urlscan.io logo urlscan.io
SecurityTrails logo

paybyplatema.site Open in urlscan Pro
2606:4700:3037::6815:1fd7  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://paybyplatema.site/
Effective URL: https://paybyplatema.site/
Submission: On August 10 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 3 countries across 12 domains to perform 61 HTTP transactions. The main IP is 2606:4700:3037::6815:1fd7, located in United States and belongs to CLOUDFLARENET, US. The main domain is paybyplatema.site.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 10th 2023. Valid for: a year.
This is the only time paybyplatema.site was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

10    2606:4700:3037::6815:1fd7 (United States)

ASN13335 (CLOUDFLARENET, US)
paybyplatema.site
5    2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
6    2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
4    2606:4700:3032::ac43:8ad7 (United States)

ASN13335 (CLOUDFLARENET, US)
acacdn.com
11    139.45.197.251 (United Kingdom)

ASN9002 (RETN-AS, GB)
yonhelioliskor.com
9    192.243.59.12 (Ashburn, United States)

ASN39572 (ADVANCEDHOSTERS-AS, NL)
alterassumeaggravate.com
4    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
2    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
partner.googleadservices.com
1    139.45.195.8 (United Kingdom)

ASN9002 (RETN-AS, GB)
my.rtmark.net
5    2606:4700:e4::ac40:a823 (United States)

ASN13335 (CLOUDFLARENET, US)
youradexchange.com
3    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
1    2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
Apex Domain
Subdomains		 Transfer
11 yonhelioliskor.com
yonhelioliskor.com — Cisco Umbrella Rank: 629006
41 KB
10 paybyplatema.site
paybyplatema.site
153 KB
9 alterassumeaggravate.com
alterassumeaggravate.com — Cisco Umbrella Rank: 329533
9 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 130
tpc.googlesyndication.com — Cisco Umbrella Rank: 151
213 KB
5 youradexchange.com
youradexchange.com — Cisco Umbrella Rank: 36677
1 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 65
384 KB
4 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2069
334 B
4 acacdn.com
acacdn.com — Cisco Umbrella Rank: 101587
154 KB
2 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
5 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 3
1 KB
1 rtmark.net
my.rtmark.net — Cisco Umbrella Rank: 11124
545 B
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 1216
607 B
61 12
Domain Requested by
11 yonhelioliskor.com paybyplatema.site
yonhelioliskor.com
10 paybyplatema.site 1 redirects paybyplatema.site
9 alterassumeaggravate.com paybyplatema.site
6 pagead2.googlesyndication.com paybyplatema.site
pagead2.googlesyndication.com
tpc.googlesyndication.com
5 youradexchange.com acacdn.com
5 www.googletagmanager.com paybyplatema.site
www.googletagmanager.com
4 region1.google-analytics.com www.googletagmanager.com
4 acacdn.com paybyplatema.site
acacdn.com
3 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
2 googleads.g.doubleclick.net pagead2.googlesyndication.com
1 www.google.com tpc.googlesyndication.com
1 my.rtmark.net paybyplatema.site
1 partner.googleadservices.com pagead2.googlesyndication.com
61 13

This site contains links to these domains. Also see Links.

Domain
youradexchange.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-02-10 -
2024-02-10		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-07-17 -
2023-10-09		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-07-17 -
2023-10-09		 3 months crt.sh
acacdn.com
GTS CA 1P5		 2023-07-11 -
2023-10-09		 3 months crt.sh
yonhelioliskor.com
R3		 2023-06-15 -
2023-09-13		 3 months crt.sh
alterassumeaggravate.com
R3		 2023-07-18 -
2023-10-16		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2023-07-17 -
2023-10-09		 3 months crt.sh
rtmark.net
R3		 2023-07-25 -
2023-10-23		 3 months crt.sh
youradexchange.com
GTS CA 1P5		 2023-06-21 -
2023-09-19		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-07-17 -
2023-10-09		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-07-17 -
2023-10-09		 3 months crt.sh

This page contains 5 frames:

Primary Page: https://paybyplatema.site/
Frame ID: 6086B04420F6AC9A9DE58F5F2007F30D
Requests: 50 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230808/r20190131/zrt_lookup.html
Frame ID: 45EC9C8B0E310F029213D7BD871817C4
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4969693136336878&output=html&adk=1812271804&adf=3025194257&lmt=1691669248&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x1080_l%7C212x1080_r&format=0x0&url=https%3A%2F%2Fpaybyplatema.site%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1691690613704&bpp=760&bdt=834&idt=1044&shv=r20230808&mjsv=m202308030102&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3279754144158&frm=20&pv=2&ga_vid=646315439.1691690613&ga_sid=1691690615&ga_hid=1693519111&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31076733%2C31076807%2C31076924&oid=2&pvsid=744392052487926&tmod=2074969340&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=1063
Frame ID: 6940C7DF0A81C894D47010AA34EB0EE1
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: FA31023AF1DE4D9825A58F802F5EEF47
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 295A8E693EF14D790C78908F1A8E2E7B
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

PayByPlateMa com Pay Online Toll Bills in Massachusetts

Page URL History Show full URLs

  1. http://paybyplatema.site/ HTTP 301
    https://paybyplatema.site/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

61
Requests

100 %
HTTPS

77 %
IPv6

12
Domains

13
Subdomains

13
IPs

3
Countries

954 kB
Transfer

2608 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://paybyplatema.site/ HTTP 301
    https://paybyplatema.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

61 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
paybyplatema.site/
Redirect Chain
  • http://paybyplatema.site/
  • https://paybyplatema.site/
92 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c3ded7595947b97807ce7feab0f8e44e0c2d6c257cb72268550c21a91489bad

