uN8bRDi4UjGfNbGW9XkarjkfTWbfZ5Yhpfx46Q2l%2FrhTz%2B42vZ5oCyQ4a3Gi7rRgnlhrQ2Gh4rD4iDuS%2F3l9uUwKsQyuEDfiLlHWGOGTGHozF%2BC9DzT5xNRdng0%2F6pkwpVkA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8736443-FRA
expires: Fri, 25 Jun 2021 23:01:50 GMT

GET
H3-29 200 simple-banner.css
oneclickroot.com/wp-content/plugins/simple-banner/ 397 B
788 B 53ms
39ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/simple-banner/simple-banner.css?ver=2.10.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8fce36318ae0707c20333ed16ffe4897628548dc8d2a3c672b07ccc16f3f310f

Request headers

:path: /wp-content/plugins/simple-banner/simple-banner.css?ver=2.10.2
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 929717
cf-polished: origSize=487
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5c100006443f8281000000001
last-modified: Wed, 26 May 2021 23:02:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=7ogIO77nawP5dSqWYNK2pzgruBI21y1v6dXA8JCQUdE28PmzclqgIvskV%2BG7KGB575cqQLgEeI%2BRojkAwCHyDfD0G6ggH16BiABasuNAT9QQh7SKwlJ0CH%2FcOe9xKmVMZxE441Zl93Z%2FJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8716443-FRA
expires: Fri, 25 Jun 2021 23:12:21 GMT

GET
H3-29 200 style.css
oneclickroot.com/wp-content/themes/oneclickroot/ 11 KB
4 KB 53ms
39ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/style.css?ver=20170330
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b32450ffdd94f7437c9a4db0500d67f2144044b3d6364b074643ee770fe2ecb

Request headers

:path: /wp-content/themes/oneclickroot/style.css?ver=20170330
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1332838
cf-polished: origSize=18834
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5c2000064430910a000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=i4cnuJVgHKCJ7qR5PDJio2HagtFT%2FbC51q8iQqCDj1CSJG3%2F9ubAVHADQ86HusD6pcStNAM%2FS5ZD5SVyBvs43ylI2Tpds4%2FaS8iT%2FET0XJOjIAB4je1vFdbxFKJIw383W%2Bn97qvFBYH96w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8756443-FRA
expires: Mon, 21 Jun 2021 07:13:37 GMT

GET
H3-29 200 custom-style.css
oneclickroot.com/wp-content/themes/oneclickroot/css/ 28 KB
7 KB 34ms
21ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1dc1c5a0cdd40141f4546b942f742ea206c5bcb0bb19430c1e42096564422fc9

Request headers

:path: /wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 929717
cf-polished: origSize=36962
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bc0000644322abc000000001
last-modified: Wed, 26 May 2021 23:10:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SRK%2ByFK7apOgJA9QVmIx%2BIl0K2LCmhExS60qvlcr6YqgAsZPtfFmmBqQ6I%2BTBq7ofldcoFrTj8Qz8%2F78HPMQ5wDHR7TEPNxQWh4ihrF97xUZPn8J98z4GD1oNNxGY4qGyupHs3fyg6He0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8666443-FRA
expires: Fri, 25 Jun 2021 23:12:21 GMT

GET
H3-29 200 widget-style.css
oneclickroot.com/wp-content/themes/oneclickroot/css/ 5 KB
2 KB 39ms
27ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/widget-style.css?ver=20170330
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9db39e6b65543fd44b1193b45497943925f38d33104c0e044c2c4d35f002e861

Request headers

:path: /wp-content/themes/oneclickroot/css/widget-style.css?ver=20170330
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291802
cf-polished: origSize=6205
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5ba0000644311be1000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ahOlMW9fbTSqaGkn0Atz8ic1cy4qOuNDjjsyHY2F7UipVDE9HO1eHuuUUFlIGxpMhVRM%2FkDspyhjC7c%2F6OZRNAUjalSxiMZRb7Quc1pr4JqL3Avmg9E8GDLQC0O6AhzCPUxI2l2eNM3Waw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f85e6443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 js_composer.min.css
oneclickroot.com/wp-content/plugins/js_composer/assets/css/ 449 KB
40 KB 47ms
35ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5

Request headers

:path: /wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253486
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bb00006443e7af8000000001
last-modified: Tue, 26 Jan 2021 19:48:31 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lt%2BsbIMLUVavz0XV0qUwFTt%2FSXgYinIJSbxggIfdxs8u7ZaJZft0Dcr%2FA3RRg8F0OrmZOxAh7KCadnKCuG1GCfgrAGndEieBIrk98z9EGJv8%2FPipBjx7y%2Bv7yrL6jp5hT0YF3bBFzzZJFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8626443-FRA
expires: Tue, 22 Jun 2021 05:16:11 GMT

GET
H3-29 200 jetpack.css
oneclickroot.com/wp-content/plugins/jetpack/css/ 76 KB
14 KB 39ms
28ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/jetpack/css/jetpack.css?ver=9.7.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1cbdad4ce844ca96c63fc42506fd55d093cad2ca3d3d56b64b80a173352b3be6

Request headers

:path: /wp-content/plugins/jetpack/css/jetpack.css?ver=9.7.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 265254
cf-polished: origSize=77727
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bb00006443030de000000001
last-modified: Thu, 03 Jun 2021 15:46:35 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nfns3OmdJShpMp6lJDTs39N2MazAnxoFiFBRGXDovBR2RZv25w12jifqEOaVuJpBmnaiv8We%2BFtn%2BO%2B0JTV38B%2BO77c5jWILbGqMUffttxVvcqoR6bV8RChL8%2F3red3OaBIUdcLDVrLeEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8616443-FRA
expires: Sat, 03 Jul 2021 15:46:42 GMT

GET
H3-29 200 jquery.min.js Show response
oneclickroot.com/wp-includes/js/jquery/ 87 KB
30 KB 36ms
25ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827

Request headers

:path: /wp-includes/js/jquery/jquery.min.js?ver=3.5.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253442
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bc000064433730d000000001
last-modified: Thu, 08 Oct 2020 02:03:26 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=xenKE3RUhoow1c5qHEIwBCBXzaFotHr8MFQtaSmbSh7mcn5kcKbF4AK%2BAUwJhS0VMh5YiroI88JP3wTn6eZvHh8lfImRSeZbN8QBY%2FcMphvRWa%2FRHmFlUTlnKz2ia0fPUPLOGzcL49yCaA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a35f8646443-FRA
expires: Tue, 22 Jun 2021 05:16:55 GMT

GET
H3-29 200 jquery-migrate.min.js Show response
oneclickroot.com/wp-includes/js/jquery/ 11 KB
4 KB 30ms
20ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

:path: /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253443
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5ba00006443182bb000000001
last-modified: Wed, 18 Nov 2020 19:36:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=VzDdo1Yvg9GASOXRLvu7KAfh7IjIzPoZMHt0r3qOORPilZEtQ98uL6hALwtGtP5lONJ%2FbDGKeki3JdTbjS6FIHgh5lxPbbOif3JjUsjdNR7v7bPly9CdOQz3N8Wy6OBDE0ZdYmkLtXsz5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a35f85f6443-FRA
expires: Tue, 22 Jun 2021 05:16:55 GMT

GET
H3-29 200 cookie-law-info-public.js Show response
oneclickroot.com/wp-content/plugins/cookie-law-info/public/js/ 28 KB
7 KB 41ms
31ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.0.3
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f8c9f1c471da8dae19554e26c6c423f31e5e687ea3892e4a73ada4be3179f86

Request headers

:path: /wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js?ver=2.0.3
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 930347
cf-polished: origSize=36312
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bb000064433730c000000001
last-modified: Wed, 26 May 2021 23:00:53 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JHOZfu56RPttjpgWZB5fsJvck8R8At4Xn9EWJyy8lZBYJrzCmdCVa%2BF3d0L076Sntm%2FBt9ktjYB1aQiJXnWn7%2Bm%2Fn8SQewrXjq48e%2B8E6jQQo8j08q%2FuKPTNFu04qHEORVisBklDi0AboA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a35f8606443-FRA
expires: Fri, 25 Jun 2021 23:01:50 GMT

GET
H3-29 200 simple-banner.js Show response
oneclickroot.com/wp-content/plugins/simple-banner/ 3 KB
2 KB 28ms
21ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/simple-banner/simple-banner.js?ver=2.10.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 332d1b140187c17f38d7bd50a71587ded1b48ca5c7c9cc2748142fb87a9bdac6

Request headers

:path: /wp-content/plugins/simple-banner/simple-banner.js?ver=2.10.2
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 929717
cf-polished: origSize=4633
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bf00006443fda0c000000001
last-modified: Wed, 26 May 2021 23:02:07 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lYewBLQ3guRAxm08dJi3YsEevwImiFws%2FKAj%2Bb4iMqx8ZIunl8ckbiOxorVHQT1JePnltqFKMOHFikq2jyWVu9vvFdrWfYSMjKQFeE2ED0O%2BkfqiwuKYZxwICLOc%2BhzAK0jRK0NoPMDrOA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a35f86c6443-FRA
expires: Fri, 25 Jun 2021 23:12:21 GMT

GET
H2 200 tapfiliate.js Show response
script.tapfiliate.com/ 11 KB
4 KB 70ms
21ms Script
text/javascript 143.204.98.56
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://script.tapfiliate.com/tapfiliate.js?ver=5.7.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-56.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75cdd0cd8782116ba8444dabd993758b1b349843584c9631f4f24a4295b98940

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 12:54:52 GMT
content-encoding: gzip
last-modified: Fri, 10 Jul 2020 09:38:20 GMT
server: AmazonS3
age: 16366
etag: W/"3a5177f5482ab61da6a0eb7587446403"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 e38834cd8f7f79ef118dc9bba0861780.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: 8fZ-L87uyfTFTN_32fSZ1qWjTJuGa5QyPA5u2927Gp2rT5fjA03bLQ==

GET
H3-29 200 keyboard-image-navigation.js Show response
oneclickroot.com/wp-content/themes/oneclickroot/js/ 277 B
799 B 40ms
33ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/js/keyboard-image-navigation.js?ver=20120202
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9e13ef12708f64c09b8f81f80f0ac44521c4aeff8a7e5124865a2ef056a6a81d

Request headers

:path: /wp-content/themes/oneclickroot/js/keyboard-image-navigation.js?ver=20120202
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291802
cf-polished: origSize=416
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bd000064431a8be000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MuX%2Bt33uLbZjJ13vPQu3O5z3zYPI8jXv0VmJxkS5%2BAyBk88ge8dubozjff1qgjQpnqxnZ%2FEaiTbF75mfYzvtzOapHEEgzb8vROLJFr%2BVLErrLgTDgl6rJELgnH6h9zPWK762cbWtg4ug%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a35f8686443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 64044.css
oneclickroot.com/wp-content/uploads/winp-css-js/ 186 B
733 B 45ms
38ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/uploads/winp-css-js/64044.css?ver=1612309962
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ea0d8a62e779ceae1224b04a661334f14c30fddaf2d9a7dd6bcd7f8682e51bdc

Request headers

:path: /wp-content/uploads/winp-css-js/64044.css?ver=1612309962
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291802
cf-polished: origSize=354
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bf00006443efa41000000001
last-modified: Tue, 02 Feb 2021 23:52:42 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=JHcTn84ID9wTLzL5NzjVmGR3xZVu7C7AduYFdWu1MfNNjWTgnH0AAOvRk5KHBMGWrKmItvmQ5JbHuneBCtF0x4uMOzTo6UcirwBw5LBlWKw80IqiMvrEZXNtkAD3CFy%2BqWOz9aTsxvHRzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f86d6443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 64444.css
oneclickroot.com/wp-content/uploads/winp-css-js/ 4 KB
1 KB 45ms
38ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/uploads/winp-css-js/64444.css?ver=1612201545
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 938654c76f9aba5798b9e0e3480a095a1ea4f9b0a67ffcecc8833570e7475546

Request headers

:path: /wp-content/uploads/winp-css-js/64444.css?ver=1612201545
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291802
cf-polished: origSize=5096
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5c000006443182bc000000001
last-modified: Mon, 01 Feb 2021 17:45:45 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=oU89MJqNHmit1ID6VYxi%2FSh%2BxWeZDkx%2BgCyyVQbwgf2YgdDFDcyRygrvBrF2LsanTPyJR3XVDVXBGHh0UqW0Xu8JiKoPjPSSQYNAtF9JkykZioYfTHAQ%2Ff6NqOzga7SucDqfE3kyVcRFWg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f86f6443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 62567.css
oneclickroot.com/wp-content/uploads/winp-css-js/ 0
642 B 45ms
38ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/uploads/winp-css-js/62567.css?ver=1612196881
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /wp-content/uploads/winp-css-js/62567.css?ver=1612196881
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291802
cf-polished: origSize=475
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 0
cf-request-id: 0a83f6b5c000006443030df000000001
last-modified: Mon, 01 Feb 2021 16:28:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=MXtaoeq%2BQvhNpT8T6SbWQhqRYAM5gIxBAXi410o5CBA%2FenU8LL6u4K4r8fWezCdnVbYnUv9x9Lq2BC9nT%2B1zGwBHVftXB25RCXlV7NvzVyH2QHdCg9JfeC7UrgoWXxM8rpysXdpHrqPi5A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a35f8706443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 64407.css
oneclickroot.com/wp-content/uploads/winp-css-js/ 759 B
892 B 31ms
25ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/uploads/winp-css-js/64407.css?ver=1608601332
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 243e981fb1132fc19094b071ee8d871bf1c2fb7afec270e4e2a65f4bd17d1808

Request headers

:path: /wp-content/uploads/winp-css-js/64407.css?ver=1608601332
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291802
cf-polished: origSize=1190
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5bb00006443eb3f3000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OY2q06cJuSnO53F5vmY19rdz88eaw5Xa0ucN16yJRFPP95sqXAszS4XC4ulHIrMc%2FHoOyTm5cs9a7YY7ZAy8Oh6OUSMfgq3e%2BG8JHmWHeFjBHK6gLicbhn%2BH9TfehOn5%2BA9mHwWCJbflFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f8636443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 64403.css
oneclickroot.com/wp-content/uploads/winp-css-js/ 13 KB
3 KB 44ms
38ms Stylesheet
text/css 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/uploads/winp-css-js/64403.css?ver=1608601079
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f41ae176305c7313c7168dcbddc24e4ec176ac1504ad9768c39450ddca5e6084

Request headers

:path: /wp-content/uploads/winp-css-js/64403.css?ver=1608601079
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291801
cf-polished: origSize=19558
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b5be000064432a97f000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=KQVMh4tIIoL0l130j3QFJb3ux69O0gmWlG6Fh5QG8OZ2A5WwjJ7WVYR0gG49eYcqrrFoAmBFjnndfx0Vjr%2BYzYkFAdD2zMasj3zOhk5XoD%2Fa9sG9AYrMFWxjszXYRqiFGUGfPOTnElxVvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=2592000
cf-ray: 65b35a35f86b6443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H2 200 js.cookie.min.js Show response
cdn.jsdelivr.net/npm/js-cookie@rc/dist/ 2 KB
1 KB 19ms
5ms Script
application/javascript 2a04:4e42:3::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/js-cookie@rc/dist/js.cookie.min.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:3::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b5c1a679368da537e7b0f6880801ab32fe84b38b900acdbc1fdbe8cd6a86c4c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 23206
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 829
etag: W/"695-ZmFYFlLtHkFxw/L8U2aMkUosIZ4"
x-served-by: cache-fra19125-FRA
date: Sun, 06 Jun 2021 17:27:36 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 134 KB
48 KB 63ms
23ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

89f3559669480a4882efa1f00d6b3201705835e1219e8c89aff316cee6892e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48425
x-xss-protection: 0
server: cafe
etag: 10531183180401443940
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H3-29 200 logo-width.png
oneclickroot.com/wp-content/themes/oneclickroot/images/ 17 KB
18 KB 23ms
20ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/logo-width.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1d0187e2c049d77ec849ae06718baa71bfc51ced33c1fa6edf4cd84568a85358

Request headers

:path: /wp-content/themes/oneclickroot/images/logo-width.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253440
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 17751
cf-request-id: 0a83f6b61a00006443e7afc000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SDRsk2e3tcMGvmeo%2BAJRxnAotcmbxbA3X05k04Rk15YloNEjzoRYVIQVn7CoD1RLNmCeMrj%2BAnTf4MKj8Xb9sVjLQtRUd1g9ICTFc9fBKCLxQw07zfu4LumDBNOa3rIDdTsUqBlqYOO9BA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3688a46443-FRA
expires: Tue, 22 Jun 2021 05:16:58 GMT

GET
H3-29 200 logo.png
oneclickroot.com/wp-content/themes/oneclickroot/images/ 15 KB
16 KB 25ms
21ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/logo.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 66d8104a5e8048bc8102957186d56a30c30b566ff1cde3774638f6e9549eb2dd

Request headers

:path: /wp-content/themes/oneclickroot/images/logo.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253440
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 15270
cf-request-id: 0a83f6b61b0000644309110000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=syHIXvuHbuoPuNQXl5gXfelh1fx%2Bw4DwlQCeq03nheawiAbFA0GyfGsDb1yTpbN4VN2gTmI9l74Z%2BeLayraZqG2AVdFSbR9sOGUPfLltLCwpaA8k92A2Q1xW3to8dtOyJAvRe3cJJync2A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3688a56443-FRA
expires: Tue, 22 Jun 2021 05:16:58 GMT

GET
H3-29 200 wp-emoji-release.min.js Show response
oneclickroot.com/wp-includes/js/ 14 KB
5 KB 33ms
29ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

:path: /wp-includes/js/wp-emoji-release.min.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2122577
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b61b0000644322ac2000000001
last-modified: Thu, 07 Jan 2021 01:59:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GfpDuPnB0%2BtvWb4aWFgfMxLTXYlit3Mq7bGArcCKAUYaVB9BPQGasX0YeghYDv8mjigLrdPlI7UEDKlDM0vU8dgxz07dAha%2Bilf6gJgesBAi4%2FBA7sRxzvYPtwpNRg2lDduJ7IahJrBzNw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a3688a66443-FRA
expires: Sat, 12 Jun 2021 03:51:20 GMT

GET
H3-29 200 banner.jpg
oneclickroot.com/wp-content/uploads/2014/10/ 12 KB
13 KB 29ms
26ms Image
image/jpeg 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/uploads/2014/10/banner.jpg
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f0d44358544c598aaad61f29410b0866ca3085c95f8c5b1c37bd8947008629f

Request headers

:path: /wp-content/uploads/2014/10/banner.jpg
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1249312
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 12410
cf-request-id: 0a83f6b61b000064432a983000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=EGAZcshcymyyh6y4tTk02ObWW6DTK%2FCBKxGKJCKldIzHD7l6b9O31ilOzCJW9qaHSJ%2Fffp0qZpsRFaqltIUS82z%2FT4VLBTM63ROdaKRcZHhtVk2iiy%2FATLs4bgdWQ17Wn6cvTA3iZC7qNA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3688a76443-FRA
expires: Tue, 22 Jun 2021 06:25:46 GMT