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0
cf-cache-status
DYNAMIC
cf-ray
7f4a27f7bb1118dc-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 10 Aug 2023 18:03:32 GMT
expires
Thu, 10 Aug 2023 18:03:32 GMT
last-modified
Thu, 10 Aug 2023 14:07:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xs0IXMSxrGtE%2BkIgHnY8Twa4TY2ol%2F9itXvGiSrkAio2PKRCxlPz1qTZF5RhSyD46LJn%2FP32cex6t5hQ7L6ALVnj9qj2%2BfHj7K9kDq5qU8qkouZuyW2b8wnBbtJBtrKMGl62bThW82to%2BbHXw%2BLl5w%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,Accept-Encoding

Redirect headers

CF-RAY
7f4a27f6dfab927f-FRA
Cache-Control
max-age=3600
Connection
keep-alive
Date
Thu, 10 Aug 2023 18:03:32 GMT
Expires
Thu, 10 Aug 2023 19:03:32 GMT
Location
https://paybyplatema.site/
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ihKog8DNSeM2htWYFO2eFnT1vOOwaNjQH43b%2FzIVmAj7LSjalkETidEP8H0Xzjm6%2BblWtJefIlBX7iCbwMWhr3feP%2FsvT5YaGyN4Hnn2vSdh2bbQFfHcPahzmCYSdg%2B7pckRPtwBFefxhwcZOiJFPA%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400
4fe25cb8403b8bf73d79996bf2ac7bb5.css
paybyplatema.site/wp-content/cache/min/1/ 		135 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://paybyplatema.site/wp-content/cache/min/1/4fe25cb8403b8bf73d79996bf2ac7bb5.css
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a59dabada4fe980793de9c904fee9ed1cdcd5b489623273c4037a9a9df63c11c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Wed, 09 Aug 2023 07:52:29 GMT
server
cloudflare
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished
origSize=138824
vary
Accept-Encoding,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cWwDmBEAm3yP97A9SJqSqNhxAk%2FxQMfHCYHoIVnetyuEly62Br2egyvcx0rtDBJr2wK8nxpscsVo5ID8ChKnFxNEiO7Yi1ZSjIljlrenSp6If8zXJ6V2cY8%2By8WO2rGErLnjIxHeYi%2BSWh18lxl3ng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=UTF-8
cache-control
public, max-age=31536000,public
cf-ray
7f4a27fa8e9818dc-FRA
alt-svc
h3=":443"; ma=86400
expires
Thu, 08 Aug 2024 08:30:05 GMT
js
www.googletagmanager.com/gtag/ 		192 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-BR9S49MX8J
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d42085202093b85b6c6bd3c69ef678d75c068074ea2242136b277cdc4b5c8a9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:32 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
72315
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 10 Aug 2023 18:03:32 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		145 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4969693136336878
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a5fb6c37dc451c24b8e75c62d980e498c487fbe3b809577864d17f9f5f04eff7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://paybyplatema.site/
Origin
https://paybyplatema.site
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
50768
x-xss-protection
0
server
cafe
etag
16220424004746948337
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 10 Aug 2023 18:03:33 GMT
js
www.googletagmanager.com/gtag/ 		260 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-PQVTRPL0ST
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5faaa9f2b1e0a1e50f9e70635e086fd2fd55396ed5f4da941672d7489b8f208f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88762
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 10 Aug 2023 18:03:33 GMT
js
www.googletagmanager.com/gtag/ 		180 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-256309008-1
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
47d90727acb9bf251d457228fa72d1cbc94d39b389477888e2416c08fbeab7ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
66672
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 10 Aug 2023 18:03:33 GMT
atg.js
acacdn.com/script/ 		105 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acacdn.com/script/atg.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:8ad7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
26e189f6fa1647e9905eb19cf008d8f4ddbcdfd6b152d800889814e0a6f1d669

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2047
x-guploader-uploadid
ADPycdvxJ9sY3SJ6L3JDHwvto85SKjjPktuw_5M_VueEqWLNbOaAJ39zh1VTb2eYZl-5wWNvB0k2uJo5RAN-xc6fcaryz88EbmmN
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 04 Aug 2023 08:06:54 GMT
server
cloudflare
etag
W/"8ae014e4e660e04037c09e58737530fb"
vary
Accept-Encoding
x-goog-hash
crc32c=cg3w/w==, md5=iuAU5OZg4EA3wJ5Yc3Uw+w==
x-goog-generation
1691136414887084
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BDWOLZL55IqZmFiOmljLG6Qd6aUZLsRdez%2By6FN17s1DGViEnhSHGW4dc9dBILr6p%2FFUpq28qEpRibl7AEa9yOxRipOnFSs7jBXn4LDvi0joQqueGZ1ivax1PzMvsxROaM5HKE%2Fmbh2L"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
107312
cf-ray
7f4a27fb39da5c6e-FRA
expires
Thu, 10 Aug 2023 17:30:22 GMT
tag.min.js
yonhelioliskor.com/pfe/current/ 		13 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/pfe/current/tag.min.js?z=5907218
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
2c2d7fc364c8ba3d5295b7817c48a7baea14b7a2983fa2989796719a215e0e8c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Aug 2023 18:03:34 GMT
content-encoding
gzip
last-modified
Fri, 04 Aug 2023 11:40:05 GMT
server
nginx
etag
W/"64cce395-338c"
content-type
application/javascript
cache-control
no-cache
access-control-allow-credentials
true
paybyplate-ma-768x489.jpg
paybyplatema.site/wp-content/uploads/2022/10/ 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paybyplatema.site/wp-content/uploads/2022/10/paybyplate-ma-768x489.jpg
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d463d228d035d3ad8f2a03c125a95f741960bf46567a8aa6a43678dba5f7859