GET
H3-29 200 get-support.jpg
oneclickroot.com/wp-content/uploads/2014/10/ 24 KB
24 KB 23ms
20ms Image
image/jpeg 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/uploads/2014/10/get-support.jpg
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 59bd527fdd4691ca358f6e56b2388910a9caa4c6b66986930cc42f3112dd65e1

Request headers

:path: /wp-content/uploads/2014/10/get-support.jpg
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1249278
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 24256
cf-request-id: 0a83f6b61c00006443efa46000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=IPNfgnpFbmK8CuJix4HioTXZCfa%2Bk1DqDSQBpP%2BgTF1GBJcp%2BXhAP1IYrv7aSaW7K5FzYm7VnAdDOOqo0TtgXn32df5Cz6WqJFsHS5HHQKjxGcxqiZwm9UD9QY6P3y088sZcnCE8cRAYDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3688a86443-FRA
expires: Tue, 22 Jun 2021 06:26:20 GMT

GET
H2 200 dmca_protected_sml_120n.png
images.dmca.com/Badges/ 2 KB
2 KB 11ms
7ms Image
image/png 151.139.242.29
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.dmca.com/Badges/dmca_protected_sml_120n.png?ID=c83b9835-eb61-44c5-ab79-2a578455c80b
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.29 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx / ASP.NET
Resource Hash: 45ec09974d948120c9f97cbedd141f4fa8df876bd2206f0c41133ae3a13fdf13

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
last-modified: Tue, 04 May 2010 23:19:10 GMT
server: nginx
x-powered-by: ASP.NET
etag: "a7af7333e0ebca1:0"
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
link: <http://dmca-images.azurewebsites.net/Badges/dmca_protected_sml_120n.png>; rel="canonical"
content-length: 2060
expires: Tue, 06 Jul 2021 17:26:51 GMT

GET
H2 200 DMCABadgeHelper.min.js Show response
images.dmca.com/Badges/ 465 B
633 B 30ms
10ms Script
application/javascript 151.139.242.29
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://images.dmca.com/Badges/DMCABadgeHelper.min.js
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.29 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx / ASP.NET
Resource Hash: e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
last-modified: Fri, 21 Jun 2019 20:14:34 GMT
server: nginx
x-powered-by: ASP.NET
etag: "26b181f16d28d51:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
link: <http://dmca-images.azurewebsites.net/Badges/DMCABadgeHelper.min.js>; rel="canonical"
content-length: 280
expires: Tue, 06 Jul 2021 17:26:51 GMT

GET
H2 200 bundle.min.js Show response
translations.sking.co/dist/ 220 KB
64 KB 73ms
32ms Script
application/javascript 2606:4700:3034::6815:4303
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://translations.sking.co/dist/bundle.min.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3034::6815:4303 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

baad1213282cf51ae2d233a225c5dfadc45cbb309d7b3e52fbe7aa6ee59ea901

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1252586
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b63e0000634198b70000000001
last-modified: Thu, 28 Jan 2021 20:28:01 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=t%2FbMpTO9a%2FtaoCcY5AG%2FmyiPCJ4QA3G%2B1vXjsLZtxryYXLmw%2F%2FYja6QL2%2BIt5bZLU70Svkb7yFcp4eVl7%2FrhtVsCejc%2Brw7oxWW1Y%2B6%2FnSqfsPg9l9d4gVxqEI27nyJcBN9CGva25Q8ypz8AYZ7j"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2592000
cf-ray: 65b35a36cef26341-FRA
expires: Tue, 22 Jun 2021 05:31:10 GMT

GET
H3-29 200 62580.js Show response
oneclickroot.com/wp-content/uploads/winp-css-js/ 208 B
773 B 20ms
20ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/uploads/winp-css-js/62580.js?ver=1592351656
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3113153d65bcf7799f9ee3443c8991a1d123bf3af4cdaf49f11fde14aec24662

Request headers

:path: /wp-content/uploads/winp-css-js/62580.js?ver=1592351656
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291801
cf-polished: origSize=338
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b6050000644322ac1000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=uvTjfS%2Bkmi%2FsusaK03AWyCzUEksVKkzEN7Nwh5HnRLM07iFstJYl5tBIMQ9NAsnL%2BMnjauRxfZ%2FwAmOvteI%2BCUKcKR%2FOT2oBG0Hc3%2BDeQi6ZQMeFoc4WEXYoXi95hQcuxsGj5Qf%2FeBGHfg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a3668966443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 wp-polyfill.min.js Show response
oneclickroot.com/wp-includes/js/dist/vendor/ 97 KB
32 KB 32ms
28ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3

Request headers

:path: /wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291785
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b617000064431a8c1000000001
last-modified: Mon, 29 Jun 2020 21:20:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=nvd9qK%2FZQCHYY68EXsa57eOX%2Fqfkcujsxl7O0U7kZuKRpvI6qqs4oHY8hHlqq2BIlYo8bps0BRKoD6yeahPYSYsnOOK4d9C0%2BKrK%2FOcYvc1po9yVt76UQbwc7AP24WfhosqurHaRUcFRiA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a36889d6443-FRA
expires: Mon, 21 Jun 2021 18:37:51 GMT

GET
H3-29 200 index.js Show response
oneclickroot.com/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 20ms
16ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 927d5436967ebce8a52c4bdcd27cc056c910a72270f74990dfbd1d554840c12d

Request headers

:path: /wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 930346
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b61800006443eb3f8000000001
last-modified: Wed, 26 May 2021 23:00:38 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=xTMew56gBS75Y5NbLh2AgKaaDbxhe5oTu6Keak8A%2BdIxk%2B3ATj67vvvk8NHjknwcGbJih4VyYivYAJd%2FEWt7jGAEexVOqVstmUshdLEwkwZMANxBYY1aDrGfo6SFDIhgNy0onhx3nELL4w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a36889e6443-FRA
expires: Fri, 25 Jun 2021 23:01:51 GMT

GET
H3-29 200 core.min.js Show response
oneclickroot.com/wp-includes/js/jquery/ui/ 20 KB
7 KB 25ms
21ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cd851e5b33af0fbb354df65506da39807b998e07723f3d08aba5179fa2ed97e

Request headers

:path: /wp-includes/js/jquery/ui/core.min.js?ver=1.12.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253442
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b61800006443fda12000000001
last-modified: Thu, 15 Apr 2021 03:46:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=dpS01BDvxX5NWU1P3MM0tO69NIsbiAB%2BUmlP4Bfr6QPWNeu6tIybfY8hvDHdOwXNdvsZedUoPg74%2F6J2QT7XT5M4MWmi4tnrLP2bCq8YCT4I3AmMqVT7FYtfEpn8hf98szEms41sfJE%2F2g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a36889f6443-FRA
expires: Tue, 22 Jun 2021 05:16:55 GMT

GET
H3-29 200 accordion.min.js Show response
oneclickroot.com/wp-includes/js/jquery/ui/ 8 KB
3 KB 23ms
19ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/jquery/ui/accordion.min.js?ver=1.12.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 638caa40d39dec20d95e4119187482e3c5939616252d96ded196b05c2e1cfc27

Request headers

:path: /wp-includes/js/jquery/ui/accordion.min.js?ver=1.12.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291801
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b619000064430b97f000000001
last-modified: Thu, 21 Jan 2021 00:05:18 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=SnrSoGjYqAWya1OnroxnQIU9gB%2Bb%2BBByz5Yp82tecMAD0pQMFut97Cag5mwUQg52oNCRLVcPwMRCRbg0L7GP5gn2IjXOd1XPitoojibdmGRqzLBc7bwFTIK2G607tV7c8gpnE4JGXBf5Cw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a3688a06443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 small-menu.js Show response
oneclickroot.com/wp-content/themes/oneclickroot/js/ 1019 B
988 B 20ms
16ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/js/small-menu.js?ver=20120206
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2ac5938f47fbfdbb40f6dc28da3e5d7ae8bfbead9d5e5769c3cb22f82ed0ac9f

Request headers

:path: /wp-content/themes/oneclickroot/js/small-menu.js?ver=20120206
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291801
cf-polished: origSize=1385
cf-bgj: minify
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b61900006443030e3000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=cGjdliOhWGZ8L%2Fy%2BE34tPVR6xVfNh3L%2FCSV%2BbfPgHnF0p9q2yShQpfYrUUFnBj4sSUkUtgGnoTp7Hjfh2UCVYU4s8gNHkz9Ay34%2BGbFdomEzagGN0E6i9xFoZ2nPfhLH8mJ%2BR9KLRd0c6w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a3688a16443-FRA
expires: Mon, 21 Jun 2021 18:37:35 GMT

GET
H3-29 200 wp-embed.min.js Show response
oneclickroot.com/wp-includes/js/ 1 KB
1 KB 22ms
17ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-includes/js/wp-embed.min.js?ver=5.7.2
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

:path: /wp-includes/js/wp-embed.min.js?ver=5.7.2
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2122638
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b61900006443f8285000000001
last-modified: Thu, 07 Jan 2021 01:59:24 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5OnC7uTR%2F%2BbCg1Z5Ha%2FzoG4epT8178%2FFW6p%2BaEDyL2odKmhbTB4dkkttM1kyahqUjMgDsvlGr0iSSIrPDThwkzWAVGe0Agrj2YOHcs93qhipvTpcnizfkxVHADOnMlWURy1fEiIJxv7QbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a3688a26443-FRA
expires: Sat, 12 Jun 2021 03:50:20 GMT

GET
H3-29 200 js_composer_front.min.js Show response
oneclickroot.com/wp-content/plugins/js_composer/assets/js/dist/ 19 KB
6 KB 37ms
32ms Script
application/javascript 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://oneclickroot.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=5.1
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 60e52a19fe23790b163dd2a27b256eda989ec4b90f79b0abe0caedb1d44a0796

Request headers

:path: /wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=5.1
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253486
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
cf-request-id: 0a83f6b61a000064431398e000000001
last-modified: Tue, 26 Jan 2021 19:48:31 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wrCz43pyd4LvwJcKxbxiwNGMAlzPeiK8lomeG4Fe7plAYJyc3EXjcsXoNwd%2FFEDMC5jUka2JPk5QkafDwCtYukCmU23zs0rhsqW%2BcztzCMESu7bEOMDZLB4Zmb4SX%2F7ZDmtLIB20Agi8hA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 65b35a3688a36443-FRA
expires: Tue, 22 Jun 2021 05:16:12 GMT

GET
H2 200 e-202122.js Show response
stats.wp.com/ 9 KB
3 KB 51ms
15ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202122.js
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-nc: HIT hhn
date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 23 May 2022 05:25:50 GMT

GET
H2 200 platform.js Show response
apis.google.com/js/ 54 KB
21 KB 65ms
26ms Script
application/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/platform.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1533a0437bab2af5169ff33ed8f37ebb2791793bb3e7001bbd6452a8db798216

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-j97XlbjOuIUK316cj5pFxw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "a68431d28598ca094cc7a5b791b0415c"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-j97XlbjOuIUK316cj5pFxw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H2 200 js Show response
static.getclicky.com/ 15 KB
6 KB 61ms
19ms Script
text/javascript 2606:4700::6810:dd1d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.getclicky.com/js
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:dd1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0bd461b72898c4f163b3ec06196d994a2b1a08e361c9703f1221333e69d9c66

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
cf-cache-status: HIT
server: cloudflare
age: 57331
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=604800
cf-ray: 65b35a36cca34e8c-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
x-proxy-cache: HIT
cf-request-id: 0a83f6b64000004e8c31b4c000000001
expires: Sun, 13 Jun 2021 17:27:36 GMT

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ 57 KB
11 KB 46ms
29ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 249722
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 10301
cf-request-id: 0a83f6b6260000d6f5373a5000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-e4d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=3WOJgNAKQlgnesqr39Inmx%2F9%2FXnr3xy5eXuN99pJ4ryG1NqtDIwTpjUOKNvYjQKRfiEziODTwe61IzC9ezoAAT58AboZLh0KSHIJ3upwP1SUnl%2BpmiUX5eG%2FR8Cfk%2BaJTKqlLBdpzE3NXpOA0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 65b35a36aecfd6f5-FRA
expires: Fri, 27 May 2022 17:27:36 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 22 KB
1 KB 27ms
22ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5afc4668b016e01a83f9479a2d96ef54b14bd6e994802e2565421a2fc04df4e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 06 Jun 2021 17:19:25 GMT
server: ESF
date: Sun, 06 Jun 2021 17:27:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H3-29 200 css
fonts.googleapis.com/ 3 KB
575 B 32ms
29ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,700

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

34489ae45b8749aa518a888ad417089b659ef6d87bb41dcfdf520a5876bd4da9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 06 Jun 2021 15:34:04 GMT
server: ESF
date: Sun, 06 Jun 2021 17:27:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H2 200 hotjar-1822886.js Show response
static.hotjar.com/c/ 4 KB
2 KB 127ms
70ms Script
application/javascript 52.85.170.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1822886.js?sv=6

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.170.51 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-170-51.bud50.r.cloudfront.net

Software

Resource Hash

eca91e4a100c07b72ff5522fad81c081c8da9c782fcb49cdb45953156bec9bf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: BUD50-C1
etag: W/e5dc32f0aa52447ade70fcf60af69e39
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
content-length: 1916
via: 1.1 a26540cbff437874d38da8924a9a8923.cloudfront.net (CloudFront)
x-amz-cf-id: 6D8FrH-2xmjlPMQkgIsxNZxFuFLSumysmoFRDFW3S9mFtxECWxlrqw==

GET
H2 200 mixpanel-2-latest.min.js Show response
cdn.mxpnl.com/libs/ 75 KB
25 KB 39ms
2ms Script
text/javascript 2600:1901:0:bc29::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:bc29:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 07bf87548212f24057ba352fed5ec567dab724b44a7fc88ddc393cbc7706d033

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:19:09 GMT
content-encoding: gzip
age: 507
x-guploader-uploadid: ABg5-Uy6UZfbJhm0PQcJORC0dc16amKS0s3qb5TYYvpaQ7cbhHImb6xActhnbFb-Y9V0ESLDK2VjZ7R06cBi61ne5Jg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: clear
content-length: 25572
last-modified: Thu, 28 Jan 2021 18:21:54 GMT
server: UploadServer
etag: "765779983eed1c9fc2821b4507eea08b"
vary: Accept-Encoding
x-goog-hash: crc32c=kP//+g==, md5=dld5mD7tHJ/CghtFB+6giw==
x-goog-generation: 1611858114590219
access-control-allow-origin: *
cache-control: public,max-age=600
x-goog-stored-content-length: 25572
accept-ranges: bytes
content-type: text/javascript
expires: Sun, 06 Jun 2021 17:29:09 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 30 KB
9 KB 63ms
26ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 73e2e5173ed0d5a77b02914fa0ef1f67bb53143da75f0348f558f95565220ca1

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
last-modified: Fri, 28 May 2021 20:25:24 GMT
x-msedge-ref: Ref A: 12D9E11D347D45B19F00B9FF6EE68821 Ref B: FRAEDGE1316 Ref C: 2021-06-06T17:27:36Z
etag: "0d2a696ff53d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 9008

GET
H3-29 200 header-bg.png
oneclickroot.com/wp-content/themes/oneclickroot/images/ 502 B
1 KB 28ms
28ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/header-bg.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3813424f62a838f68ae495b56a6124b5409d36045a2723dcdc246bf88056fc88

Request headers

:path: /wp-content/themes/oneclickroot/images/header-bg.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253440
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 502
cf-request-id: 0a83f6b62000006443eb3f9000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=w51EYKCtCwAFzlACRgkEid5XceGZ4dAIETzwdq5dHotgvzvAyMGCrq%2By7S3bnKsKHSbBPruaDaLQa9g3mTf3bzEDRaQueWe2wCsailYRDc5Ba1JQhka0e0gc35MyWa3ALsMtTBeUcsi9Qw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3698aa6443-FRA
expires: Tue, 22 Jun 2021 05:16:58 GMT

GET
H3-29 200 KFOkCnqEu92Fr1Mu51xIIzI.woff2
fonts.gstatic.com/s/roboto/v27/ 17 KB
17 KB 17ms
16ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOkCnqEu92Fr1Mu51xIIzI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://oneclickroot.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 12:31:12 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 449784
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17304
x-xss-protection: 0
expires: Wed, 01 Jun 2022 12:31:12 GMT

GET
H3-29 200 search.png
oneclickroot.com/wp-content/themes/oneclickroot/images/widgets/ 417 B
1 KB 34ms
16ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/widgets/search.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/widget-style.css?ver=20170330
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78d9c51dc6cbb63a144eeee8f2cc96351a627d047133c171e97cb3a6b2a2f096

Request headers

:path: /wp-content/themes/oneclickroot/images/widgets/search.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/widget-style.css?ver=20170330
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/widget-style.css?ver=20170330
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1249312
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 417
cf-request-id: 0a83f6b63f0000644309112000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=4cFf9ZSAvaZEBjv4RR9PnwajXAjfMozTDIKw6MMB%2BReynzp2jovaA9ryB%2Fch6ceAm4FqS0eGLFzLKeYNaLZOY1UAc7s%2BK8B8Nf7Qqkb22%2BCECO6XJJYDTvDzTxOaZf3F2ItuzC6YQdzKMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a36c8be6443-FRA
expires: Tue, 22 Jun 2021 06:25:46 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 15ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://oneclickroot.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 04:57:07 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 477029
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
expires: Wed, 01 Jun 2022 04:57:07 GMT

GET
H3-29 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v15/ 19 KB
19 KB 15ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v15/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,700

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://oneclickroot.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 05:13:29 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:52 GMT
server: sffe
age: 476047
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19172
x-xss-protection: 0
expires: Wed, 01 Jun 2022 05:13:29 GMT

GET
H3-29 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 17ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://oneclickroot.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 08:33:34 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 464042
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Wed, 01 Jun 2022 08:33:34 GMT

GET
H3-29 200 android-rootable.png
oneclickroot.com/wp-content/uploads/2020/06/ 12 KB
12 KB 17ms
16ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/uploads/2020/06/android-rootable.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f09bbdae620dcf710a12d3826b98e9cc3637446602f3921e80410a751c6dafe

Request headers

:path: /wp-content/uploads/2020/06/android-rootable.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1249761
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 12114
cf-request-id: 0a83f6b66e000064431a8c7000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=YFvTrAZo2TZ%2BeAOvv4H1lz3U%2BwpDYhrDJd9C9hj4K1s1BK6M59YrUZb0ceDMepVKIgSSQ0D4WEg6Du%2BaS3BHc1fKJ7lvPOMuD58RgLkF3g7lHPlHKHBP1Ll7fmXGXYfZ0vfgxGarLi%2BJww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3708d16443-FRA
expires: Tue, 22 Jun 2021 06:18:17 GMT