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
cf-cache-status
HIT
last-modified
Tue, 18 Oct 2022 14:43:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6YauNBifKDFTK5p0RB5uNc6WAYPrR2Z5T9DZAczTvC5qfJaGng8Q1SfNIvVkQkYu87wF2521YxU9WGdEdUsfR6bo3yHxOKDF0xeejZwIOa3Du8xX%2F%2BRid%2Bo%2FpPwhjNfB89Y%2BbyrZmD5zqxoKfq7rgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=10368000,public
accept-ranges
bytes
cf-ray
7f4a27faaeb318dc-FRA
alt-svc
h3=":443"; ma=86400
content-length
35012
expires
Mon, 16 Oct 2023 12:48:30 GMT
PayByPlateMA-768x299.jpg
paybyplatema.site/wp-content/uploads/2022/10/ 		34 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paybyplatema.site/wp-content/uploads/2022/10/PayByPlateMA-768x299.jpg
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14479a98ec305fbd5fb6681cc2e6a69c603249fa7039c1eb31658add354721c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
cf-cache-status
HIT
last-modified
Tue, 18 Oct 2022 14:26:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HLIQWjJcqgK7UW2hLnHzHlIXyukADRbJ3pPGTRJegvruRbplI3GvgOi1TjZvIfIocGWIGDTpH8g9i2nC8EtS%2B5rNF8Mx66mERvLpcnwzokuwKPeiEHU98yoiUgTLDWl6pBbw5e7C1vYsDk4WeeYiDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=10368000,public
accept-ranges
bytes
cf-ray
7f4a28023876906c-FRA
alt-svc
h3=":443"; ma=86400
content-length
34423
expires
Sat, 11 Nov 2023 10:06:34 GMT
PaybyPlateMa-password-reset-2-768x358.jpg
paybyplatema.site/wp-content/uploads/2022/10/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paybyplatema.site/wp-content/uploads/2022/10/PaybyPlateMa-password-reset-2-768x358.jpg
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5147a8231c22904e0b506be9ca95eeb3882f3e85a2c3c213ed28c720d0dd48f5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
cf-cache-status
HIT
last-modified
Tue, 18 Oct 2022 14:07:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QCrFB7%2FlO08wneWNSI56wylgekcIuKX6sHsCxw2rgXLcHiPAkRnjx8kNk%2Fac3czvkoJ%2FGTXPWqTvnAzfMiexlzqX%2F1UYWQlyBf4Ba3%2F%2FILTBKDvo7A9nuVRKzpW5z5GHKt%2B5Yis0xJKbRD3PCxDvvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=10368000,public
accept-ranges
bytes
cf-ray
7f4a28039a01906c-FRA
alt-svc
h3=":443"; ma=86400
content-length
31316
expires
Mon, 16 Oct 2023 16:04:24 GMT
email-decode.min.js
paybyplatema.site/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://paybyplatema.site/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 08 Aug 2023 14:42:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"64d25459-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1zB2%2FDAjo0ZGH1ROREcWJ7z%2BAXRESbJQ28fm1S7G247Zdz2azawxeAz%2Bjv9YykJ9zzffnBIidrL9wccgx0cTQjHwWJtbzBzOOQpHIGC8Gb4IVtUBkXyqYF0MhV7%2BpxsNAVNu5KIm6s0goID8VxkzjA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7f4a27fbd9da906c-FRA
expires
Sat, 12 Aug 2023 18:03:33 GMT
menu.min.js
paybyplatema.site/wp-content/themes/generatepress/assets/js/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://paybyplatema.site/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.3.0
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
174066535cb768d1715ae34808cd4e83f16f23715524bfff79db8860e8c03296

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 22 Mar 2023 16:14:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LN4P16PCheoODKKR6pPcLOCX7ZoxfRNzlQ%2BENQW4j50NQ1%2BmpxG6wj2c7SH0dvxT5VYsHNq43sn0%2BsKDBfvQWRg80oBf6Th5v9wTxFx51%2FaUlHtqTPB84A%2FP88A9JDFGY2LTpSjT%2Fjrv70l5jb0Ojg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000,public
cf-ray
7f4a27fbf9f6906c-FRA
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Jun 2024 12:29:20 GMT
main.min.js
paybyplatema.site/wp-content/plugins/luckywp-table-of-contents/front/assets/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://paybyplatema.site/wp-content/plugins/luckywp-table-of-contents/front/assets/main.min.js?ver=2.1.4
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
995456f7211327129612b97dc0a2baa2288f1e3065d1d6ed1882a0eb89d6baac

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:33 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 14 Oct 2022 08:55:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tKdqb8rP%2B4ohLFwoT9wVOFpbwZbD2qMJ6JBBOMSXIFF1r27nngftIp73Yif7nBFS2HHA8Kt60ycecXjJ4blMy21pFka%2FBU%2BlnLtuC%2B1lU5Lp1M2CBzs4oby1epwtV9y6yYaYzqDjOrGgHnIS61kSBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000,public
cf-ray
7f4a27fd0b2b906c-FRA
alt-svc
h3=":443"; ma=86400
expires
Thu, 13 Jun 2024 12:29:20 GMT
103f872def2557028e4aca50c4daff0f.js
alterassumeaggravate.com/10/3f/87/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/10/3f/87/103f872def2557028e4aca50c4daff0f.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:34 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
collect
region1.google-analytics.com/g/ 		0
255 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-BR9S49MX8J&gtm=45je3890&_p=1693519111&cid=646315439.1691690613&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1691690613&sct=1&seg=0&dl=https%3A%2F%2Fpaybyplatema.site%2F&dt=PayByPlateMa%20com%20Pay%20Online%20Toll%20Bills%20in%20Massachusetts&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-BR9S49MX8J
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Aug 2023 18:03:33 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://paybyplatema.site
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		260 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-PQVTRPL0ST&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-BR9S49MX8J
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
1588fb3df8f9b9fd13d0226df71f395af15ee25c4ea6007a1cc437d6c18e7dab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88774
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 10 Aug 2023 18:03:34 GMT
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308030102/ 		372 KB
125 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308030102/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4969693136336878&plah=paybyplatema.site
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4969693136336878
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4578cc40b356903805da4ae30bcb6a8551e0d2a464cf4dbaf3c5e99efd770dc6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
128349
x-xss-protection
0
server
cafe
etag
14815242763881939228
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 10 Aug 2023 18:03:34 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230808/r20190131/ Frame 45EC 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20230808/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4969693136336878
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://paybyplatema.site/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
5484
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
4544
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 10 Aug 2023 16:32:09 GMT
etag
12368291122986407432
expires
Thu, 24 Aug 2023 16:32:09 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
collect
region1.google-analytics.com/g/ 		0
45 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-PQVTRPL0ST&gtm=45je3890&_p=1693519111&cid=646315439.1691690613&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1691690613&sct=1&seg=0&dl=https%3A%2F%2Fpaybyplatema.site%2F&dt=PayByPlateMa%20com%20Pay%20Online%20Toll%20Bills%20in%20Massachusetts&en=page_view&_fv=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PQVTRPL0ST
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Aug 2023 18:03:33 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://paybyplatema.site
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		209 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-5M4EY5KCMW&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-256309008-1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fac6920af02c011b0fb3643356083a3f09ff0ac82e45f54e6e47cfdab1dc5c5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
76524
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 10 Aug 2023 18:03:34 GMT
invoke.js
alterassumeaggravate.com/d3b70164122317877867615a5af5346f/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:34 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
zone
yonhelioliskor.com/ 		884 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/zone?pub=0&zone_id=5907218&is_mobile=false&domain=paybyplatema.site&var=&ymid=&var_3=
Requested by
Host: yonhelioliskor.com
URL: https://yonhelioliskor.com/pfe/current/tag.min.js?z=5907218
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
9d240aaf3d61197b2c0974214b1e74273bc2ae98195c2844cb30a1e80b54c2cd
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

x-trace-id
394c7f0e1d28b5d7b46a75d50b1a66bc
date
Thu, 10 Aug 2023 18:03:34 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://paybyplatema.site
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
884
universal.min.js
yonhelioliskor.com/pfe/current/ 		85 KB
33 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/pfe/current/universal.min.js?v=3.1.447
Requested by
Host: yonhelioliskor.com
URL: https://yonhelioliskor.com/pfe/current/tag.min.js?z=5907218
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
d386a8d490fb64324db18390f71f8987c9c2fd6eb8e93f334c416544737b600c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Aug 2023 18:03:34 GMT
content-encoding
gzip
last-modified
Fri, 04 Aug 2023 11:40:05 GMT
server
nginx
etag
W/"64cce395-155ce"
content-type
application/javascript
access-control-allow-origin
https://paybyplatema.site
cache-control
no-cache
access-control-allow-credentials
true
collect
region1.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-5M4EY5KCMW&gtm=45je3890&_p=1693519111&cid=646315439.1691690613&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EAAI&_s=1&sid=1691690614&sct=1&seg=0&dl=https%3A%2F%2Fpaybyplatema.site%2F&dt=PayByPlateMa%20com%20Pay%20Online%20Toll%20Bills%20in%20Massachusetts&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5M4EY5KCMW&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Aug 2023 18:03:34 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://paybyplatema.site
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
custom
yonhelioliskor.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://paybyplatema.site
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://paybyplatema.site
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Thu, 10 Aug 2023 18:03:34 GMT
server
nginx
custom
yonhelioliskor.com/ 		39 B
326 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/custom
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
c3f41a080506fc6f1b06f5f72ffd5ae0
date
Thu, 10 Aug 2023 18:03:34 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://paybyplatema.site
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
39
Code%20file
paybyplatema.site/ 		5 KB
6 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://paybyplatema.site/Code%20file
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3037::6815:1fd7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eed5e77bb0b4ffaa4a4802ade9d4cae485660554e327e4f8d29d37629a03daae