GET
H3-29 200 android-bul.png
oneclickroot.com/wp-content/uploads/2020/06/ 25 KB
25 KB 14ms
13ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/uploads/2020/06/android-bul.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4a28bee7eba2ad83c74a71fba0fbcb4944cca88f51d546499bc0f8c284d0f83

Request headers

:path: /wp-content/uploads/2020/06/android-bul.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1249761
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 25240
cf-request-id: 0a83f6b66b0000644337314000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Yism0ftt3pIQJ3gvC%2BaW4irJBZ0E9JOw8ISW4nXExUE0RUQgQpAaGk8FI9RPG2kbUgW9JTsUmg4emcfQB9GEqZDcF6XmloICCGeIH%2BP0JyDgRM6fz02a4r4B18R4Zf9qYx%2BAX24VorZx5w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3708d46443-FRA
expires: Tue, 22 Jun 2021 06:18:17 GMT

GET
H3-29 200 android-chat.png
oneclickroot.com/wp-content/uploads/2020/06/ 16 KB
17 KB 21ms
20ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/uploads/2020/06/android-chat.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ced235b4577cee17fe955033b58015406baceebf1d1c1e0aa28c86c53c1b2798

Request headers

:path: /wp-content/uploads/2020/06/android-chat.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1249761
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 16432
cf-request-id: 0a83f6b66e0000644337315000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=OyVGolpV57Qu8urWQ7OeDxo%2BmynQwpGQcVVo1f7d7avLr4Tu9Iiyd81Y3sIemBFxyRb9kdr9lXiwJLeOyjuRz%2BsvwQIws1SaKpodrVzuBB9N6SvxlzH7l5XwMIrFoixHSar5%2Fnk%2FmECANg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3708d56443-FRA
expires: Tue, 22 Jun 2021 06:18:17 GMT

GET
H3-29 200 footer-bg.png
oneclickroot.com/wp-content/themes/oneclickroot/images/ 145 B
759 B 14ms
13ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/footer-bg.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 132c321fadec37119251f1478f57cb7ca4ab382c3a562aedb65bf710348e871c

Request headers

:path: /wp-content/themes/oneclickroot/images/footer-bg.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253486
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 145
cf-request-id: 0a83f6b67a00006443fda17000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5n1mw8uEaOXhZF02nigX7mMetiSvkcEfiw3O7IYgNFOaZDJueJokE%2FXokvHHxBykBWyAXMGnWcsxj%2BCSHfOsRwM%2BiBLGXt6HLTvemcyVpKrF09T3XB0ucvNce1jRhPNtRzLqSP6%2F3Lq%2Bdg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3728e26443-FRA
expires: Tue, 22 Jun 2021 05:16:12 GMT

GET
H3-29 200 fb.png
oneclickroot.com/wp-content/themes/oneclickroot/images/socials/ 2 KB
2 KB 14ms
11ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/socials/fb.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5651b47069d656369d30ed6b1d4e23045b588550f0e51b6c2d3b8f6a24bc99cd

Request headers

:path: /wp-content/themes/oneclickroot/images/socials/fb.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253437
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1761
cf-request-id: 0a83f6b67b0000644313992000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2FFe0GJ2eLs7U9z7Cg830IoZ0%2F5wD1UWjR7hvLwss%2FnVFvaW02W44z1xXjG1u2seAahF4BNfBnCiM1rADKKI0JG9PVq6exqEl%2BkxE2MiI2ElnvkrZHbAEvpTynniiTGwafvw0x5gocKvpHw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3728e36443-FRA
expires: Tue, 22 Jun 2021 05:17:00 GMT

GET
H3-29 200 tw.png
oneclickroot.com/wp-content/themes/oneclickroot/images/socials/ 2 KB
3 KB 14ms
12ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/socials/tw.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1ea2546d8cb4ee9e950a77ef7049f0dd60a0328127926d91af1453b8c63d76c

Request headers

:path: /wp-content/themes/oneclickroot/images/socials/tw.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253437
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 2118
cf-request-id: 0a83f6b67b00006443e7b01000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Blox442z6lwZkM%2BW4%2BH9YPsrx070UZysK%2FGMkglOBjpd1mb6KL73dswY1oC6AQb1TMcfBFnreIJ9b%2FxwQRqvzl3a3c5gXVFds7pc8ETX32dwK2dEz8Wdrcd4iAeRZI4UBjBYVZ0DK2%2Fccw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3728e56443-FRA
expires: Tue, 22 Jun 2021 05:17:00 GMT

GET
H3-29 200 yt.png
oneclickroot.com/wp-content/themes/oneclickroot/images/socials/ 2 KB
3 KB 19ms
17ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/wp-content/themes/oneclickroot/images/socials/yt.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdd0f26fde1892abbb97a0b6161387f8b1775d37084bb004bc12db8cc30034fb

Request headers

:path: /wp-content/themes/oneclickroot/images/socials/yt.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/wp-content/themes/oneclickroot/css/custom-style.css?ver=20170313
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253437
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 2435
cf-request-id: 0a83f6b67b000064432a988000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=1d9g6ZAEiLqKm%2F3666HpvNUJ8wCaJweYhKUKw5E0vfY4RDsG2ER1d1uxFcTHZH5cJ0ifWYP76POeLzfUHUlo6dcgBV%2FMr0QZIP6Q8YWJbFOLIUJDEfHryLW00Gig2FGTlFYx5O%2BFflBsLA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a3728e66443-FRA
expires: Tue, 22 Jun 2021 05:17:00 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 16 KB
16 KB 7ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://oneclickroot.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 02 Jun 2021 00:19:38 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 407278
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
expires: Thu, 02 Jun 2022 00:19:38 GMT

GET
H3-29 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,100,100italic,300,300italic,400italic,500,500italic,700,700italic,900

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://oneclickroot.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 22:49:47 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 412669
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Wed, 01 Jun 2022 22:49:47 GMT

GET
H2 204 5857439.js Show response
bat.bing.com/p/action/ 0
127 B 121ms
121ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/5857439.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ARR/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 06 Jun 2021 17:27:36 GMT
cache-control: private,max-age=86400
x-msedge-ref: Ref A: 1DAC3B0CAFBF496ABE1B5D73F0405256 Ref B: FRAEDGE1316 Ref C: 2021-06-06T17:27:36Z
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 38ms
12ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fdc589c7d9d43e6ec99d0b662d9a2fb4137455aa8ea3901c853b093c0adb4491

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: +2CRwZccYsyfW87/+hD/FA==
cross-origin-resource-policy: cross-origin
expires: Sun, 06 Jun 2021 17:46:58 GMT
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1779
x-fb-rlafr: 0
x-fb-debug: MNxIiKaORq5U5dlt3gkkBsEvOp66+1kgyDM49F4A6hRjMngmxQZr0urCMjnKn6If7kHdE2xHqX0Ljc0eRoMWQg==
x-fb-trip-id: 1709462857
x-fb-content-md5: e10a17a1b3513a0b93a46b48095f29d1
date: Sun, 06 Jun 2021 17:27:36 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "79c9b5321a10c196cf025af4706e9c76"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H3-29 200 plusone.js Show response
apis.google.com/js/ 54 KB
20 KB 49ms
35ms Script
application/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d097a0116293da844fdeeaa11f41dd941e511e6df699ff2195e8499de8a42fd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kEebJjEDGiL5/yvojpFyJw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "920a6e51949cf2eec053a3396b28fac1"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-kEebJjEDGiL5/yvojpFyJw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 28ms
6ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6794) /
Resource Hash: a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 06 Jun 2021 17:27:36 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Apr 2021 17:57:32 GMT
Server: ECS (frb/6794)
Age: 162
Etag: "9eb59e5602fef4b3ebf6090856ff21db+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 28779

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 973
date: Sun, 06 Jun 2021 17:11:23 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Sun, 06 Jun 2021 19:11:23 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 90 KB
35 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M4DMRL

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

611c0522eeece05559f145a61bbff3839bfefe6e7b9e59e96e69225228f92418

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35454
x-xss-protection: 0
last-modified: Sun, 06 Jun 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H3-29 200 GB.png
oneclickroot.com/flags-iso/shiny/24/ 1 KB
2 KB 19ms
16ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/GB.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a387d8558f49244c17766a18c27cacebdf97e8135ae386fa8e6aacca8aaa636

Request headers

:path: /flags-iso/shiny/24/GB.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253427
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 1132
cf-request-id: 0a83f6b6e800006443030ee000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=X0OEJYJjkgtMRtHmc5sCpm17KTWtBjLapl1PrbCHbGCoUTzz670sxJOIHTE7pMzLJpx6kp5GbTiL32v4y4TCAq5EPHKVrcqP5yr0OjqiZ6iXGMcJiXg20zZRk75mUPgy24YmN0zTGVKMuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9236443-FRA
expires: Tue, 22 Jun 2021 05:17:10 GMT

GET
H3-29 200 ES.png
oneclickroot.com/flags-iso/shiny/24/ 705 B
1 KB 17ms
15ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/ES.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c246ec07b24762244202158adadb0d006913c39f924c7d01d0ff00d2d024a0af

Request headers

:path: /flags-iso/shiny/24/ES.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253425
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 705
cf-request-id: 0a83f6b6e800006443eb002000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=FZCot0PP9zJT4CqLjgtqiMIGLGLAWMPs%2BVsAW2UZoN12%2Ft6ba7H1eVAjpfwPGyJaNQlrKLNc%2FM64CIFlHWVXrWG0HJu2fXzTU1n4rwtEMNMk34O8Evj9YlHaJX5NIXggIagShK4h1%2F%2BUCA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9246443-FRA
expires: Tue, 22 Jun 2021 05:17:12 GMT

GET
H3-29 200 FR.png
oneclickroot.com/flags-iso/shiny/24/ 851 B
1 KB 17ms
15ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/FR.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f494c6d8894113fcc5724294d52ff485c8d28b2d898a00975df52f1b6cb88584

Request headers

:path: /flags-iso/shiny/24/FR.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253425
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 851
cf-request-id: 0a83f6b6e900006443fda1d000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=GFHOitBTUTHaOKFjMc58fxtShlcXfMGn%2BhWqaDdJJ0WUKRVjhqk0%2BaKlU6eEDDKXDX%2FbwXyveMDGCocSX4rng61UHmKb0PMyvhLg3BVOrChvw3buXYQ0hvmf5BITajCta%2BWS3ulT6I9JHg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9256443-FRA
expires: Tue, 22 Jun 2021 05:17:12 GMT

GET
H3-29 200 DE.png
oneclickroot.com/flags-iso/shiny/24/ 509 B
1 KB 18ms
15ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/DE.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 802a3cb7595f14f16c36837989c3891dec2b38166b5a75bfdb2fde7c4ab09a4d

Request headers

:path: /flags-iso/shiny/24/DE.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253425
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 509
cf-request-id: 0a83f6b6e9000064431a8ce000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=TKCHhpe9gwP0WGnoHYFAjxMfDtDLlGkR%2B2diFqAPVpAZgtRQZ20ur38PUeFrFGhPpbIK7ENAkZxE3r8MeQAbdchxOvnwwsbreuVmn8ZeeVPYilTRbk2F72WtCuWhpLppJisIBF4Qa%2BZT1A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9266443-FRA
expires: Tue, 22 Jun 2021 05:17:12 GMT

GET
H3-29 200 IT.png
oneclickroot.com/flags-iso/shiny/24/ 851 B
1 KB 19ms
17ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/IT.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b6cf86376b18e7013022123018f749c4427bc442df1ca43d05f7514b1984980

Request headers

:path: /flags-iso/shiny/24/IT.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253424
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 851
cf-request-id: 0a83f6b6ea000064431399a000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=lPcVDEXMFw%2BvaXjKz55NrZnc2a9ZINlT9Ovp1XyvIs2DZPejzg%2FboGE3j247B2oj4W4lwHkaimbtw%2Fqam3OI8JGPCgKezF0%2FMvzsY70FBuVePP%2BLp6zHoRnQgGUM9oWrviH7PbW%2FojU6dQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9276443-FRA
expires: Tue, 22 Jun 2021 05:17:13 GMT

GET
H3-29 200 PT.png
oneclickroot.com/flags-iso/shiny/24/ 869 B
1 KB 21ms
19ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/PT.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e13a24713c60de07775945d4f347acc364ae5f5f156ac3186329c0dcdfa7c69

Request headers

:path: /flags-iso/shiny/24/PT.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291783
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 869
cf-request-id: 0a83f6b6ea00006443e7b09000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=I6YYe1yJYH3UqpoC6DvgMd7Kk0jdck035D0aUBHK8%2FfJoilzAO2e7SBDNFtVMVTNLOsDogvRhMU08xEs0NdL76vfQ7PZq18d0LrdT4KGG7mxhHC%2BWC7lX%2Flfw1GbNiXHjgtInu1gn9zDBw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9296443-FRA
expires: Mon, 21 Jun 2021 18:37:54 GMT

GET
H3-29 200 NL.png
oneclickroot.com/flags-iso/shiny/24/ 509 B
1 KB 17ms
15ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/NL.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1fbaef854e0f55871aa050995066ea783c517640ba307e4971a5dfa009342b1

Request headers

:path: /flags-iso/shiny/24/NL.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291783
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 509
cf-request-id: 0a83f6b6ea000064433731b000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=icPr7ukZ7h6tt7JMIRRMxdC4S6JCoc7qojS0BHHgdy0i5PhOiirAl3pGgWZLI30W0n3XwzfosXp9KDErhvqTBKzdaftqpuQqzXyjESn3tGZyLbjlAMgMo6qgtFuAHVm2yfwkyCNafWDp9w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d92a6443-FRA
expires: Mon, 21 Jun 2021 18:37:54 GMT

GET
H3-29 200 RU.png
oneclickroot.com/flags-iso/shiny/24/ 520 B
1 KB 19ms
17ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/RU.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a4a435a77ba9821779ff039d294facf001ace345b9173c180754f425970b2d1a

Request headers

:path: /flags-iso/shiny/24/RU.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1291783
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 520
cf-request-id: 0a83f6b6eb000064430b989000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=wAhpezVJuUDnq0%2FRL0nk%2FvMxeCgbeX05YRLE2dnYhCh9LiLS18TMuDdeYXsHj%2BCt3NM%2BmNhT43MEb6ZdxcHIVNVQV09xhO0ES%2Fs%2FSuEW8ulNwj0oAoEbI%2FiemA3SW5ywKzloHDAhW0Dlpg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d92b6443-FRA
expires: Mon, 21 Jun 2021 18:37:54 GMT

GET
H3-29 200 JP.png
oneclickroot.com/flags-iso/shiny/24/ 626 B
1 KB 30ms
28ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/JP.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82a5f826524292eb1bb531a7aaada0614f83dc0487e90a9549b394ce6f9cac44

Request headers

:path: /flags-iso/shiny/24/JP.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253424
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 626
cf-request-id: 0a83f6b6ec000064432a98c000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Wy3EBfu7etGYlhUebPRw4qn1tl%2BPLO%2FG1odun2O7OIxpfYhTQ59CXQrOlx0EOLNjq8abiUJNJ752w4bUgk6DOWzbJ4RCBxnaeV4yupDQcsCrwT9yF6mjVtY00SCOR9115pofxvkX%2BEreaw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d92c6443-FRA
expires: Tue, 22 Jun 2021 05:17:13 GMT

GET
H3-29 200 KR.png
oneclickroot.com/flags-iso/shiny/24/ 947 B
2 KB 19ms
18ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/KR.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a3f4c76a79a739f201a7d58866606219b635e3f31c641391d2cfcb8ac408f57d

Request headers

:path: /flags-iso/shiny/24/KR.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253424
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 947
cf-request-id: 0a83f6b6ec00006443efa51000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=q9vlogwtzTlh4Fs8smnJT6npTmtUhvYfbhBPnSmpSGc%2BSVguYQ%2FamdXzrtj4FVLP0yLp%2Bp5GhtRi9u1kQDQPfzwB4W7X2GgNHwzOvH%2FMrMchjyUI4R%2Fa1iTLSBWaHQC%2F%2B60X7wBZlXST9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d92d6443-FRA
expires: Tue, 22 Jun 2021 05:17:13 GMT

GET
H3-29 200 SA.png
oneclickroot.com/flags-iso/shiny/24/ 939 B
2 KB 37ms
35ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/SA.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1914089b9ec68a3b941d15a5315684bcb4362329b5ffc2dcf49c667c2964376e

Request headers

:path: /flags-iso/shiny/24/SA.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253424
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 939
cf-request-id: 0a83f6b6ed0000644322acd000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=5DRAfEHISovJYoLF7%2Fi%2FnDWrn%2B9qfClp7snb688Dtkk9aU2Fed%2F%2B9U%2FSHe6RxAu9UsWf3IZBrV7wTOhJbtl%2FO47WFIsQYFRaZHXbI%2B2jgRvOhDUgnFIR5sUcr0OlTerS6OpwTyzT5fDOug%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d92e6443-FRA
expires: Tue, 22 Jun 2021 05:17:13 GMT

GET
H3-29 200 IL.png
oneclickroot.com/flags-iso/shiny/24/ 637 B
1 KB 24ms
23ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/IL.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22ba83b4eb02be9f9579bea1374f2572ef3990eb2a3b481d8d075c6c96455824

Request headers

:path: /flags-iso/shiny/24/IL.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253424
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 637
cf-request-id: 0a83f6b6ed00006443f8290000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=%2B3arK58wesRyvAqj0LW64Wu1mOPP%2Fx5dc4a8P%2B%2BQFDR%2BnCx7otX5hJLAhkNrmA9MMOci3IwNvPBWnHvcjNSMOriU9gTl%2F6d%2FnJoFGAwDOmLgojtg7IP8wbltg7DilBLcl0z6nIiv0MXp8w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9306443-FRA
expires: Tue, 22 Jun 2021 05:17:14 GMT

GET
H3-29 200 CN.png
oneclickroot.com/flags-iso/shiny/24/ 845 B
1 KB 20ms
19ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://oneclickroot.com/flags-iso/shiny/24/CN.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0dbbf2dce996285ba6dc8de4e5e41e045a15b6ae694846c8e116483a9f23aa3b

Request headers

:path: /flags-iso/shiny/24/CN.png
pragma: no-cache
cookie: PHPSESSID=27a6e276161842e0c88973e1cbff90ec; mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel=%7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: oneclickroot.com
referer: https://oneclickroot.com/download-apk/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://oneclickroot.com/download-apk/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253424
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 845
cf-request-id: 0a83f6b6ed000064430911a000000001
last-modified: Tue, 26 Jan 2021 19:48:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AvweCoyVuFXBa7Qo8cfYc8L6z%2BqQ9fPMIU1r%2FENSxY35yG6YvRr5dNSAPLDDskGK%2FgLklrf5vHxz%2F0dqVC%2F4LxfWj2dY2GU9oFZQ3cpe1Hho9cldMGe60PABhMYjTOgmA%2FdF136Y%2Fu0rQw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9326443-FRA
expires: Tue, 22 Jun 2021 05:17:14 GMT