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
cf-cache-status
DYNAMIC
last-modified
Fri, 28 Apr 2023 20:57:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5A0op4avOjU1w%2FbGoovKu8vHjhUuIgRqwj8mRnz8Viwo%2BYgE%2Bh3K5X6N5U%2BCFBzoq8CaMhWw%2Fxsx89%2Bd9gPKtVk%2BMdy9Iu%2B8%2FHD1SOxWafz6aM9b%2Bg%2BNtBzSV2%2B70qke16y8E6gAICv%2FsVABikv9DQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
7f4a2805dcac906c-FRA
alt-svc
h3=":443"; ma=86400
content-length
5242
expires
Sat, 09 Sep 2023 18:03:34 GMT
invoke.js
alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:34 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
cookie.js
partner.googleadservices.com/gampad/ 		401 B
607 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=paybyplatema.site&callback=_gfp_s_&client=ca-pub-4969693136336878
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308030102/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4969693136336878&plah=paybyplatema.site
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
44b2e685f2c151b49338c5539558ab5d11dd98272fcd0d5c4a436554ed4b7f88
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
255
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 6940 		603 B
218 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4969693136336878&output=html&adk=1812271804&adf=3025194257&lmt=1691669248&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x1080_l%7C212x1080_r&format=0x0&url=https%3A%2F%2Fpaybyplatema.site%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1691690613704&bpp=760&bdt=834&idt=1044&shv=r20230808&mjsv=m202308030102&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3279754144158&frm=20&pv=2&ga_vid=646315439.1691690613&ga_sid=1691690615&ga_hid=1693519111&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31076733%2C31076807%2C31076924&oid=2&pvsid=744392052487926&tmod=2074969340&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=1063
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308030102/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4969693136336878&plah=paybyplatema.site
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://paybyplatema.site/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 10 Aug 2023 18:03:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
invoke.js
alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:34 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
invoke.js
alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:35 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
custom
yonhelioliskor.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://paybyplatema.site
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://paybyplatema.site
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Thu, 10 Aug 2023 18:03:35 GMT
server
nginx
custom
yonhelioliskor.com/ 		39 B
326 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/custom
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
95abbcf78cf8d77b8e2e1b4bcc4f1ebb
date
Thu, 10 Aug 2023 18:03:35 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://paybyplatema.site
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
39
gid.js
my.rtmark.net/ 		65 B
545 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://my.rtmark.net/gid.js?pub=0&userId=cc34b6a75c9b45c29d356bfc8cc6c052&zoneId=5907218&checkDuplicate=true&ymid=&var=
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
139.45.195.8 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
c56169a170453097cd1dca09eaef318585e47e3fc7b11c0da05e1afd27452b20
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:35 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://paybyplatema.site
access-control-expose-headers
Authorization
access-control-allow-credentials
true
timing-allow-origin
*, *
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
content-length
65
invoke.js
alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:35 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
invoke.js
alterassumeaggravate.com/d3b70164122317877867615a5af5346f/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:35 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
invoke.js
alterassumeaggravate.com/d3b70164122317877867615a5af5346f/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:35 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
event
yonhelioliskor.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/event
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://paybyplatema.site
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://paybyplatema.site
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Thu, 10 Aug 2023 18:03:35 GMT
server
nginx
event
yonhelioliskor.com/ 		94 B
381 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/event
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
1b94946cb3b3b1f924cf79e93e7a6bd2494bb27bc78006559bfe710f606340fb
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
1c1b360dcdb7630200749518e62a053e
date
Thu, 10 Aug 2023 18:03:35 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://paybyplatema.site
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
94
invoke.js
alterassumeaggravate.com/d3b70164122317877867615a5af5346f/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.243.59.12 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software
nginx/1.19.5 /
Resource Hash

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Thu, 10 Aug 2023 18:03:35 GMT
Server
nginx/1.19.5
Accept-CH
Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Content-Type
application/javascript
Connection
keep-alive
Content-Length
0
custom
yonhelioliskor.com/ 		39 B
326 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/custom
Requested by
Host: paybyplatema.site
URL: https://paybyplatema.site/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881
Security Headers
Name Value
Strict-Transport-Security max-age=1
X-Content-Type-Options nosniff

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
application/json

Response headers

x-trace-id
4a7affff5f3460896518916c78e7dcca
date
Thu, 10 Aug 2023 18:03:35 GMT
strict-transport-security
max-age=1
x-content-type-options
nosniff
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
https://paybyplatema.site
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept
content-length
39
sodar
pagead2.googlesyndication.com/getconfig/ 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230808&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308030102/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4969693136336878&plah=paybyplatema.site
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
271bd1b888f12dbfa7c14ef58bb3fcd94083e4ae46d2b7fbde001baa4da347de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:35 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11633
x-xss-protection
0
custom
yonhelioliskor.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://yonhelioliskor.com/custom
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://paybyplatema.site
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://paybyplatema.site
access-control-max-age
86400
content-length
0
content-type
text/plain; charset=utf-8
date
Thu, 10 Aug 2023 18:03:35 GMT
server
nginx
ut.js
acacdn.com/script/ 		80 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acacdn.com/script/ut.js?cb=1691690614475
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/atg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:8ad7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
598f8c291c7321d1b28233ae7f76f5a92c549b3f39db28ebd605069a9f9b3af5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:35 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2166
x-guploader-uploadid
ADPycdsKUs5Ma5NJz8GuF81ZSlHJGgHCXxewTKYPKbE9BHHp6xB90L4iIpC241UIe1tunGoiVn3rdXJKW282zDFkFiUYzN3qL2G1
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 27 Jul 2023 08:59:07 GMT
server
cloudflare
etag
W/"15207f22f2a90c931616bc80d297af5e"
vary
Accept-Encoding
x-goog-hash
crc32c=LyN8+w==, md5=FSB/IvKpDJMWFryA0pevXg==
x-goog-generation
1690448347755614
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BP%2BTjHewse5JToV5UP6A6H17G2fMp0QdYOKLnmq8HSPApKwp4VgMdT1dY8AVCx3iMlpZMiEYzH3oM1c8MEUvy6USOgx8M7ykGif1tUsuKaEKQxBAXtF%2BkYM0Zbq6teQCHdVnQY1lkzes"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
82354
cf-ray
7f4a280ccee55c6e-FRA
expires
Thu, 10 Aug 2023 18:12:31 GMT
czcf.php
youradexchange.com/ad/ 		204 B
667 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/ad/czcf.php?cz=dddyue3gxn&chmob=%3F0
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/atg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90b7b3d3cf24dcbeda9657513661418643887b6e4c46cf3a2d9eb78d98dc14db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
via
1.1 google
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EvYrGvH923Nk1QTvcGMsvPxr%2F6%2BDULgI5iQJ82RB2egdA0uxd82I1RsVUf2hHGDnt1REj774%2F59PbzQNjcL6JPQe%2BeE0fIgctTU6dd%2FjkyhpNY1ALKbmTrUWDs4N%2BcpUkUa77kc%2F4TDIC3v2qRiB%2FRE%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
content-type
text/html; charset=utf-8
cf-ray
7f4a280d6e375c62-FRA
access-control-allow-headers
Content-Type
alt-svc
h3=":443"; ma=86400
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202308030102/show_ads_impl_with_ama_fy2021.js?client=ca-pub-4969693136336878&plah=paybyplatema.site
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Thu, 10 Aug 2023 18:03:35 GMT
hb.php
youradexchange.com/ut/ 		0
415 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/ut/hb.php?cb=0.7152781470847791
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/ut.js?cb=1691690614475
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://paybyplatema.site/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
Content-Type
text/plain; charset=utf-8