GET
H2 200 g.gif
pixel.wp.com/ 50 B
92 B 8ms
6ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A9.7.1&blog=190161027&post=0&tz=0&srv=oneclickroot.com&host=oneclickroot.com&ref=&fcp=1292&rand=0.3718790312419771
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 , United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H3-29 200 yt.png
www.oneclickroot.com/wp-content/themes/oneclickroot/images/socials/ 2 KB
3 KB 23ms
23ms Image
image/png 2606:4700:3033::ac43:d826
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.oneclickroot.com/wp-content/themes/oneclickroot/images/socials/yt.png
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::ac43:d826 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fdd0f26fde1892abbb97a0b6161387f8b1775d37084bb004bc12db8cc30034fb

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1253265
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 2435
cf-request-id: 0a83f6b6ed00006443fda1f000000001
last-modified: Fri, 29 Jan 2021 21:10:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Duk7nAk14klsD9oLvROJMxerb9gafyTLRHftxpfATzYRVNGTcsg0F4KDVof1EANOdlrcHZUgxbwDSzo7XqKLsr%2Fush%2Fz5RXvQRhWcHOHf1ndsK5rb0cvZDB8geeiplkoDHeiNn1bYlfI2lyJyIo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=2592000
accept-ranges: bytes
cf-ray: 65b35a37d9346443-FRA
expires: Tue, 22 Jun 2021 05:19:53 GMT

GET
H3-29 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210601/r20190131/ 232 KB
86 KB 45ms
31ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210601/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2683709611132395&plah=oneclickroot.com&amaexp=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0d5f76008f1784b20b99d51741b2f8b8bbee28d5f2950ca2cf4226b6d61b1344

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87637
x-xss-protection: 0
server: cafe
etag: 15632250250964762239
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 06 Jun 2021 17:27:36 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210601/r20190131/ Frame 5E3F 10 KB
5 KB 25ms
6ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210601/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1dad6cb9a0903898a8f82f89c0d10ee6e94f8459228530fa5df3078100c9f650

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210601/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 05 Jun 2021 23:11:58 GMT
expires: Sat, 19 Jun 2021 23:11:58 GMT
content-type: text/html; charset=UTF-8
etag: 15349191498103243965
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4506
x-xss-protection: 0
age: 65738
cache-control: public, max-age=1209600
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 0
bat.bing.com/action/ 0
149 B 32ms
32ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5857439&Ver=2&mid=440efbc4-1ab7-4cba-9c3e-ba82af949179&sid=7c99f8d0c6ec11eb811aad28f74aa505&vid=7c99d810c6ec11ebb312cfe952178233&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Nothing%20found%20for%20Download%20Apk&p=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&r=&lt=1416&evt=pageLoad&msclkid=N&sv=1&rn=166791
Requested by: Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Sun, 06 Jun 2021 17:27:36 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 1AE701ABD76E43469C96A6BCD1A5858A Ref B: FRAEDGE1316 Ref C: 2021-06-06T17:27:37Z
x-cache: CONFIG_NOCACHE
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/ 78 KB
78 KB 24ms
24ms Font
application/octet-stream 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://oneclickroot.com
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 6553124
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
content-length: 79444
cf-request-id: 0a83f6b73f00002bf2b80f3000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-13654"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=h3IOfWcClV0BLFcynrlgoY82TeKjqC%2FMobvBQ%2BRcA%2FXPNnkeRPzfRaJz9WpV1iIh5pPk6JH5WfynWDerkjX4utElOnvcHE46dys5NbdYaHRUIgSTQu8TPpMcUvgzUexIjVu8Kcpls8cU31ENfA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 65b35a3869762bf2-FRA
expires: Fri, 27 May 2022 17:27:37 GMT

GET
H2 200 modules.734bd4b678d25642f35b.js Show response
script.hotjar.com/ 219 KB
58 KB 80ms
29ms Script
application/javascript 52.85.170.61
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.734bd4b678d25642f35b.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1822886.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.170.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-170-61.bud50.r.cloudfront.net

Software

Resource Hash

97d7a6a99d78ef625f666a5eadb2ebc807a035af276abf045f87050e1be2761d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 03 Jun 2021 10:15:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 285152
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 58989
access-control-allow-origin: *
last-modified: Thu, 03 Jun 2021 10:14:54 GMT
etag: "7b5811df19fd9039ed7e0c4af36daa03"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 a3c3236fb9c392e8c5978c750d2f8309.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: BUD50-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: ULGck8_3RnQ207dRgXRAk7JCrVVf6FY5J7u-JAqz8Brsiy53cLgDYA==

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1432235498&t=pageview&_s=1&dl=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&ul=en-us&de=UTF-8&dt=Nothing%20found%20for%20Download%20Apk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=1033192664&gjid=1280470345&cid=747202333.1623000457&tid=UA-38268321-1&_gid=209733095.1623000457&_r=1&_slc=1&z=836423513

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://oneclickroot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK widget_iframe.06c6ee58c3810956b7509218508c7b56.html Show response
platform.twitter.com/widgets/ Frame 7FAA 319 KB
103 KB 7ms
7ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Foneclickroot.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/674C) /
Resource Hash: 5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://oneclickroot.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 250773
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Sun, 06 Jun 2021 17:27:37 GMT
Etag: "dab7ee9ff99366614e06e117bab5e542+gzip"
Last-Modified: Wed, 28 Apr 2021 17:56:54 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/674C)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105298

GET
H3-29 200 all.js Show response
connect.facebook.net/en_US/ 219 KB
64 KB 15ms
14ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=da384a375b512ca5b1fe1568bea45a54&ua=modern_es6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6d3b6c2cce62a128cd3ce8734e5ca4b1f2ef83e86b70d09114d645752302946a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://oneclickroot.com
Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: AoxmiGjIqUHSTHL0Zy8uww==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 65824
x-fb-rlafr: 0
x-fb-debug: U1ftKHR9ldqGJgJN3v/UWXaCHqn7OSURUSyhKhF2Nsob9wx4IIHG4B4ty9hD2R7HhY1W8NYvzdAM6aUeXbL5lQ==
x-fb-content-md5: ba8f91daef8c9517ce57364e44795a69
x-frame-options: DENY
date: Sun, 06 Jun 2021 17:27:37 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "4ae8c9a7bf595a92aedb7bb645e148bc"
timing-allow-origin: *
priority: u=3,i
expires: Mon, 06 Jun 2022 16:25:56 GMT

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.p7L79FLXQCw.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO6hl1EejjzC-wrWbDdgTxPi0Gs8g/ 142 KB
50 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.p7L79FLXQCw.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCO6hl1EejjzC-wrWbDdgTxPi0Gs8g/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

187e5ab1d37aaa4779205fddec1d0bd632c73ba09db7590c8f79bc238557932f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 06:01:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 41144
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51027
x-xss-protection: 0
last-modified: Wed, 19 May 2021 15:07:34 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Mon, 06 Jun 2022 06:01:53 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
431 B 41ms
14ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-38268321-1&cid=747202333.1623000457&jid=1033192664&gjid=1280470345&_gid=209733095.1623000457&_u=IEBAAAAAAAAAAC~&z=1802724661

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 06 Jun 2021 17:27:37 GMT
content-type: text/plain
access-control-allow-origin: https://oneclickroot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 38ms
17ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M4DMRL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

4da18cf3cfa4b3d576d9eda3450e2773c95ad8a660ec2998c7a7287f4191daf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13934
x-xss-protection: 0
server: cafe
etag: 6909554294999178257
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 06 Jun 2021 17:27:37 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
67 B 28ms
14ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j90&tid=UA-38268321-1&cid=747202333.1623000457&jid=2129596076&gjid=145673966&_gid=209733095.1623000457&_u=aGDAgAABAAAAAG~&z=484242389

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 06 Jun 2021 17:27:37 GMT
content-type: text/plain
access-control-allow-origin: https://oneclickroot.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j90&a=1432235498&t=pageview&_s=1&dl=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&ul=en-us&de=UTF-8&dt=Nothing%20found%20for%20Download%20Apk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgAABAAAAAC~&jid=2129596076&gjid=145673966&cid=747202333.1623000457&tid=UA-38268321-1&_gid=209733095.1623000457&gtm=2wg621M4DMRL&z=1985381554

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 15:46:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 6086
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 box-25a418976ea02a6f393fbbe77cec94bb.html Show response
vars.hotjar.com/ Frame E118 2 KB
1 KB 74ms
23ms Document
text/html 52.85.170.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-25a418976ea02a6f393fbbe77cec94bb.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1822886.js?sv=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.170.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-170-33.bud50.r.cloudfront.net
Software: /
Resource Hash: 7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-25a418976ea02a6f393fbbe77cec94bb.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

content-type: text/html
content-length: 1044
date: Thu, 03 Jun 2021 10:15:05 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "76922233be8bdb14c053af468d29404a"
last-modified: Thu, 03 Jun 2021 10:14:54 GMT
x-amz-server-side-encryption: AES256
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 d84412fe91532b74b0fb5833b7857e01.cloudfront.net (CloudFront)
x-amz-cf-pop: BUD50-C1
x-amz-cf-id: pcnQJFNj3GsY3eLLRUczY_k_lrivLvi9ty0rLtgMVFwoIpRfDlgrvw==
age: 285152

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 206 B
644 B 38ms
15ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=oneclickroot.com&callback=_gfp_s_&client=ca-pub-2683709611132395

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210601/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2683709611132395&plah=oneclickroot.com&amaexp=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

9f92d9904edc2f0e70b1e1519562454983d2063c509aa321b10ce77ff4f24f83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 195
x-xss-protection: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 39ms
38ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tn=DIV&id=cookie-law-info-bar&ign=false

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
799 B 36ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=oneclickroot.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 35ms
14ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=oneclickroot.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E932 8 KB
1 KB 80ms
79ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&adk=1812271804&adf=3025194257&lmt=1623000457&plat=1%3A16809992%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456961&bpp=3&bdt=341&idt=162&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=846926675092&frm=20&pv=2&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=186

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5226bd3b12b75b176426f2be33bdee0eaa9e04f8c1013e0fd57f647206a316e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2683709611132395&output=html&adk=1812271804&adf=3025194257&lmt=1623000457&plat=1%3A16809992%2C2%3A32776%2C8%3A134217728%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456961&bpp=3&bdt=341&idt=162&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&nras=1&correlator=846926675092&frm=20&pv=2&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=186
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 06 Jun 2021 17:27:37 GMT
server: cafe
content-length: 1144
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 06-Jun-2021 17:42:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 06 Jun 2021 17:27:37 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 33ms
13ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a06800ad719e1f1b46691ded5a5577666d2fc30f950b0ba544352ede4e25de7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622805992319560"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28149
x-xss-protection: 0
expires: Sun, 06 Jun 2021 17:27:37 GMT

GET
H2 200 in.php Show response
in.getclicky.com/ 139 B
435 B 443ms
147ms Script
text/javascript 198.145.13.14
IINET-2044

General

Check archive.org

Show headers Download Go to

Full URL: https://in.getclicky.com/in.php?site_id=66638085&type=pageview&href=%2Fdownload-apk%2F&title=Nothing%20found%20for%20Download%20Apk&res=1600x1200&lang=en&jsuid=1082188309&mime=js&x=0.8854975345311904
Requested by: Host: static.getclicky.com
URL: https://static.getclicky.com/js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.145.13.14 Portland, United States, ASN2044 (IINET-2044, US),
Reverse DNS: getclicky.com
Software: nginx /
Resource Hash: 5b50918195f5e1e0a7cf6917b5c71d590169d3b5a61b1e15228087d9621a537a

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate, post-check=0, pre-check=0
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B927 65 KB
22 KB 521ms
521ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=7752804668&adk=772853018&adf=938969183&pi=t.ma~as.7752804668&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=390x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456964&bpp=2&bdt=345&idt=208&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=130&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sME1KIdDhD&p=https%3A//oneclickroot.com&dtd=213

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6da58d9e2e025ed65f71362d0912e154c7712188846b1d365407b32811591b03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=7752804668&adk=772853018&adf=938969183&pi=t.ma~as.7752804668&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=390x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456964&bpp=2&bdt=345&idt=208&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=130&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sME1KIdDhD&p=https%3A//oneclickroot.com&dtd=213
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 06 Jun 2021 17:27:37 GMT
server: cafe
content-length: 22179
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 06-Jun-2021 17:42:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 06 Jun 2021 17:27:37 GMT
cache-control: private

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F8BE 74 KB
24 KB 640ms
639ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2c456a0d18af7915a660b1c1ee73a74520d3179eea236178778ee30b9505414

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 06 Jun 2021 17:27:37 GMT
server: cafe
content-length: 24743
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sun, 06-Jun-2021 17:42:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 06 Jun 2021 17:27:37 GMT
cache-control: private

GET
H3-29 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956684001/ 2 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956684001/?random=1623000457208&cv=9&fst=1623000457208&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg621&sendb=1&ig=1&frm=0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tiba=Nothing%20found%20for%20Download%20Apk&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e696d9d16c3eb699981f86b7374a1d8bde5ea79ebbd91cf2777c1155b963edb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1027
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/956684001/ 2 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/956684001/?random=1623000457210&cv=9&fst=1623000457210&num=1&label=26VjCJzew1gQ4a2XyAM&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg621&sendb=1&ig=1&frm=0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tiba=Nothing%20found%20for%20Download%20Apk&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18f81b7374f2a878c5b44689e0496e86f27e3f549205eec7ade5b0fca45d1fab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1074
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 57ms
33ms Fetch
text/plain 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=442973669095021&input_token&origin=1&redirect_uri=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=da384a375b512ca5b1fe1568bea45a54&ua=modern_es6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: pXCLh6WEWErYNATcONVDlZ2Z+tQXQv8PEd22c9wtjZMZviu+sk1p2/4gczm034/l3XKO+X3p3PR79RvQKHHpEQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 06 Jun 2021 17:27:37 GMT
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://oneclickroot.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956684001/ 42 B
108 B 49ms
30ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956684001/?random=1623000457210&cv=9&fst=1622998800000&num=1&label=26VjCJzew1gQ4a2XyAM&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg621&sendb=1&frm=0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tiba=Nothing%20found%20for%20Download%20Apk&async=1&fmt=3&is_vtc=1&random=2160191948&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956684001/ 42 B
108 B 50ms
31ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956684001/?random=1623000457210&cv=9&fst=1622998800000&num=1&label=26VjCJzew1gQ4a2XyAM&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg621&sendb=1&frm=0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tiba=Nothing%20found%20for%20Download%20Apk&async=1&fmt=3&is_vtc=1&random=2160191948&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/956684001/ 42 B
552 B 46ms
28ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/956684001/?random=1623000457208&cv=9&fst=1622998800000&num=1&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg621&sendb=1&frm=0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tiba=Nothing%20found%20for%20Download%20Apk&async=1&fmt=3&is_vtc=1&random=2575239183&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/956684001/ 42 B
552 B 38ms
19ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/956684001/?random=1623000457208&cv=9&fst=1622998800000&num=1&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg621&sendb=1&frm=0&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&tiba=Nothing%20found%20for%20Download%20Apk&async=1&fmt=3&is_vtc=1&random=2575239183&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: oneclickroot.com
URL: https://oneclickroot.com/download-apk/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 7FAA 256 B
442 B 133ms
118ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=930ca12721e86c2545eb17ecb87aadc5f8f5f2ba

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.06c6ee58c3810956b7509218508c7b56.html?origin=https%3A%2F%2Foneclickroot.com

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
last-modified: Sun, 06 Jun 2021 17:27:37 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: a5b923dfbdd54be640e814921a5cf4eb60e132ce14fa0b51f343d35d0382737f
content-length: 176

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 28ms
15ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=oneclickroot.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 28ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=oneclickroot.com

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B280 61 KB
24 KB 802ms
802ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e01afe8a86d28d6600bf070d55298612f09bbcbd1f46b8169a61baf9cdd32b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 06 Jun 2021 17:27:38 GMT
server: cafe
content-length: 24436
x-xss-protection: 0
set-cookie: IDE=AHWqTUltZP39JZfI2ffyHX2Jl2sNKjVm8luWKDGPBbRQXLpndhfrSW0q3MQmeL9VIIQ; expires=Fri, 01-Jul-2022 17:27:37 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; expires=Fri, 01-Aug-2008 22:45:55 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 06 Jun 2021 17:27:38 GMT
cache-control: private

GET
H3-29 200 css
fonts.googleapis.com/ Frame B927 3 KB
578 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=7752804668&adk=772853018&adf=938969183&pi=t.ma~as.7752804668&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=390x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456964&bpp=2&bdt=345&idt=208&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=130&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sME1KIdDhD&p=https%3A//oneclickroot.com&dtd=213

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 06 Jun 2021 17:04:46 GMT
server: ESF
date: Sun, 06 Jun 2021 17:27:37 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 06 Jun 2021 17:27:37 GMT

GET
H2 200 bg_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/ Frame B927 6 KB
3 KB 29ms
10ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/bg_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e582eab9f97529cf56731793b29d7d6f82ce7cf3757f65e170aef28515e19e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 00:52:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59708
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2634
x-xss-protection: 0
server: cafe
etag: 6665593826416850973
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 00:52:29 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame B927 1 KB
989 B 27ms
11ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:25:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 882
x-xss-protection: 0
server: cafe
etag: 11243716317595354070
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:25:31 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/ Frame B927 17 KB
7 KB 25ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9de83c923a234e8b164d2351ed47b456ec3417785b5fc33b4827f071f51f05f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7001
x-xss-protection: 0
server: cafe
etag: 17954294202796946299
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:27:17 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame B927 2 KB
1 KB 28ms
11ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:24:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:24:07 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B927 122 KB
37 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622806011323838"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Sun, 06 Jun 2021 17:27:37 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame B927 13 KB
6 KB 25ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27466895d3e9250f3d0ae0e726f72b8a5c23e2aa83f9caaaf99dcb9f18fcac4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 413
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1091097466425408374
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:20:44 GMT

GET
H2 200 3b821d177d35ff0343c5a517c12ac1c9.js Show response
www.gstatic.com/mysidia/ Frame B927 25 KB
11 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3b821d177d35ff0343c5a517c12ac1c9.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d7bc2e5c2959435469986ff3eb98d158edf428ed8eeccb0e8ffe31d3336c9ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 06:53:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210846
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10549
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 00:10:36 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 02 Sep 2021 06:53:31 GMT

GET
H3-29 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/15493501565930346513/ Frame B927 11 KB
11 KB 21ms
6ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15493501565930346513/downsize_200k_v1?w=400&h=209

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c9ef034019aa39323b351f1d81fb4ac07a736f696b8204c20986fd31c8b9bdf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 04:15:52 GMT
x-content-type-options: nosniff
age: 479505
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11383
x-xss-protection: 0
last-modified: Thu, 01 Apr 2021 15:05:47 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 01 Jun 2022 04:15:52 GMT

GET
DATA 200
OK truncated
/ Frame B927 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 /
track.seadform.net/adfserve/ Frame B927 35 B
0 67ms
21ms Fetch
image/gif 37.157.6.253
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.seadform.net/adfserve/?bn=43890171;1x1inv=1;srctype=3;ord=3416429599

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.253 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

s1.adform.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
expires: -1

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame B927 0
0 18ms
18ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C2CxPiQW9YN6XDOyW1fAP3fywuAzk5YLNYsGzw6unDZCejtePDhABIL-7qj5glQKgAcjk14oDyAEJqQKljNEhqGm0PqgDAcgDywSqBOMBT9C8Nwz1iWeXpNozNCp-YIHk-bp-hMq7mWXoNdMHvo4B0EZp5VaS3iYwPNy0BxRY1rLWnFELpfJ_2xB3zzLo54clXcbGLlM1OalcuKam4Ym_XyDrfct2tndT2REDymiYyfCr0NuOcX0dPWHr28jGRL0lAV5rJjd2PwfYz4y5S1Nka-X1Hlx6ER6GEyXmEkboiLPGT0A1YJy0vRMARO1rtC-QT_p6eod6iAV7qaJJ40VtoWWRuWCLG71z8uv_HREolu1HPRKE1GzK4-EFbsjhGAX1RUaD8gaMWQxoIcJv0Gre3W3ABNTg5eWyA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYugAegm6h1qAeKnLECqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH7NUb2AcA8gcEELXxCtIICQiA4YAQEAEYH4AKAcgLAbgTiCfYEw2IFALQFQGYFgGAFwGyFxoKGAgAEhRwdWItMjY4MzcwOTYxMTEzMjM5NQ&sigh=hYtVL8HVSA0&template_id=5000

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=7752804668&adk=772853018&adf=938969183&pi=t.ma~as.7752804668&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=390x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456964&bpp=2&bdt=345&idt=208&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=130&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=sME1KIdDhD&p=https%3A//oneclickroot.com&dtd=213
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 06 Jun 2021 17:27:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 06 Jun 2021 17:27:37 GMT

GET
DATA 200
OK truncated
/ Frame B927 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1f044d98fc4d2f36e57186c1bf1eb9d11784e38e6cf55beb0208fc9a2bef09f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame B927 21 KB
21 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 06:30:43 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:21 GMT
server: sffe
age: 471414
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21716
x-xss-protection: 0
expires: Wed, 01 Jun 2022 06:30:43 GMT

GET
H3-29 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v27/ Frame B927 21 KB
21 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://googleads.g.doubleclick.net
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 22:10:26 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Nov 2020 20:26:16 GMT
server: sffe
age: 415031
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21552
x-xss-protection: 0
expires: Wed, 01 Jun 2022 22:10:26 GMT

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame B422 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/bg_fy2019.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 06:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 211237
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 06:47:00 GMT

GET
H3-29 200 bgl_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/ Frame F8BE 4 KB
2 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/elements/html/bgl_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee56037ac8fbd38d712a70f714fef6f8cb5aa40419b5e62f4b39a5c270226e2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 10:17:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 25798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2171
x-xss-protection: 0
server: cafe
etag: 6229439154439569843
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 10:17:39 GMT

GET
H3-29 200 10076819833865964427
tpc.googlesyndication.com/simgad/ Frame F8BE 73 KB
73 KB 7ms
7ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10076819833865964427?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnl5JWRRCACtAOFyZttzKOvunDeog

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

66873f18b674747bca014166e9c00769a6edc39d00cb50a6ded799893d6c834a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 01 Jun 2021 17:01:01 GMT
x-content-type-options: nosniff
last-modified: Wed, 19 May 2021 09:09:57 GMT
server: sffe
age: 433596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74595
x-xss-protection: 0
expires: Wed, 01 Jun 2022 17:01:01 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/ Frame F8BE 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9de83c923a234e8b164d2351ed47b456ec3417785b5fc33b4827f071f51f05f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7001
x-xss-protection: 0
server: cafe
etag: 17954294202796946299
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:27:17 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame F8BE 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:24:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 210
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:24:07 GMT

GET
H3-29 200 transparent.png
tpc.googlesyndication.com/pagead/images/ Frame F8BE 67 B
91 B 8ms
8ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/transparent.png

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 06 Jun 2021 05:13:53 GMT
x-content-type-options: nosniff
server: cafe
age: 44024
etag: 2462972746714251406
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67
x-xss-protection: 0
expires: Mon, 07 Jun 2021 05:13:53 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F8BE 122 KB
37 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:37 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622806011323838"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Sun, 06 Jun 2021 17:27:37 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame F8BE 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27466895d3e9250f3d0ae0e726f72b8a5c23e2aa83f9caaaf99dcb9f18fcac4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 413
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1091097466425408374
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:20:44 GMT

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame F8BE 25 KB
10 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8c60d643e58946baee86cbad5d665082f2acbb595f5dbc337f2a9d3f5fe39e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 07:17:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36618
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10533
x-xss-protection: 0
server: cafe
etag: 2880717265082513417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 07:17:19 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame F8BE 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CMdIeiQW9YILaDOOG1fAP8KqKQIqc85Jj_bSNuPMN5tObzd0bEAEgv7uqPmCVAqABgZm0wAPIAQKoAwHIA8kEqgTiAU_QHXGa9-_qEwg3d53RTCwd6huVHdh4-XNChybZSCQQZ1Wl765aEPpn6AeUMs1mmbToEUjG3u4FqkYTGgZ--3_2YosFAR3Ot1Y7-Kw9TE31HrHq7MWoHTK7qJG3Lh6eDLKSKdoNqyFPTv_XtyERrCldgZStWqLB_shqEG1Dsl5Ayj8gg_IZc-9nxdtpf-LyFJLZeuuXDpfzG1jwBDm5L1_RmzjhqdrWJ_8dUJnwxwYvSIZJrfkd4DsNo61pT4iOEI-IfpzvNCdtKOxjRcc0WQ22ti7Ob3p8pZyQGdgeOPCgLuDABJfRha7PA5IFBAgEGAGSBQQIBRgEoAYCgAefn_qhAagHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBD--xDSCAkIgOGAEBABGB-ACgHICwHYEw3QFQGAFwGyFxoKGAgAEhRwdWItMjY4MzcwOTYxMTEzMjM5NQ&sigh=1MacOJw3kNk

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 06 Jun 2021 17:27:37 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C79A 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkWURMqxgeTR3iZNgBQaYPeVtkWzGhQlCPQNIgxrBcQLcZR6gvSy4tS2EltgNo; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=280&slotname=9132342665&adk=1402971634&adf=3110842294&pi=t.ma~as.9132342665&w=1200&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000456966&bpp=1&bdt=347&idt=218&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C390x280&nras=1&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=200&ady=1249&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=cDteD3SWTd&p=https%3A//oneclickroot.com&dtd=221

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 06 Jun 2021 16:36:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3039
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F8BE 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88288d364a5bec9987d23ac293b209b8d6fa22e4b7e7b19cce0c2fb417cf1bca

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame C79A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

39ms
39ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUkWURMqxgeTR3iZNgBQaYPeVtkWzGhQlCPQNIgxrBcQLcZR6gvSy4tS2EltgNo; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 06 Jun 2021 17:27:38 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 06-Jun-2021 18:27:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 06 Jun 2021 17:27:38 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 06 Jun 2021 17:27:38 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame CD84 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 06:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 211237
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 06:47:00 GMT

GET
H3-29 200 1379527439338155373
tpc.googlesyndication.com/simgad/ Frame B280 16 KB
16 KB 7ms
7ms Image
image/gif 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1379527439338155373

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

805cee749fd051beef0370ca9cc62ed038d755537d9869636d40f809aa6caa0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 22:52:58 GMT
x-content-type-options: nosniff
age: 153280
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15943
x-xss-protection: 0
last-modified: Mon, 31 May 2021 14:42:30 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 04 Jun 2022 22:52:58 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/ Frame B280 17 KB
7 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/abg_lite_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9de83c923a234e8b164d2351ed47b456ec3417785b5fc33b4827f071f51f05f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7001
x-xss-protection: 0
server: cafe
etag: 17954294202796946299
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:27:17 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame B280 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:24:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 211
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:24:07 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B280 122 KB
37 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1622806011323838"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37960
x-xss-protection: 0
expires: Sun, 06 Jun 2021 17:27:38 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame B280 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27466895d3e9250f3d0ae0e726f72b8a5c23e2aa83f9caaaf99dcb9f18fcac4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 414
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5635
x-xss-protection: 0
server: cafe
etag: 1091097466425408374
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 17:20:44 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame B280 0
0 15ms
14ms Image
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSxlPJUTj42Bfl16H6fTIYH83muCdLzkE4oOJc_mwsMnJ1cPOwvnQNT8od0Qq9_GEmxUE8ASG9OR_7lAQatN1X1v5sJEQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/ Frame B280 25 KB
10 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210601/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d8c60d643e58946baee86cbad5d665082f2acbb595f5dbc337f2a9d3f5fe39e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 07:17:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36619
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10533
x-xss-protection: 0
server: cafe
etag: 2880717265082513417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 20 Jun 2021 07:17:19 GMT

GET
H/1.1 200
OK ai.aspx Show response
m.exactag.com/ Frame B280 43 B
1 KB 55ms
18ms Fetch
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL

https://m.exactag.com/ai.aspx?extProvId=5&extPu=14058-gaw&extLi=13322141478&extCr=120326006302-525036040727&cb=2897832406

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: So, 06 Jun 2021 05:27:38 GMT
Server: Microsoft-IIS/8.5
Date: Sun, 06 Jun 2021 17:27:37 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1053
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3-29 200 adview
googleads.g.doubleclick.net/pagead/ Frame B280 0
0 18ms
17ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CSd7MiQW9YObsFci7iQa7goPACZPc_YZjvqi5xuQN2dkeEAEgv7uqPmCVAqABqPmSzAPIAQOpAqWM0SGoabQ-qAMByAPJBKoE3wFP0OEgd8_fV2g2VBft9T1muN1j4JzAPpbL4q07yA0bAiEy2y7zXxavQZKpBtgsVhEx8f4erzsgD7U3eToI1ptlZDk4p7Yl7c-qSp_VgYrO-pBWQxOMrP5UJhYlty73ALA6WB6YfII6o9jaOcfgdKhYTN2th6O_ww2b7aVG6-4L789-cE1XgOEIWaeZ5feQLrx6biIxtH7k4XEVyculjFzRl4O4naE3UryeKcqA8Q5HA73NEVdK-dJE1WOveE9IPkxOdTNB9lG4yXYMmSxgMAyWNCgPtzeawCSns6BvMLYlwASezPSfwAOSBQQIBBgBkgUECAUYBKAGA4AHwIbtM6gHipyxAqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB-zVG9gHAfIHBBDBuAHSCAkIgOGAEBABGB-ACgHICwHYEwLQFQGAFwGyFxoKGAgAEhRwdWItMjY4MzcwOTYxMTEzMjM5NQ&sigh=oE0rbAbLNLg

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 06 Jun 2021 17:27:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-29 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2990 143 B
163 B 8ms
6ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUltZP39JZfI2ffyHX2Jl2sNKjVm8luWKDGPBbRQXLpndhfrSW0q3MQmeL9VIIQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 06 Jun 2021 16:36:58 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 3040
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8B12 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 06 Jun 2021 03:04:19 GMT
expires: Mon, 07 Jun 2021 03:04:19 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 51799
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame B280 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99df9a89116a9ceb03dcb762de240a9eaea499bbc8375be88aa75f6acdc0fb93

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 8B12 35 B
464 B 28ms
11ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESED3yqqj_5gi8Qy3kTBBpsGM&google_cver=1&google_push=AYg5qPL8vLzEJh1Dephf_WJYtO0EkbHie1QfTMZaUSvKDSEBG-MbJDu3boR0EF9p1K1-zo9V8S6UwOqv5yz4k0Z2UhcfQc-9tr_9

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8B12
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKZxc0bTo7WCGsRru5LeVXoxgj_Z12SnOVQZFs...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUwwRmlnQUFCYVZaTXgyZg&google_push=AYg5qPKZxc0bTo7WCGsRru5LeVXoxgj_Z12SnOVQZFsCXbLOH3eG1oAJG7VbVVLC3apzBk9YCUGtGKyzU0tJp3TDfdfkgSnZCpiA

170 B
188 B

20ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUwwRmlnQUFCYVZaTXgyZg&google_push=AYg5qPKZxc0bTo7WCGsRru5LeVXoxgj_Z12SnOVQZFsCXbLOH3eG1oAJG7VbVVLC3apzBk9YCUGtGKyzU0tJp3TDfdfkgSnZCpiA

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUwwRmlnQUFCYVZaTXgyZg&google_push=AYg5qPKZxc0bTo7WCGsRru5LeVXoxgj_Z12SnOVQZFsCXbLOH3eG1oAJG7VbVVLC3apzBk9YCUGtGKyzU0tJp3TDfdfkgSnZCpiA
Date: Sun, 06 Jun 2021 17:27:38 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8B12
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESECqbQqNkHQLZryx048MfREc&google_cver=1&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI
https://rtb.openx.net/sync/dds?google_gid=CAESECqbQqNkHQLZryx048MfREc&google_cver=1&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI&google_hm=MWcujeF6xrkbYfCOzKiyAA==

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI&google_hm=MWcujeF6xrkbYfCOzKiyAA==

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:37 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIx0Ads0WYGB4FEQAmKSYg2XDOsLAwM4xSRm95kPm63NVqKnKeyWFofCwK219qqCTK9ooGMcozxt8PMc87iqSX6aCMO9RiI&google_hm=MWcujeF6xrkbYfCOzKiyAA==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 070fg897ksjhoaoa6ahtf2n775hqtm4j

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8B12
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=VE1r86OrRhWZtxUYIgQTeA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=VE1r86OrRhWZtxUYIgQTeA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKHt6oHccxnIMk7d6d1Y8R60RykxqVc3NKaxeeldFV3vADWj0QT-V9ZcxdmUwHtTX3iyVGJPT-VTPYP3PdyFAGkez8UC6US

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=VE1r86OrRhWZtxUYIgQTeA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKHt6oHccxnIMk7d6d1Y8R60RykxqVc3NKaxeeldFV3vADWj0QT-V9ZcxdmUwHtTX3iyVGJPT-VTPYP3PdyFAGkez8UC6US
date: Sun, 06 Jun 2021 17:27:37 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 8B12
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOqPlyDEzevUmL8V95PmdtU&google_cver=1&google_push=AYg5qPJiPokc2IGk6V3lJrPH7HVK6iLcZxflg68BSFY8bVqsgv2Am9qrXRB0NnQDYEvSPisBZqQ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BMR0tHRFMtMU8tMzBOMg==&google_push=AYg5qPJiPokc2IGk6V3lJrPH7HVK6iLcZxflg68BSFY8bVqsgv2Am9qrXRB0NnQDYEvSPisBZqQojEsjNvWEiJlECRvk52TkqYg

170 B
188 B

33ms
16ms

Image
image/png

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BMR0tHRFMtMU8tMzBOMg==&google_push=AYg5qPJiPokc2IGk6V3lJrPH7HVK6iLcZxflg68BSFY8bVqsgv2Am9qrXRB0NnQDYEvSPisBZqQojEsjNvWEiJlECRvk52TkqYg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1BMR0tHRFMtMU8tMzBOMg==&google_push=AYg5qPJiPokc2IGk6V3lJrPH7HVK6iLcZxflg68BSFY8bVqsgv2Am9qrXRB0NnQDYEvSPisBZqQojEsjNvWEiJlECRvk52TkqYg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 8B12
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8Et...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 8B12 43 B
297 B 71ms
21ms Image
image/gif 2a05:d01c:1d8:8100:61f8:e3:2497:5dcb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEIU9F85KeVDkqN849LsO9MA&google_cver=1&google_push=AYg5qPKCBgeup7BAEnS-RBs80EUZH_65MijXM5XuCIZ_3rl3kMRUymdHC-m81NOkAeqfu4mDHulHDX_AkXFtA372wuvfUtCOftkD
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2683709611132395&output=html&h=100&adk=4033216255&adf=3820668265&pi=t.aa~a.1083519250~rp.4&w=390&fwrn=4&fwrnh=100&lmt=1623000457&rafmt=1&to=qs&pwprc=6405913364&psa=0&format=390x100&url=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..&dt=1623000457301&bpp=1&bdt=682&idt=1&shv=r20210601&cbv=%2Fr20190131&ptt=9&saldr=aa&abxe=1&cookie=ID%3D49d74e1a9d520cb3-22937dfbc2c8001c%3AT%3D1623000457%3ART%3D1623000457%3AS%3DALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg&prev_fmts=0x0%2C390x280%2C1200x280&nras=2&correlator=846926675092&frm=20&pv=1&ga_vid=747202333.1623000457&ga_sid=1623000457&ga_hid=1432235498&ga_fc=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1010&ady=1214&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31060973&oid=3&pvsid=1612525110577805&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=jPfmdRcURc&p=https%3A//oneclickroot.com&dtd=11
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:61f8:e3:2497:5dcb London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 1
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 8B12 0
236 B 44ms
14ms Image
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IXWqjdn1SBGz7f3Rqvhz_x3wWAvAvn-LnosF4jMhW-qzdL5E2490TxyVfR3X0-gfRVz7yK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 34ms
19ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210601&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aad5e122fd899c43270bc4942ae898712dff1ab260338ece62a8be7109f5ee9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7689
x-xss-protection: 0

GET
H3-29 200 page.php Show response
www.facebook.com/plugins/ Frame 1BA6 102 KB
27 KB 97ms
96ms Document
text/html 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=da384a375b512ca5b1fe1568bea45a54&ua=modern_es6

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

487566e4584e4dd12f82141e80ee98ee63266508e96fad842225b656f1bf73ed

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

vary: Accept-Encoding
content-encoding: br
x-fb-rlafr: 0
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
content-type: text/html; charset="utf-8"
x-fb-debug: lCd/HyI7dsQRqBQ7rtb/npyWlRSV/CIixZgDb+3sndELXBgTcbxpI9MqSYO+AyQOPD/f/hsIVtCNNVO0Vtg1bg==
date: Sun, 06 Jun 2021 17:27:38 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET
H3-29

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2990
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