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n9w0%2BLoQOwHNB90Y4QYHYXp8yTRv9iJXW2vOPWcKDUkTwZCVptcb%2BoQkGcRV2SNZpDGuHgGdhArmh31nS2N6V57BSmjkRPfWW8EdmsJVyo2AfB2rOY2r9X1J4CUYXLv5GxPbEmq8Q%2B8snxXkujp4HX0%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
7f4a280dce7e901c-FRA
alt-svc
h3=":443"; ma=86400
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame FA31 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://paybyplatema.site/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1936
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Thu, 10 Aug 2023 17:31:19 GMT
expires
Fri, 09 Aug 2024 17:31:19 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 295A 		783 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
1ba6f4d154ac3ce7ed0dd64a289e4f2a38ffdf5a4ce7fc84692b4703ca1730f6
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-My92mzmYm_Lxb8dfrgjqcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://paybyplatema.site/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
511
content-security-policy
script-src 'report-sample' 'nonce-My92mzmYm_Lxb8dfrgjqcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 10 Aug 2023 18:03:36 GMT
expires
Thu, 10 Aug 2023 18:03:36 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
gDKveuiD6qzElJZQWCdHL_tXbW9wBzQNLi6nE-8m1ts.js
pagead2.googlesyndication.com/bg/ Frame FA31 		38 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/gDKveuiD6qzElJZQWCdHL_tXbW9wBzQNLi6nE-8m1ts.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8032af7ae883eaacc49496505827472ffb576d6f7007340d2e2ea713ef26d6db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 15:47:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
8148
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14779
x-xss-protection
0
last-modified
Mon, 07 Aug 2023 12:08:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 09 Aug 2024 15:47:48 GMT
display.php
youradexchange.com/n/ 		0
341 B 		Script
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/n/display.php?r=6713762&atag=1&czid=dddyue3gxn&aggr=2&ppv=1&srs=03c2840c0d0e9b4a9f9894d1e1fa7473
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/atg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-methods
GET, POST, OPTIONS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fb7MRJJSfJheIUay83bpIPm8dd9%2FzCgwrOVTqH6GruceT6cC6U9g7iVtLBTBOi5IBLUUd993EU99ZNC3JO1huVXsvyNv6x%2FG4JlBOf8S8zV9yR3%2BJl1Awr3QR6kwHUS%2BeAIs3%2Fh8RY%2BWQcIr%2Fj3D%2Fc8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
7f4a280e7f35901c-FRA
access-control-allow-headers
Content-Type
alt-svc
h3=":443"; ma=86400
ippg.js
acacdn.com/script/ 		121 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acacdn.com/script/ippg.js
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/atg.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:8ad7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f1dd6ebbb5dec91e6869026ca44b38e644eb2970a524a86fea3ac40ea24436d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
432
x-guploader-uploadid
ADPycdtS2PdVAY5kUjzTM3UfLSbKXOtH6GxMGI_xZJTBdv2yInyrgGva_3sJCnzK__Me6dP7DB8_35iIUl3udbEvvdzX0ZcN9rzu
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 01 Aug 2023 10:42:02 GMT
server
cloudflare
etag
W/"65abb2cf1db985095d4657ee10b185c8"
vary
Accept-Encoding
x-goog-hash
crc32c=FDBm8g==, md5=Zauyzx25hQldRlfuELGFyA==
x-goog-generation
1690886522906376
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L9FaY%2BlxGYLXkeSAseLDGLTAiJOZ0ODPy1P2zYyJR%2BdrONltc070DMkFrPp6YbrqiPpJ5Dtw1S6%2BMjOIccRmXEyTUSFBGjm5%2F6dsS7hChF0pz6XSU8wrFs4%2BJoxqDYOFpYcuxhGA5QTH"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
124255
cf-ray
7f4a280e79819a35-FRA
expires
Thu, 10 Aug 2023 18:13:07 GMT
suv4.js
acacdn.com/script/ 		146 KB
49 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acacdn.com/script/suv4.js
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/atg.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3032::ac43:8ad7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b2f9db008ee83d202539f22980ad01bf251e40e08dd7e124abebb946d8247a71