40ms
39ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: DSID=NO_DATA; IDE=AHWqTUltZP39JZfI2ffyHX2Jl2sNKjVm8luWKDGPBbRQXLpndhfrSW0q3MQmeL9VIIQ
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 06 Jun 2021 17:27:38 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sun, 06-Jun-2021 18:27:38 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 06 Jun 2021 17:27:38 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 06 Jun 2021 17:27:38 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame E5F7 14 KB
6 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 06:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 211238
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 06:47:00 GMT

GET
H3-29 200 collect
www.google-analytics.com/ 35 B
55 B 7ms
7ms Image
image/gif 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j90&a=1432235498&t=timing&_s=2&dl=https%3A%2F%2Foneclickroot.com%2Fdownload-apk%2F&ul=en-us&de=UTF-8&dt=Nothing%20found%20for%20Download%20Apk&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=2662&pdt=46&dns=0&rrt=414&srt=669&tcp=0&dit=1391&clt=1412&_gst=1387&_gbt=1523&_cst=1388&_cbt=1541&_u=aGDACAABBAAAAG~&jid=&gjid=&cid=747202333.1623000457&tid=UA-38268321-1&_gid=209733095.1623000457&z=1397022002

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 15:46:11 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 6087
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Sun, 06 Jun 2021 17:27:38 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 1E15 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Sun, 06 Jun 2021 17:19:14 GMT
expires: Mon, 06 Jun 2022 17:19:14 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 504
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2C71 783 B
530 B 16ms
15ms Document
text/html 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4071fe59d9cf1a379fd3b5689d070be17a25a5c06f1dc3544465d097afe7758b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ecM783x0S1MgpNboskoTng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://oneclickroot.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=216=VPLeZpaC6eLwZisgcfxiuBDzcCP1Fb0XxQmRIne97M4T7kfMNdnZEwUp2ROMX6xVAbhSvXHun0rorM1SbgUtrDQq6HL_huT8nM9eLZPr8YS5gnvK7BL1hhiCU3uFmPlw3mlwZPoAIb0ROm5zMev2CJCdyUqVu6h9KQL7R-seOm0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://oneclickroot.com/

Response headers

expires: Sun, 06 Jun 2021 17:27:38 GMT
date: Sun, 06 Jun 2021 17:27:38 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-ecM783x0S1MgpNboskoTng' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bRJGAYq4f6_.css
static.xx.fbcdn.net/rsrc.php/v3/yj/l/0,cross/ Frame 1BA6 557 B
660 B 42ms
14ms Stylesheet
text/css 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yj/l/0,cross/bRJGAYq4f6_.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5e3890c1f6ed706d18fe8cfa64afef4c442f70f33d587695435a4be58ed67276

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: mzd0sq2K6ErxK5EXALl4jQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 222
x-fb-rlafr: 0
x-fb-debug: 2e3pyPPLeBt9D2fouCkmNJMY39R1stV1eVgNCEZHEB0ddkMFh5KeFrd7fEaFon2Nq2qB38JrOV+7MtiDAkxe3A==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sun, 05 Jun 2022 17:40:46 GMT

GET
H2 200 -eO4i9E-rQN.css
static.xx.fbcdn.net/rsrc.php/v3/yh/l/0,cross/ Frame 1BA6 19 KB
5 KB 42ms
14ms Stylesheet
text/css 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yh/l/0,cross/-eO4i9E-rQN.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e5f062bffe79aac620d5fd83f54cf20ce47cd7ced1800d87699b9991fcd9a8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: YAdm1WHG7zX/96f11tu2qQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4889
x-fb-rlafr: 0
x-fb-debug: jnCQer085HHRnjUlefLIkCu/KWydLo+gnKnIIG/lKOwfAw1ScAjYFcHiuzRQl+ZtqNUdWrMwEfSzCnziQoKQEw==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sun, 05 Jun 2022 17:40:46 GMT

GET
H2 200 5Fsnp3irenq.css
static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/ Frame 1BA6 2 KB
1007 B 42ms
15ms Stylesheet
text/css 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/5Fsnp3irenq.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ec98f88129d5c3180c878d70ae27ffcdf7907737e4d2e82ec41b6f81fe1cd8ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: J9gtDCcpBAeYh1TcXJ9kqQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 816
x-fb-rlafr: 0
x-fb-debug: B+4pCqlUSaIc7R16IKIPj2abyu4NN1TAX2iRy32zJBwlPQTvPJV8ldHYy9IdkIDzoSj9XiM2mqBmh0CHKMP59w==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Fri, 27 May 2022 16:15:14 GMT

GET
H2 200 UG5hFH3OnGZ.css
static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/ Frame 1BA6 36 KB
7 KB 42ms
15ms Stylesheet
text/css 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/UG5hFH3OnGZ.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

83617fdf42c2457abd24c043606c8ad4bacfd7fe6fce42dfa5d16f4fbec523dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: EdrE11NR23Bfi5e1q30Fuw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 7078
x-fb-rlafr: 0
x-fb-debug: EVRUVmBgMZD6uMUhSaFrheJ3TbGP4bT4OFsVZVg0ISsXbIMsXKc2KX+qCDYtwvjJ4W4Te2ht8acqraPeA9uZLA==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 04 Jun 2022 18:04:08 GMT

GET
H2 200 ifuvhx604ax.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y1/r/ Frame 1BA6 293 KB
80 KB 43ms
15ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/ifuvhx604ax.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

396dbd7121c396fdab19e3660282b6835b19c3d8dccd84bee367d8985e44f93c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: GvrQleRRZYTsEF1YYRqTqQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 81411
x-fb-rlafr: 0
x-fb-debug: YZSeYJ2IbiXps14qnTCdRdjNrna9+PoyQlDX0eyNAtLfPOmWWy/5s3jEIKDQyMH55CuGGV4WLcZNAqiM99Ok4g==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 04 Jun 2022 20:20:29 GMT

GET
H2 200 LDIDWlUlAG9.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yd/r/ Frame 1BA6 65 KB
20 KB 43ms
16ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/LDIDWlUlAG9.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

56766cebd19e526d59965412d4744818753abe2b9030407f0580eeaf029fff33

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: zCLO5QjrkLcH6FDlzNjdyg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 20222
x-fb-rlafr: 0
x-fb-debug: +hXSuBC1q4BWTFS5TxXnZThSWmm2TUxIDqsP/G4Fzh2BtfgZcWt4ESbxhacRwnn7/S6EXn7yGCuf5GkDCjQJlw==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 04 Jun 2022 19:04:06 GMT

GET
H2 200 0Z7xVUWszo1.js Show response
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yk/l/en_US/ Frame 1BA6 126 KB
35 KB 42ms
15ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yk/l/en_US/0Z7xVUWszo1.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

92ce8008dfa52e912fea1f1700570804a13891cfbc24c71cc3a2e51244ff6d78

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: MLif0GUUZX/p4PbReI0Ftw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 35908
x-fb-rlafr: 0
x-fb-debug: W6415Ik08h5kxTAwXAZneEnMJyHGmZcBjebCjO8O6exUh6PAbvFofEIaAi3LItFCgzAC2gxBoQl/5fgyKa4ujA==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 04 Jun 2022 07:15:56 GMT

GET
H2 200 aVoL5z69Opq.js Show response
static.xx.fbcdn.net/rsrc.php/v3iLl54/yD/l/en_US/ Frame 1BA6 15 KB
5 KB 69ms
42ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iLl54/yD/l/en_US/aVoL5z69Opq.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

107dedf2466d7c482f36f2b4cd22b1cc9b54904b2aaa9f0dac91be3cdb5b162e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: HSJTIQ7R8l61TUXAOctZfQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4989
x-fb-rlafr: 0
x-fb-debug: z/BJVhGyW66sH4KXz/z/Q4EPky8hdv+TOxsmE6E3LGuVZ2CRot5QSzz+GGBQERCENZsWnexZAbJv4DkwzBA9eA==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 02 Jun 2022 19:31:32 GMT

GET
H2 200 ykbSkxJ8VJE.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yA/r/ Frame 1BA6 9 KB
3 KB 43ms
16ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yA/r/ykbSkxJ8VJE.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6b64f5bc28886025d0249793131aab1cf4a02c6b799543e2a74bc8047ead1b41

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 8u6hsl3sOAhh3qFnVy4qyw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3219
x-fb-rlafr: 0
x-fb-debug: wfzn7+fAsqNoi9R5pYbeZQBwbnXoPBfN316UJVB5N5Lb5sffZr+hQOa6T6E6BwNT/fel1DQ63oV9fl8osbfiZw==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 02 Jun 2022 18:16:26 GMT

GET
H2 200 vVNHHjOWB6t.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yk/r/ Frame 1BA6 153 KB
45 KB 42ms
16ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yk/r/vVNHHjOWB6t.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

407844bdddf476cc18f80188a3fb73350b6046fd1eaf47a0b9f7d72bacd2b9e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: Q8sL51xZKYYpd7c+Kk0iYg==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 46173
x-fb-rlafr: 0
x-fb-debug: RistkDuH4CP+iIZf3jMVKeDiYxyAm3MJPPf1ZfAgNDZxHhrRyo1acRnmiEieIHMuZiQ+vFlGt6FJz9POm1zkrQ==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 04 Jun 2022 02:49:16 GMT

GET
H2 200 IEOQM8FL8ot.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yr/r/ Frame 1BA6 5 KB
2 KB 43ms
16ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yr/r/IEOQM8FL8ot.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

908edfa9f7ec9fd5cb6b2159b5cb305d9c2c88601c8bf00a23bb0e96fcea1e21

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: mrvV7Xg6Liq29ANLrbPdkw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1630
x-fb-rlafr: 0
x-fb-debug: IYAEW4fsQsht0l1yV8pi/GTQMf3Y9ij4tDCx0PArrNjgWhPGbhPtwxCAW+De2vgCNLMd71GnGmXa0a/uYCEkvw==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 03 Jun 2022 20:46:47 GMT

GET
H2 200 IcaTm-jFAR8.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yP/r/ Frame 1BA6 7 KB
2 KB 69ms
42ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yP/r/IcaTm-jFAR8.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6b26263e492d4334076354b0db27917b73fdf99ca6f24ecb267ddca57a40138b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: XfPy4s+vkyIdTYCGlL45zw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2240
x-fb-rlafr: 0
x-fb-debug: f5TI9YkI3yMRJvpJQ9P7Z+pjiuOiV1el/uaQxMQ8j/QBIM1Pc3+cPQlYXor+Tt1ovgf0KeNHCLEOytmgZMN7oA==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 04 Jun 2022 18:42:05 GMT

GET
H2 200 bsryAwrhWve.js Show response
static.xx.fbcdn.net/rsrc.php/v3ig8t4/yZ/l/en_US/ Frame 1BA6 422 KB
101 KB 69ms
43ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3ig8t4/yZ/l/en_US/bsryAwrhWve.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7b38f96f67bd52a3246d0ff5fa5f5278b45451be77e8dd1e4b94b4e6135f2018

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: mv+m+3vkxCgU2brIDLJEsQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 102911
x-fb-rlafr: 0
x-fb-debug: a49oWqEA/hJnns/envGNH+hGpiu9VxqL4mkojQwD3xLXnE1G8Z1I4bPDp7ovE84MHwoGc2ULPNdH0hdlzU6jwg==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Thu, 02 Jun 2022 19:31:32 GMT

GET
H2 200 LRo67jlaRgY.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yl/r/ Frame 1BA6 18 KB
6 KB 69ms
43ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/LRo67jlaRgY.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

47b5e303447c7681ce1b2242f23699f94c0709da3aa5016ec1c8f6d7efcad1c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: /49V/V76X87agOuBQG4NzA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 6073
x-fb-rlafr: 0
x-fb-debug: vr+p2xnDr+wuZBlgYdelt7h4rjz9BlhcTS6owpMOflfN9rYyVbh8Mtyu6c5S/BxnbU4cPgzHpZKJsotzuWB7vA==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 02 Jun 2022 18:22:26 GMT

GET
H2 200 d__2zwz9HAa.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yo/r/ Frame 1BA6 100 KB
28 KB 70ms
44ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/d__2zwz9HAa.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

14d050ca7cd307f53e86dfa07664029c4554d13997a250625e59251edaee3618

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: rzgGV/sULh4bwV2HO4iWhw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 28014
x-fb-rlafr: 0
x-fb-debug: kjDklRVuOT6MvXDZ/SNkSo6dnhi7sgpomQnrlOKw/viQ9vMv6U3p/X07iLJSLHII2jnaIADEN7brKyimHEqpNg==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 04 Jun 2022 19:38:46 GMT

GET
H2 200 wUWY9b9jtGx.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yc/r/ Frame 1BA6 360 KB
81 KB 69ms
44ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yc/r/wUWY9b9jtGx.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e40a747b443b046d9071a67d800f2eed2b62bb1d2242714fed831ad73eeca1fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: mBHB1EpAYEqDGE8Lq3ax1w==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 82386
x-fb-rlafr: 0
x-fb-debug: eTwxUJRnTLfoeZAGzLvBI+f+oqhQ32L6rxfMWIb4P+9bXIB08csQnBlUQNQIG6cGXY+vtW1ZfJydtH61TG6h8A==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Sat, 04 Jun 2022 21:30:44 GMT

GET
H2 200 n2R9YVn6Y87.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yS/r/ Frame 1BA6 4 KB
2 KB 68ms
43ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yS/r/n2R9YVn6Y87.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

0f783a947b0e1f22b2f0460631e207543de7e70a3652a21d1756debbc982313e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 5h28vz/IL0qDPe2C9eTxEw==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: D+U8yPp7xVzVOuB91oUFTiB8bl/jSGpdl3ENfOw0xcEQHrZWr7tTUC6NuXxr3qRc3o8p2WE/zy1RWo5Bt/Ft0A==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Fri, 03 Jun 2022 19:11:47 GMT

GET
H2 200 Uf-73aw922e.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yl/r/ Frame 1BA6 15 KB
6 KB 68ms
43ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/Uf-73aw922e.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4eef62c77a19b7d9fb6f894cfa0e7757e0a3bf2936c1af0d330a9e409914bde0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: O1i5c8VfmwReAn1Xg3t6xQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 5738
x-fb-rlafr: 0
x-fb-debug: Hyg2JBGYJv4UnIeJC+v7SKGBJEKAkNgL9gc32K+ILtxrzB5UWt+pVnOzTCneCJ7NYsYNwq1BZ4FNl6g1xP5nqA==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Fri, 03 Jun 2022 20:46:48 GMT

GET
H2 200 JNHW1aQLTTB.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yf/r/ Frame 1BA6 2 KB
997 B 69ms
44ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yf/r/JNHW1aQLTTB.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

46d2d8aa76374bad68b27aff870970ca15ff5f1ab3389f2327f21f073ddf521a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: agNC6E6e+E6Zesw/5kQcYA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 806
x-fb-rlafr: 0
x-fb-debug: rsJOQ5SsOvkd6tEiSop6FckbEGsn54tp30M8+GDkGXKOOTKznDLntrrfKr0Q8px4lZgnuE96YcWsro7xvMuDVg==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Tue, 24 May 2022 20:17:14 GMT

GET
H2 200 iArlHGPYN4y.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yC/r/ Frame 1BA6 9 KB
3 KB 69ms
44ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yC/r/iArlHGPYN4y.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8857d647f96ba04fd5a24e7a547aad036614a57dfa575d850f3fd6fe2694b35f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: 7FbtrFYBPw0+87XsuihnRA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 2516
x-fb-rlafr: 0
x-fb-debug: +M4KGqnu6xfgq4iyCH37apB3pe2CS1E4OVq3UJcG7LVAZafAZ9u1PHaURJXjMtzQGp9Lis7+HSV2ybOoxp9YjQ==
x-fb-trip-id: 1709462857
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Thu, 02 Jun 2022 19:32:29 GMT

GET
H2 200 10619956_847528195327118_5986271127010369165_o.jpg
scontent-frt3-2.xx.fbcdn.net/v/t31.18172-0/s403x403/ Frame 1BA6 12 KB
12 KB 20ms
6ms Image
image/jpeg 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frt3-2.xx.fbcdn.net/v/t31.18172-0/s403x403/10619956_847528195327118_5986271127010369165_o.jpg?_nc_cat=101&ccb=1-3&_nc_sid=dd9801&_nc_ohc=O6XGm2N49WIAX80E2A_&_nc_ht=scontent-frt3-2.xx&tp=7&oh=41f7e27f8dee6e446b8f0e4c9ed14eb0&oe=60E12A52
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: da9668f07b02b6a76bf8927b107bba9c1f88ac5fbf1b0d169d71fb7185b49efb

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 2726574634
date: Sun, 06 Jun 2021 17:27:38 GMT
x-fb-trip-id: 686109401
last-modified: Thu, 18 Jun 2015 01:35:43 GMT
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 3230104762
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 12150

GET
H2 200 10955377_803038153109456_4126918969640052151_n.png
scontent-frt3-1.xx.fbcdn.net/v/t1.18169-1/cp0/p50x50/ Frame 1BA6 3 KB
4 KB 20ms
7ms Image
image/png 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-frt3-1.xx.fbcdn.net/v/t1.18169-1/cp0/p50x50/10955377_803038153109456_4126918969640052151_n.png?_nc_cat=106&ccb=1-3&_nc_sid=dbb9e7&_nc_ohc=gCQRdwfkRm4AX_huLXj&_nc_ht=scontent-frt3-1.xx&tp=30&oh=8591f04f95ce4a337a3f285cc653e972&oe=60E16B9A
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 327473e2609faa37d9701987efff7916d84210c08b3850df3a2854890c30be61

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-haystack-needlechecksum: 1144118088
date: Sun, 06 Jun 2021 17:27:38 GMT
x-fb-trip-id: 686109401
last-modified: Wed, 18 Mar 2015 18:59:44 GMT
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: X-FB-CEC-Video-Limit
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 3927778795
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 3277

GET
H3-29 200 Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js Show response
pagead2.googlesyndication.com/bg/ Frame 1E15 14 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Jl_KA3DWLl1pqAl7nrDeic27IkrJD7_aVFtTlraQVeY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 04 Jun 2021 06:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 211238
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5751
x-xss-protection: 0
last-modified: Mon, 31 May 2021 08:58:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 04 Jun 2022 06:47:00 GMT

GET
H3-29 200 9m0FMHEePT2.png
static.xx.fbcdn.net/rsrc.php/v3/yI/r/ Frame 1BA6 1007 B
1 KB 28ms
13ms Image
image/png 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yI/r/9m0FMHEePT2.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yj/l/0,cross/bRJGAYq4f6_.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1ede2fd4fdf2fc99e6266bb689cac2ffcab0cd5aa78fac1b7f7e4d1414a570a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yj/l/0,cross/bRJGAYq4f6_.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: IBsRT/3pchZyKx7i+htTXjlf5WHZj1WEINUYF2ylo5WShpC+wgeVWoYQw0rm5XGJBAvhZR1B8snkMCeqdtnV4g==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: lUfSU9jeH8NAxUQP8fo8MA==
date: Sun, 06 Jun 2021 17:27:38 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1007
x-fb-rlafr: 0
expires: Sun, 05 Jun 2022 17:40:47 GMT