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
1416
x-guploader-uploadid
ADPycdv4vc-kjRM3SyIbv43DsRW72giBW0mFEyGM9lsFllt6-9qZYUn8PYRe-ojEdNkzIc0s1a4YFxxRZe0wPZq5TV4GfYbntDdG
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 10 Aug 2023 11:25:13 GMT
server
cloudflare
etag
W/"ab1d2ca5de8baba7d482f0b63bbc033e"
vary
Accept-Encoding
x-goog-hash
crc32c=M41Dbg==, md5=qx0spd6Lq6fUgvC2O7wDPg==
x-goog-generation
1691666713246484
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=14400
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CbzwwDzJpE%2FZ%2Fx87IxjaYNFSp3rhmzJpgGg8JZhS%2BFSS707zblcoxGOC3T28u0csc3rpn1JIaJfLicS3QsvfxgCWrkY18Pya22omJDeDrC%2F3eYcm0GWoGFE4nYBhl5vhFpK%2BbYxJeQOd"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length
149775
cf-ray
7f4a280e79829a35-FRA
expires
Thu, 10 Aug 2023 18:24:06 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 295A 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230808&jk=744392052487926&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers
generate_204
tpc.googlesyndication.com/ Frame FA31 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?eAlbEw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
push.php
youradexchange.com/script/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/script/push.php?r=6713766&ipp=1&mads=1&position=top&czid=dddyue3gxn&aggr=2&atag=1&cbpage=https%3A%2F%2Fpaybyplatema.site%2F&cbref=&srs=03c2840c0d0e9b4a9f9894d1e1fa7473&chmob=%3F0
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/ippg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-methods
GET, POST, OPTIONS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=biUs2ETnHKpYmGCaRrDDTRANOWiXd4TlVcXngOrrrCZ%2Fp65KmqJRBm2Ln5a2NrPS%2BFE65qqw%2BtbnrmaUTASR%2B221k31bBd9zVSAP1Ja2EoEebwEclp1F1uN5IHvYlBkkYA2tlHbVlAiha6OpTlSETtw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
7f4a280f68805c62-FRA
access-control-allow-headers
Content-Type
alt-svc
h3=":443"; ma=86400
suurl4.php
youradexchange.com/script/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://youradexchange.com/script/suurl4.php?r=6713770&chmob=%3F0&atag=1&czid=dddyue3gxn&cbur=0.05730421156260812&cbiframe=0&cbWidth=1600&cbHeight=1200&cbtitle=PayByPlateMa%20com%20Pay%20Online%20Toll%20Bills%20in%20Massachusetts&cbpage=https%3A%2F%2Fpaybyplatema.site%2F&cbref=&cbdescription=PaybyPlateMa%20com%20and%20E-ZPass%20is%20smooth%20%26%20easy%20ways%20to%20pay%20tolls%20online%20and%20with%20the%20introduction%20of%20app%20it%20has%20become%20even%20more%20easier.&cbkeywords=&cbcdn=acacdn.com&aggr=2&ts=1691690616257&srs=03c2840c0d0e9b4a9f9894d1e1fa7473
Requested by
Host: acacdn.com
URL: https://acacdn.com/script/suv4.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e4::ac40:a823 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date
Thu, 10 Aug 2023 18:03:36 GMT
via
1.1 google
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-allow-methods
GET, POST, OPTIONS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KByL5ZOL51f%2BiHSRoraYskan1TYonxWj62yn%2Fdkew257vSjMO6uzYmcsk2uq%2BxY%2FxoudMH1zHFko8Gcebx%2FHzCOxyN90j7FFxF2cxUDidQqJupnlAaJQzL6srdyN50QUtJFhkF0TWPk8AM6AnqWcfFU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
cf-ray
7f4a280fb8ca5c62-FRA
access-control-allow-headers
Content-Type
alt-svc
h3=":443"; ma=86400
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230808&jk=744392052487926&bg=!EBOlE0fNAAaiGN5Pghg7ADkAdvg8Wu4PhkD7UtDinPbUgq9r7VgeXJ7qNMjQDIo0qer2fg8zOGNYxYBIaWtQIQiiCRKVuDcABNACAAAAVVIAAAAFaAEHmQLC-aBCWN3h9LDYsZn37wtV98f0FhA09vN7odstlZLvayCwboRDxGSOovziI4J2LaPHWIhrNFL65XvvG7dBRuPLm14TKY_F_DMFMWRe1igmrcgTSRLvN56sl49lHNOse0fPKjFqcmimpceGpdDym9oeu4PBYnQ_ScCTc9NTn0dA5GCfLjTNCznOn_GtpKPXvRIbR1bS7YuzYE0Wscz6OapD-MoVkh8S_7pTr2-xKH8GlOlDNZpi9mp8TLhSxCXSeC_hT97KFmJQ5ElWnOHdIGDbwWbiwv1mfnqmCqCD6tFVYyxBRydindowDHBklgeka3JR1UvWqE_Ah7Hbbpe1slL42yZ55zueIwg4jfUig27dh2u802LxIG5FrsrS8GpXUFWhEFOpkwY7F1AipQdlm4n2lgKeosK___TaQPIJrr_ACG0PEaiO7r7xPvsX3UfG-944M7Df8t-ByZK0mtSKjyW1hLcUJewPfdSfW7wQpTJ62v2GAAAZxHJ2TLqwJHJh62T-NYBGuINpl2EnysY0tOyBY7jMFVanhOyQQgOgbzA7kFtytzO4EcxbbsUx7mnL8jaLWfx4HnEExBXw6w9P3vSRTTg74cyJnjrIMBOW_kxcZWUUTPgVjEs4Ptu63hLnKjpm5l4Zu4tAr73OJpzxGJsjI8qaW0E7EnpL28NWoeDmACrqhgWjqPabrqW2iW7EM87V4XAfvg7EbujY0OVKJzvTgiZv0sJs0N2YR1RjbBRWuOI2KPGKjvXmc3uw6sI3cYbuuOW2oByIax_WzJ25ooiYrCFg6hCCQpYw3VIB5fGZMh74s0SxhKgZcemhtbg9Y0GBLVb4o7vj9k4UTihPRSKfcaexP6omrtJnN6ALwoSpnOYaHE9ui1KhRQXewa_FxW3aKa9zyhxqWfa8_-x0NgEqQ_WUUMTNQJLaVkHremPTlkW3bw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers
collect
region1.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-PQVTRPL0ST&gtm=45je3890&_p=1693519111&cid=646315439.1691690613&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&ngs=1&_s=2&sid=1691690613&sct=1&seg=0&dl=https%3A%2F%2Fpaybyplatema.site%2F&dt=PayByPlateMa%20com%20Pay%20Online%20Toll%20Bills%20in%20Massachusetts&en=scroll&epn.percent_scrolled=90&_et=6
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-PQVTRPL0ST
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://paybyplatema.site/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 10 Aug 2023 18:03:38 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://paybyplatema.site
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 function| gtag object| dataLayer object| google_tag_manager object| google_tag_data object| gaGlobal object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_reactive_ads_global_state object| adsbygoogle object| google_sa_queue function| google_process_slots number| google_rum_task_id_counter string| google_user_agent_client_hint function| onYouTubeIframeAPIReady function| google_spfd number| google_unique_id object| google_sv_map object| regeneratorRuntime boolean| s2sa810 object| atOptions object| zfgformats object| sdk boolean| installOnFly function| google_sa_impl boolean| _gfp_p_ number| google_global_correlator object| google_prev_clients object| ampInaboxIframes object| ampInaboxPendingMessages boolean| zfgloadedpush boolean| zfgloadedpushopt boolean| zfgloadedpushcode function| _createClass function| _classCallCheck function| RocketBrowserCompatibilityChecker object| RocketPreloadLinksConfig object| generatepressMenu object| lwptoc object| GoogleGcLKhOms string| rgxngibqxq boolean| user_engagement810 string| utsid-send boolean| s2sg810 boolean| s2ss810 function| s2ss810ff object| google_image_requests