GET
H3-29 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame 1BA6 76 KB
18 KB 203ms
203ms XHR
application/x-javascript 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22442973669095021%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F%22%2C%22width%22%3A390%2C%22height%22%3A370%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Atrue%2C%22referer_uri%22%3A%22https%3A%2F%2Foneclickroot.com%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__dyn=7xeUmxa13xu1syUbAihwLBwqo98nwgU5Gex-ewSwMwNw8OdwJwvHwdK4o4O0C82Vwb-q1ewcG0KEswaq1xwEwlU-0nSUS1vwqUcE7e2l2Utw6awZwaOfxW0D83mwkE5G0zE5W0HU1jo6iazo&__csr=&__req=1&__hs=18784.PHASED%3Aplugin_default_pkg.2.0.0.0&dpr=1&__ccg=UNKNOWN&__rev=1003914979&__s=%3A%3A3w11zi&__hsi=6970733889216591854&__comet_req=0&locale=en_US&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yk/l/en_US/0Z7xVUWszo1.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8de728c4959491b9ada3bdb7017996f4ebf4ff4dd643e485f86818a72bc2efad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: Ak542QkJTfnBUkVbqgOj0U
Referer: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: e0/M+1D4fxfp6A7saMIVcwszRck+Yx2+ZeMHfxRQJ0tMyXZ4SHeRJ1t4XG7ea+XEN9zil3UkSRzrBNrixRuOGw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 06 Jun 2021 17:27:38 GMT
x-frame-options: DENY
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H3-29 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame 1BA6 1 KB
758 B 34ms
34ms XHR
application/x-javascript 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yk/l/en_US/0Z7xVUWszo1.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

06022a4eb34627bc5c4ded7e5d7f631b3772262d77cd0af8979f6d6e94a9009f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: Ak542QkJTfnBUkVbqgOj0U
Referer: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: SKPpyldNgnlbpVYwTJHEZUBXXbd3T6U6uNgw4Vo9635DcY6iePekr7FhNKphJDCJGg2F+LZQtckkJTlXicP0zA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 06 Jun 2021 17:27:38 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
access-control-expose-headers: X-FB-Debug, X-Loader-Length

POST
H3-29 200 / Show response
www.facebook.com/pages/call_to_action/fetch_dialog_data/ Frame 1BA6 1 KB
755 B 36ms
36ms XHR
application/x-javascript 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/pages/call_to_action/fetch_dialog_data/?id=796975540382384&surface=pagePlugin&unit_type=VIEWER

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yk/l/en_US/0Z7xVUWszo1.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2cc6ae8ad154e087370262d60ebfb9747f2ff1a84f52605856b0dc805c44dfcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-FB-LSD: Ak542QkJTfnBUkVbqgOj0U
Referer: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
x-content-type-options: nosniff
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: jSs3POSz/W3n1eN/zB1sLbkjScG3Rko9eBaNiRFelCzh/i5glnetv6be2VU2wn+RUv/DWlMGPVhOekdMGCsu8g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 06 Jun 2021 17:27:38 GMT
x-frame-options: DENY
access-control-allow-methods: OPTIONS
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
vary: Origin, Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
access-control-expose-headers: X-FB-Debug, X-Loader-Length

GET
H3-29 200 G0USI1RlV_o.js Show response
static.xx.fbcdn.net/rsrc.php/v3/y-/r/ Frame 1BA6 276 KB
58 KB 14ms
13ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y-/r/G0USI1RlV_o.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/ifuvhx604ax.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6afd8ef9240c2210f0619be79e30ab60c0f1053b1ff119d71e34cce7f66d263a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: oyiTkkMbn1Nqdhf7WypqcQ==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 58994
x-fb-rlafr: 0
x-fb-debug: n0CHdysa9UGzLPML6cau4Kv3wBdQu5uWsfLXTHFUbsN9skbbJ6Rb/bH5k320U5u/MXFqkpBhoODPEtvjZgxzoA==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Sat, 04 Jun 2022 21:30:44 GMT

GET
H3-29 200 cAEvN19HjM2.js Show response
static.xx.fbcdn.net/rsrc.php/v3/yB/r/ Frame 1BA6 885 B
431 B 15ms
15ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yB/r/cAEvN19HjM2.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/ifuvhx604ax.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e913d0c8195023fea768aa63161cfe870b077cd360806e3905002e74acc7423e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: lRXvpxxdUT7QUnYyGQ+l6g==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 378
x-fb-rlafr: 0
x-fb-debug: BltZmT6uTfII7EUL3wAny9hi0+E4bS6e80FCNfo4IzB6X6rVWEU1ND7PjtpC5TtlsS+7u5ZBm4giX8F91gLgPw==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Wed, 01 Jun 2022 06:25:43 GMT

GET
H3-29 200 nuSZvOPs-lg.png
static.xx.fbcdn.net/rsrc.php/v3/yv/r/ Frame 1BA6 12 KB
12 KB 14ms
14ms Image
image/png 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/nuSZvOPs-lg.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/UG5hFH3OnGZ.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e51e7c1f2f3bd86cc3e9dcd1ad5403db927f32533f0a8b29bc15f11b40c6376

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yw/l/0,cross/UG5hFH3OnGZ.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: aTGeLnQ1hVrQccHM7hRHxJj4kQqa9sHQgo0BGJg3kvFT2fJZdPA/CjFFGlFqImsW9ErI00y+qVyxX0Wh69nZ0Q==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: +tH9SoPO1ugg3HR9LK4liQ==
date: Sun, 06 Jun 2021 17:27:38 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
priority: u=3,i
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 11870
x-fb-rlafr: 0
expires: Fri, 03 Jun 2022 23:31:13 GMT

GET
H3-29 200 onuUJj0tCqE.png
static.xx.fbcdn.net/rsrc.php/v3/y2/r/ Frame 1BA6 4 KB
4 KB 14ms
14ms Image
image/png 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/onuUJj0tCqE.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yh/l/0,cross/-eO4i9E-rQN.css?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5f71fcc2d00d22ffd4d9a07b64c435f88de80893f838fa64a45c386cbba0c601

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.xx.fbcdn.net/rsrc.php/v3/yh/l/0,cross/-eO4i9E-rQN.css?_nc_x=Ij3Wp8lg5Kz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug: 619SFaJQg3q8XKi/oTh+j32fynZAUhjBSUJDS4rS1lk3tvgJ7l7pRgJAOSmhNRqvupZPHeTDhc0f52D7ZeqXqA==
x-content-type-options: nosniff
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
content-md5: OK0dmVpVmdoMRpKMP9eDcg==
date: Sun, 06 Jun 2021 17:27:38 GMT
content-type: image/png
access-control-allow-origin: *
cache-control: public,max-age=31536000,immutable
cross-origin-resource-policy: cross-origin
content-length: 3944
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
x-fb-rlafr: 0
expires: Sat, 04 Jun 2022 22:04:32 GMT

GET
H3-29 200 0PBAeqI9Rhg.js Show response
static.xx.fbcdn.net/rsrc.php/v3iwUw4/yx/l/en_US/ Frame 1BA6 1 MB
234 KB 13ms
13ms Script
application/x-javascript 2a03:2880:f045:10:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3iwUw4/yx/l/en_US/0PBAeqI9Rhg.js?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/ifuvhx604ax.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f045:10:face:b00c:0:3 Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d59912fcad926b847aa253d75a11fb06fcdad5dec272527873b5b9e9083e4e2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.facebook.com
Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 06 Jun 2021 17:27:38 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: rznkvVLICbhTF9wZPoodrA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 239800
x-fb-rlafr: 0
x-fb-debug: i4iaILDeq2zdZ3dOW+yM/wT8fzyUmmO0dZl2b+QW0u2Iyf1O7LIxsv0IjYbZUx5nr6moObeozQ+DWkXnyOsi+g==
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
priority: u=3,i
expires: Thu, 02 Jun 2022 19:38:01 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gda_r20210601&jk=1612525110577805&bg=!u7iluPzNAAY6sG-_OrA7ACkAdvg8WuDDpGtF_ZgOLvPgcq_GXq_76AcJNqrAyxdCqoLeGeIpsK8y3gIAAADLUgAAAApoAQcKAHxXyZAxDGJZCwkvL4-qdrJEIKew9u1en6ONz_Ftv8lijQncn0p1LMU1yOg6Z5RhkHyqyYu6PpJfZTEZ2BS6UU5Uyas_WSzGWy8l_F_IBQMmX4h3SKgA8tPZZ7cU2N6eOPRcNGW0yNsmPXsCkosGi4IXOB2ykchAltF86RyOmQJAbtQZFnt0FFlbKU2htlLlO0ZvUDdQP7okxh4YzV4ANAOzGULB5arMmyVTdY9Nwxn8ZW0O37Vg91L75dVKE8HP67ofSDsYoaV6oX0XPEv4vuHuq8T_JpZMSYqyp8dLydaxwmtCXv5kyRpvCOEUGy44wcOUQ1U9pc37xgnvP8Kzz3Pq3ECHKlMzKmzkoRzOXcpVxUgwDiSB8WjfG9WS4gMby2flKCzZlBybHkcahZzBYhQCNYMCsHe08j7UYYeNMVfznX_y7zs0w0ZINs9MrYhAVqzhHm01vRfn7pCv_BJtIIkwuuTzskGVLFhRR2ycijcdaHOeXHjovezAL-X6EbkZOi_G5m7mGEpYYb8-hRslMznDGaZvpnHYPlJc7usVok-wPk5W0vb_dMmGu_R90W1KTN8txiNxUajpagJjs91AWdQZAcCNhhmTjQeLk-heFdB2PAeFklxd3RC_NWGCIO7_jNylnpk46Y-TNXEKMPeJfqDz037uc4CHKUVFnT7HQwbw6WAxA6IxVbRhC4d6mRvbSkzhgDn2VOSfRXnTWOHOt7jeSwf-hxN9UmvaDHjrJiXvTKHr28GnU8VVac89ffioY2wKJD5w39m373_9hhysD9k49lx5O2WgBzE70bDHO9ghb_ftj0vDRoeoEks9MpbHkjMVGsVHSU4frD4zqls8aJtecFBh5HNog-omNNrjM5MGnpDM8FfEzzuyS-z_lHWSfVbGdtrVzKBweQMdpbAAMobs_WLXTIKCIoNzmb-1mLqC

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://oneclickroot.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET /
www.facebook.com/login/ Frame 1BA6 0
0

GET
H3-29 200 /
www.facebook.com/login/ Frame 1BA6 0
0 99ms
98ms Document
text/html 2a03:2880:f145:82:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D442973669095021%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df374b443a869c4%2526domain%253Doneclickroot.com%2526origin%253Dhttps%25253A%25252F%25252Foneclickroot.com%25252Ff1c65382d85b184%2526relation%253Dparent.parent%26container_width%3D390%26height%3D370%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FOneClickRoot%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dfalse%26small_header%3Dfalse%26tabs%3Dtimeline%26width%3D390

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/ifuvhx604ax.js?_nc_x=Ij3Wp8lg5Kz

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f145:82:face:b00c:0:25de Amsterdam, Netherlands, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com data: blob: 'self';script-src .facebook.com .fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com .facebook.com fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com cdninstagram.com .cdninstagram.com;connect-src .facebook.com facebook.com .fbcdn.net wss://.facebook.com: attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.facebook.com
:scheme: https
:path: /login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D442973669095021%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df374b443a869c4%2526domain%253Doneclickroot.com%2526origin%253Dhttps%25253A%25252F%25252Foneclickroot.com%25252Ff1c65382d85b184%2526relation%253Dparent.parent%26container_width%3D390%26height%3D370%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FOneClickRoot%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dfalse%26small_header%3Dfalse%26tabs%3Dtimeline%26width%3D390
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.facebook.com/plugins/page.php?adapt_container_width=true&app_id=442973669095021&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df374b443a869c4%26domain%3Doneclickroot.com%26origin%3Dhttps%253A%252F%252Foneclickroot.com%252Ff1c65382d85b184%26relation%3Dparent.parent&container_width=390&height=370&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2FOneClickRoot%2F&locale=en_US&sdk=joey&show_facepile=false&small_header=false&tabs=timeline&width=390

Response headers

content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
cache-control: private, no-cache, no-store, must-revalidate
x-frame-options: DENY
content-encoding: br
x-xss-protection: 0
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
vary: Accept-Encoding
pragma: no-cache
x-fb-rlafr: 0
cross-origin-opener-policy: unsafe-none
content-type: text/html; charset="utf-8"
x-fb-debug: 75TBxT8rWa0k+yrTBPs+mCYWlEg/bV09uk2K0WmUrq/dWwLnKM4S1iYT0xWY/gRZR8hO8ZsZ9Ng141VBVKgIGA==
date: Sun, 06 Jun 2021 17:27:38 GMT
priority: u=3,i
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

GET Vi5jBRT7EMU.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ Frame 1BA6 0
0

GET Yd0jc4BZRZz.css
static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/ Frame 1BA6 0
0

GET
DATA 200
OK truncated
/ Frame 1BA6 2 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f25aebef7c5b576071a6f97559078c0a17f5d3130f2cdb8d74f04872ec8fb333

Request headers

Referer: https://www.facebook.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: text/css;charset=utf-8

GET gpiqFbt2EUi.css
static.xx.fbcdn.net/rsrc.php/v3/yn/l/0,cross/ Frame 1BA6 0
0

GET jndVCEjtwZt.css
static.xx.fbcdn.net/rsrc.php/v3/y3/l/0,cross/ Frame 1BA6 0
0

GET 8zxpfB5cm1Q.js
static.xx.fbcdn.net/rsrc.php/v3/yA/r/ Frame 1BA6 0
0

GET NifK3RmDZV7.js
static.xx.fbcdn.net/rsrc.php/v3/yj/r/ Frame 1BA6 0
0

GET QAtzoDVsrCZ.js
static.xx.fbcdn.net/rsrc.php/v3iEBX4/y3/l/en_US/ Frame 1BA6 0
0

GET Ek10ELLuAdl.js
static.xx.fbcdn.net/rsrc.php/v3/yH/r/ Frame 1BA6 0
0

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B927 42 B
64 B 42ms
41ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst4OunDFtk1zADymcpUl4D7fnaFJ1BwaH4a4VzeeyoVjNjvkiS1wvaKAYD54JmkokWLl17Z2xoLwhG5AgaeCnIZA0H-L48Q2t_FWKXdtPZE3nhfVU1APVVNTnMv0A&sai=AMfl-YQS26-37lQz6Y59aVBFu4qScZ11QRXQzJPW-bqau4KnrfB_jew3BwreOqXzdzN7BkidMAUflCFl9oRR&sig=Cg0ArKJSzDYq-rA_qKclEAE&id=lidar2&mcvt=1000&p=130,1010,410,1400&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210604&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=772853018&rs=2&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&eosm=0&rst=1623000457180&dlt=523&rpt=75&isd=0&msd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 06 Jun 2021 17:27:38 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YL0FiqKOdnVjpgWj2DTqOQAABLYAAAIB&google_cver=1&google_push=AYg5qPIntVPYOSSX70ySzUYJfxA_cHw35Ritp1Dqw1z6c6pZh-Tsup8MT0yiCtqLR0cvCtmjI8EtB-M-MjS9vUADc0yDN7-EONj8&google_gid=CAESEJY0v5yC3h5clcdXGZqPoY8

Domain: www.facebook.com
URL: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fadapt_container_width%3Dtrue%26app_id%3D442973669095021%26channel%3Dhttps%253A%252F%252Fstaticxx.facebook.com%252Fx%252Fconnect%252Fxd_arbiter%252F%253Fversion%253D46%2523cb%253Df374b443a869c4%2526domain%253Doneclickroot.com%2526origin%253Dhttps%25253A%25252F%25252Foneclickroot.com%25252Ff1c65382d85b184%2526relation%253Dparent.parent%26container_width%3D390%26height%3D370%26hide_cover%3Dfalse%26href%3Dhttps%253A%252F%252Fwww.facebook.com%252FOneClickRoot%252F%26locale%3Den_US%26sdk%3Djoey%26show_facepile%3Dfalse%26small_header%3Dfalse%26tabs%3Dtimeline%26width%3D390

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/Vi5jBRT7EMU.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y2/l/0,cross/Yd0jc4BZRZz.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yn/l/0,cross/gpiqFbt2EUi.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/y3/l/0,cross/jndVCEjtwZt.css?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yA/r/8zxpfB5cm1Q.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yj/r/NifK3RmDZV7.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3iEBX4/y3/l/en_US/QAtzoDVsrCZ.js?_nc_x=Ij3Wp8lg5Kz

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v3/yH/r/Ek10ELLuAdl.js?_nc_x=Ij3Wp8lg5Kz

Verdicts & Comments Add Verdict or Comment

179 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.oneclickroot.com/	1970-01-20 04:11:36	Name: __gads Value: ID=49d74e1a9d520cb3-22937dfbc2c8001c:T=1623000457:RT=1623000457:S=ALNI_MarHSwurm9D251b03G3Mp9yG7Wzzg
.doubleclick.net/	1970-01-20 04:11:36	Name: IDE Value: AHWqTUltZP39JZfI2ffyHX2Jl2sNKjVm8luWKDGPBbRQXLpndhfrSW0q3MQmeL9VIIQ
.doubleclick.net/	1970-01-19 18:50:04	Name: DSID Value: NO_DATA
.oneclickroot.com/	1970-01-19 18:50:02	Name: _hjFirstSeen Value: 1
oneclickroot.com/	1970-01-20 03:35:36	Name: cookielawinfo-checkbox-necessary Value: yes
.oneclickroot.com/	1970-01-19 18:50:01	Name: _first_pageview Value: 1
.oneclickroot.com/	1970-01-19 18:50:00	Name: _gat Value: 1
.oneclickroot.com/	1970-01-19 18:50:00	Name: _dc_gtm_UA-38268321-1 Value: 1
.oneclickroot.com/	1970-01-20 03:35:36	Name: _hjid Value: 4fde418f-ecef-49b2-8922-1de00a39f597
oneclickroot.com/	1970-01-20 03:35:36	Name: cookielawinfo-checkbox-non-necessary Value: yes
.oneclickroot.com/	1970-01-20 03:35:36	Name: _jsuid Value: 1082188309
.oneclickroot.com/	1970-01-19 18:51:26	Name: _gid Value: GA1.2.209733095.1623000457
.oneclickroot.com/	1970-01-20 12:21:12	Name: _ga Value: GA1.2.747202333.1623000457
.oneclickroot.com/	1970-01-19 18:51:26	Name: _uetsid Value: 7c99f8d0c6ec11eb811aad28f74aa505
.oneclickroot.com/	1970-01-20 04:11:36	Name: _uetvid Value: 7c99d810c6ec11ebb312cfe952178233
.oneclickroot.com/	1970-01-20 03:35:36	Name: mp_eaa4f42e0f646ae8e9cff2003f2510b3_mixpanel Value: %7B%22distinct_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24device_id%22%3A%20%22179e25d9ea3d08-07ecd05dc6c6a1-5771e33-1d4c00-179e25d9ea487d%22%2C%22%24initial_referrer%22%3A%20%22%24direct%22%2C%22%24initial_referring_domain%22%3A%20%22%24direct%22%7D
oneclickroot.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 27a6e276161842e0c88973e1cbff90ec

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://oneclickroot.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2
console-api	log	URL: https://translations.sking.co/dist/bundle.min.js(Line 3) Message: en-US
console-api	log	URL: https://oneclickroot.com/download-apk/(Line 769) Message: current url added
console-api	error	URL: https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/ifuvhx604ax.js?_nc_x=Ij3Wp8lg5Kz(Line 56) Message: ErrorUtils caught an error: Minified invariant #11797; Params: 113 [Caught in: Module "VisibilityListener"] Subsequent non-fatal errors won't be logged; see https://fburl.com/debugjs.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
ag.innovid.com
apis.google.com
bat.bing.com
cdn.jsdelivr.net
cdn.mxpnl.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
image6.pubmatic.com
images.dmca.com
in.getclicky.com
m.exactag.com
oneclickroot.com
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.everesttech.net
pixel.rubiconproject.com
pixel.wp.com
platform.twitter.com
rtb.openx.net
scontent-frt3-1.xx.fbcdn.net
scontent-frt3-2.xx.fbcdn.net
script.hotjar.com
script.tapfiliate.com
static.getclicky.com
static.hotjar.com
static.xx.fbcdn.net
stats.g.doubleclick.net
stats.wp.com
syndication.twitter.com
tpc.googlesyndication.com
track.seadform.net
translations.sking.co
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.oneclickroot.com
cm.g.doubleclick.net
static.xx.fbcdn.net
www.facebook.com
104.244.42.72
142.250.184.226
142.250.185.130
143.204.98.56
151.139.242.29
185.64.189.115
192.0.76.3
198.145.13.14
213.202.235.10
2600:1901:0:bc29::
2606:2800:234:46c:e8b:1e2f:2bd:694
2606:4700:3031::6815:3306
2606:4700:3033::ac43:d826
2606:4700:3034::6815:4303
2606:4700::6810:135e
2606:4700::6810:dd1d
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2620:1ec:c11::200
2a00:1450:4001:802::200a
2a00:1450:4001:809::2003
2a00:1450:4001:809::2004
2a00:1450:4001:80e::2002
2a00:1450:4001:812::2002
2a00:1450:4001:812::200e
2a00:1450:4001:813::2001
2a00:1450:4001:813::2002
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2002
2a00:1450:4001:82a::2008
2a00:1450:4001:830::2002
2a00:1450:4001:831::2003
2a00:1450:4001:831::200e
2a00:1450:400c:c04::9c
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f045:10:face:b00c:0:3
2a03:2880:f145:82:face:b00c:0:25de
2a04:4e42:3::485
2a05:d01c:1d8:8100:61f8:e3:2497:5dcb
34.246.227.69
35.227.252.103
37.157.6.253
52.85.170.33
52.85.170.51
52.85.170.61
69.173.144.138
014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
06022a4eb34627bc5c4ded7e5d7f631b3772262d77cd0af8979f6d6e94a9009f
07bf87548212f24057ba352fed5ec567dab724b44a7fc88ddc393cbc7706d033
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0cd851e5b33af0fbb354df65506da39807b998e07723f3d08aba5179fa2ed97e
0d5f76008f1784b20b99d51741b2f8b8bbee28d5f2950ca2cf4226b6d61b1344
0dbbf2dce996285ba6dc8de4e5e41e045a15b6ae694846c8e116483a9f23aa3b
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0f783a947b0e1f22b2f0460631e207543de7e70a3652a21d1756debbc982313e
107dedf2466d7c482f36f2b4cd22b1cc9b54904b2aaa9f0dac91be3cdb5b162e
132c321fadec37119251f1478f57cb7ca4ab382c3a562aedb65bf710348e871c
14d050ca7cd307f53e86dfa07664029c4554d13997a250625e59251edaee3618
1533a0437bab2af5169ff33ed8f37ebb2791793bb3e7001bbd6452a8db798216
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
187e5ab1d37aaa4779205fddec1d0bd632c73ba09db7590c8f79bc238557932f
18f81b7374f2a878c5b44689e0496e86f27e3f549205eec7ade5b0fca45d1fab
1914089b9ec68a3b941d15a5315684bcb4362329b5ffc2dcf49c667c2964376e
1cbdad4ce844ca96c63fc42506fd55d093cad2ca3d3d56b64b80a173352b3be6
1cf04407e728ea1ebf82dc1c6b45d12632cb3202ff8f4556f380b16e57484f27
1d0187e2c049d77ec849ae06718baa71bfc51ced33c1fa6edf4cd84568a85358
1dad6cb9a0903898a8f82f89c0d10ee6e94f8459228530fa5df3078100c9f650
1dc1c5a0cdd40141f4546b942f742ea206c5bcb0bb19430c1e42096564422fc9
1ede2fd4fdf2fc99e6266bb689cac2ffcab0cd5aa78fac1b7f7e4d1414a570a9
22ba83b4eb02be9f9579bea1374f2572ef3990eb2a3b481d8d075c6c96455824
243e981fb1132fc19094b071ee8d871bf1c2fb7afec270e4e2a65f4bd17d1808
265fca0370d62e5d69a8097b9eb0de89cdbb224ac90fbfda545b5396b69055e6
27466895d3e9250f3d0ae0e726f72b8a5c23e2aa83f9caaaf99dcb9f18fcac4c
284401fd9cc6074e6211119acdfbb4abb56b1d4c0be4323ccce1d6f6da7642ea
2ac5938f47fbfdbb40f6dc28da3e5d7ae8bfbead9d5e5769c3cb22f82ed0ac9f
2b32450ffdd94f7437c9a4db0500d67f2144044b3d6364b074643ee770fe2ecb
2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a
2cc6ae8ad154e087370262d60ebfb9747f2ff1a84f52605856b0dc805c44dfcf
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
3113153d65bcf7799f9ee3443c8991a1d123bf3af4cdaf49f11fde14aec24662
327473e2609faa37d9701987efff7916d84210c08b3850df3a2854890c30be61
332d1b140187c17f38d7bd50a71587ded1b48ca5c7c9cc2748142fb87a9bdac6
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
34489ae45b8749aa518a888ad417089b659ef6d87bb41dcfdf520a5876bd4da9
3813424f62a838f68ae495b56a6124b5409d36045a2723dcdc246bf88056fc88
396dbd7121c396fdab19e3660282b6835b19c3d8dccd84bee367d8985e44f93c
4071fe59d9cf1a379fd3b5689d070be17a25a5c06f1dc3544465d097afe7758b
407844bdddf476cc18f80188a3fb73350b6046fd1eaf47a0b9f7d72bacd2b9e5
45ec09974d948120c9f97cbedd141f4fa8df876bd2206f0c41133ae3a13fdf13
46375ee9192c1e0f6eabe4d32b2a48b996b93037f7b4beb970df5b87359548fd
46d2d8aa76374bad68b27aff870970ca15ff5f1ab3389f2327f21f073ddf521a
47b5e303447c7681ce1b2242f23699f94c0709da3aa5016ec1c8f6d7efcad1c5
487566e4584e4dd12f82141e80ee98ee63266508e96fad842225b656f1bf73ed
49aea8d1206dbb5e3c8a7d4db9274d2efa2111d8b53acb901efc378b1feca381
4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af
4c9ef034019aa39323b351f1d81fb4ac07a736f696b8204c20986fd31c8b9bdf
4d097a0116293da844fdeeaa11f41dd941e511e6df699ff2195e8499de8a42fd
4d7bc2e5c2959435469986ff3eb98d158edf428ed8eeccb0e8ffe31d3336c9ac
4da18cf3cfa4b3d576d9eda3450e2773c95ad8a660ec2998c7a7287f4191daf7
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e13a24713c60de07775945d4f347acc364ae5f5f156ac3186329c0dcdfa7c69
4eef62c77a19b7d9fb6f894cfa0e7757e0a3bf2936c1af0d330a9e409914bde0
5651b47069d656369d30ed6b1d4e23045b588550f0e51b6c2d3b8f6a24bc99cd
56766cebd19e526d59965412d4744818753abe2b9030407f0580eeaf029fff33
58836dc18d0e1c202d01dab37c404008b52182e946fa5043bbc3a2df6284ed59
599325d39743959cdacb163b742dd6f622443a73f155364bbcc465a291ce0b5a
59bd527fdd4691ca358f6e56b2388910a9caa4c6b66986930cc42f3112dd65e1
5a06800ad719e1f1b46691ded5a5577666d2fc30f950b0ba544352ede4e25de7
5afc4668b016e01a83f9479a2d96ef54b14bd6e994802e2565421a2fc04df4e3
5b50918195f5e1e0a7cf6917b5c71d590169d3b5a61b1e15228087d9621a537a
5b6cf86376b18e7013022123018f749c4427bc442df1ca43d05f7514b1984980
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5e01afe8a86d28d6600bf070d55298612f09bbcbd1f46b8169a61baf9cdd32b1
5e3890c1f6ed706d18fe8cfa64afef4c442f70f33d587695435a4be58ed67276
5f71fcc2d00d22ffd4d9a07b64c435f88de80893f838fa64a45c386cbba0c601
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3
60240d5a27ede94fd35fea44bd110b88c7d8cfc08127f032d13b0c622b8be827
60e52a19fe23790b163dd2a27b256eda989ec4b90f79b0abe0caedb1d44a0796
611c0522eeece05559f145a61bbff3839bfefe6e7b9e59e96e69225228f92418
638caa40d39dec20d95e4119187482e3c5939616252d96ded196b05c2e1cfc27
66873f18b674747bca014166e9c00769a6edc39d00cb50a6ded799893d6c834a
66d8104a5e8048bc8102957186d56a30c30b566ff1cde3774638f6e9549eb2dd
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
6afd8ef9240c2210f0619be79e30ab60c0f1053b1ff119d71e34cce7f66d263a
6b26263e492d4334076354b0db27917b73fdf99ca6f24ecb267ddca57a40138b
6b64f5bc28886025d0249793131aab1cf4a02c6b799543e2a74bc8047ead1b41
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6d3b6c2cce62a128cd3ce8734e5ca4b1f2ef83e86b70d09114d645752302946a
6da58d9e2e025ed65f71362d0912e154c7712188846b1d365407b32811591b03
6e312f277726cf12aa508a34dfc0c5217b72334652dc99f8df30559e3e8dc971
6e5f062bffe79aac620d5fd83f54cf20ce47cd7ced1800d87699b9991fcd9a8a
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
73e2e5173ed0d5a77b02914fa0ef1f67bb53143da75f0348f558f95565220ca1
75cdd0cd8782116ba8444dabd993758b1b349843584c9631f4f24a4295b98940
78d9c51dc6cbb63a144eeee8f2cc96351a627d047133c171e97cb3a6b2a2f096
7a44e0685d8929b5d4d50476273c9957c8c76f03afc424c665a4066e5bc1beb9
7b38f96f67bd52a3246d0ff5fa5f5278b45451be77e8dd1e4b94b4e6135f2018
802a3cb7595f14f16c36837989c3891dec2b38166b5a75bfdb2fde7c4ab09a4d
805cee749fd051beef0370ca9cc62ed038d755537d9869636d40f809aa6caa0e
82a5f826524292eb1bb531a7aaada0614f83dc0487e90a9549b394ce6f9cac44
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83617fdf42c2457abd24c043606c8ad4bacfd7fe6fce42dfa5d16f4fbec523dc
8767f01caa430c5bd4e3b008a8e9dfe022156a4e91a23c394fdcb05c267f1b94
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88288d364a5bec9987d23ac293b209b8d6fa22e4b7e7b19cce0c2fb417cf1bca
8857d647f96ba04fd5a24e7a547aad036614a57dfa575d850f3fd6fe2694b35f
89f3559669480a4882efa1f00d6b3201705835e1219e8c89aff316cee6892e14
8a387d8558f49244c17766a18c27cacebdf97e8135ae386fa8e6aacca8aaa636
8de728c4959491b9ada3bdb7017996f4ebf4ff4dd643e485f86818a72bc2efad
8f09bbdae620dcf710a12d3826b98e9cc3637446602f3921e80410a751c6dafe
8f0d44358544c598aaad61f29410b0866ca3085c95f8c5b1c37bd8947008629f
8f8c9f1c471da8dae19554e26c6c423f31e5e687ea3892e4a73ada4be3179f86
8fce36318ae0707c20333ed16ffe4897628548dc8d2a3c672b07ccc16f3f310f
908edfa9f7ec9fd5cb6b2159b5cb305d9c2c88601c8bf00a23bb0e96fcea1e21
927d5436967ebce8a52c4bdcd27cc056c910a72270f74990dfbd1d554840c12d
92ce8008dfa52e912fea1f1700570804a13891cfbc24c71cc3a2e51244ff6d78
938654c76f9aba5798b9e0e3480a095a1ea4f9b0a67ffcecc8833570e7475546
97d7a6a99d78ef625f666a5eadb2ebc807a035af276abf045f87050e1be2761d
99df9a89116a9ceb03dcb762de240a9eaea499bbc8375be88aa75f6acdc0fb93
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9db39e6b65543fd44b1193b45497943925f38d33104c0e044c2c4d35f002e861
9e13ef12708f64c09b8f81f80f0ac44521c4aeff8a7e5124865a2ef056a6a81d
9e51e7c1f2f3bd86cc3e9dcd1ad5403db927f32533f0a8b29bc15f11b40c6376
9f92d9904edc2f0e70b1e1519562454983d2063c509aa321b10ce77ff4f24f83
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a12b87855b6403c6f73092396d80541a6984aae03097a637769291d9cad15d19
a3f4c76a79a739f201a7d58866606219b635e3f31c641391d2cfcb8ac408f57d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4a435a77ba9821779ff039d294facf001ace345b9173c180754f425970b2d1a
aad5e122fd899c43270bc4942ae898712dff1ab260338ece62a8be7109f5ee9c
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1ea2546d8cb4ee9e950a77ef7049f0dd60a0328127926d91af1453b8c63d76c
b1f4247657f994f6c9520c982ab95f953ee1c052706594d74f521cae670cf8be
b1fbaef854e0f55871aa050995066ea783c517640ba307e4971a5dfa009342b1
b5c1a679368da537e7b0f6880801ab32fe84b38b900acdbc1fdbe8cd6a86c4c8
baad1213282cf51ae2d233a225c5dfadc45cbb309d7b3e52fbe7aa6ee59ea901
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bdf72009ad226c17f1954ba602292902a780b80af07dbcbab1322bdf5c32be66
c246ec07b24762244202158adadb0d006913c39f924c7d01d0ff00d2d024a0af
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c9815821ab1442501b9e9bae3d4bc5730315d6a513c8b40141b2d47b76da1916
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
ced235b4577cee17fe955033b58015406baceebf1d1c1e0aa28c86c53c1b2798
d36e5d7328268d21c6941039a7b6a15c7ed7414f60dbee72d2231d11ac9bdaf3
d5226bd3b12b75b176426f2be33bdee0eaa9e04f8c1013e0fd57f647206a316e
d59912fcad926b847aa253d75a11fb06fcdad5dec272527873b5b9e9083e4e2a
d641d794ffeb8ab4a93449307f4da1d4cb4a9c7020ad7da4c2f630b03de6d1f7
d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6
d8c60d643e58946baee86cbad5d665082f2acbb595f5dbc337f2a9d3f5fe39e4
d9de83c923a234e8b164d2351ed47b456ec3417785b5fc33b4827f071f51f05f
da9668f07b02b6a76bf8927b107bba9c1f88ac5fbf1b0d169d71fb7185b49efb
e1f044d98fc4d2f36e57186c1bf1eb9d11784e38e6cf55beb0208fc9a2bef09f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40a747b443b046d9071a67d800f2eed2b62bb1d2242714fed831ad73eeca1fc
e582eab9f97529cf56731793b29d7d6f82ce7cf3757f65e170aef28515e19e32
e696d9d16c3eb699981f86b7374a1d8bde5ea79ebbd91cf2777c1155b963edb8
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0
e913d0c8195023fea768aa63161cfe870b077cd360806e3905002e74acc7423e
ea0d8a62e779ceae1224b04a661334f14c30fddaf2d9a7dd6bcd7f8682e51bdc
ec98f88129d5c3180c878d70ae27ffcdf7907737e4d2e82ec41b6f81fe1cd8ea
eca91e4a100c07b72ff5522fad81c081c8da9c782fcb49cdb45953156bec9bf5
ee56037ac8fbd38d712a70f714fef6f8cb5aa40419b5e62f4b39a5c270226e2a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0bd461b72898c4f163b3ec06196d994a2b1a08e361c9703f1221333e69d9c66
f25aebef7c5b576071a6f97559078c0a17f5d3130f2cdb8d74f04872ec8fb333
f2c456a0d18af7915a660b1c1ee73a74520d3179eea236178778ee30b9505414
f2c761ee3ce27469f940a05b64e38a829a400427727cd0bdbb4e36f1d572afd7
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f41ae176305c7313c7168dcbddc24e4ec176ac1504ad9768c39450ddca5e6084
f494c6d8894113fcc5724294d52ff485c8d28b2d898a00975df52f1b6cb88584
f4a28bee7eba2ad83c74a71fba0fbcb4944cca88f51d546499bc0f8c284d0f83
fdc589c7d9d43e6ec99d0b662d9a2fb4137455aa8ea3901c853b093c0adb4491
fdd0f26fde1892abbb97a0b6161387f8b1775d37084bb004bc12db8cc30034fb

oneclickroot.com Open in urlscan Pro 2606:4700:3031::6815:3306 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

217 Requests

95 %HTTPS

65 %IPv6

33 Domains

49 Subdomains

43 IPs

7 Countries

2513 kBTransfer

7887 kBSize

17 Cookies

5 Outgoing links

Page URL History

Redirected requests

217 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

oneclickroot.com Open in urlscan Pro
2606:4700:3031::6815:3306 Public Scan

Screenshot
Live screenshot

Full Image

217
Requests

95 %
HTTPS

65 %
IPv6

33
Domains

49
Subdomains

43
IPs

7
Countries

2513 kB
Transfer

7887 kB
Size

17
Cookies

217 HTTP transactions
4 data transactions