8 Cookies

Domain/Path Name / Value
.paybyplatema.site/ Name: _ga_BR9S49MX8J
Value: GS1.1.1691690613.1.0.1691690613.0.0.0
.paybyplatema.site/ Name: _ga
Value: GA1.1.646315439.1691690613
.paybyplatema.site/ Name: _ga_PQVTRPL0ST
Value: GS1.1.1691690613.1.0.1691690613.0.0.0
.paybyplatema.site/ Name: _ga_5M4EY5KCMW
Value: GS1.1.1691690614.1.0.1691690614.0.0.0
.paybyplatema.site/ Name: __gads
Value: ID=d393bf0694e3f192-22fcc46d4dde0015:T=1691690614:RT=1691690614:S=ALNI_MZ92_s7yzy04RQYf9Qh41BTlSHfpw
.paybyplatema.site/ Name: __gpi
Value: UID=00000c5dc1c0692c:T=1691690614:RT=1691690614:S=ALNI_MY2vqeFwEUAaKQHnwDdY3n5n_q1eQ
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
my.rtmark.net/ Name: ID
Value: cc34b6a75c9b45c29d356bfc8cc6c052

29 Console Messages

Source Level URL
Text
javascript warning URL: https://paybyplatema.site/(Line 110)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/10/3f/87/103f872def2557028e4aca50c4daff0f.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://paybyplatema.site/(Line 110)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/10/3f/87/103f872def2557028e4aca50c4daff0f.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/10/3f/87/103f872def2557028e4aca50c4daff0f.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4969693136336878&output=html&adk=1812271804&adf=3025194257&lmt=1691669248&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=212x1080_l%7C212x1080_r&format=0x0&url=https%3A%2F%2Fpaybyplatema.site%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1691690613704&bpp=760&bdt=834&idt=1044&shv=r20230808&mjsv=m202308030102&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3279754144158&frm=20&pv=2&ga_vid=646315439.1691690613&ga_sid=1691690615&ga_hid=1693519111&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759837%2C44759876%2C44759927%2C31076733%2C31076807%2C31076924&oid=2&pvsid=744392052487926&tmod=2074969340&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&cms=2&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=1063
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/c66d4a55a2c58bb312b1ffebcda49b63/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error
Message:
The script does not have a MIME type.
network error URL: https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning (Line 8)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://alterassumeaggravate.com/d3b70164122317877867615a5af5346f/invoke.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acacdn.com
alterassumeaggravate.com
googleads.g.doubleclick.net
my.rtmark.net
pagead2.googlesyndication.com
partner.googleadservices.com
paybyplatema.site
region1.google-analytics.com
tpc.googlesyndication.com
www.google.com
www.googletagmanager.com
yonhelioliskor.com
youradexchange.com
139.45.195.8
139.45.197.251
192.243.59.12
2001:4860:4802:34::36
2606:4700:3032::ac43:8ad7
2606:4700:3037::6815:1fd7
2606:4700:e4::ac40:a823
2a00:1450:4001:80f::2008
2a00:1450:4001:81c::2004
2a00:1450:4001:827::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2002
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
14479a98ec305fbd5fb6681cc2e6a69c603249fa7039c1eb31658add354721c0
1588fb3df8f9b9fd13d0226df71f395af15ee25c4ea6007a1cc437d6c18e7dab
174066535cb768d1715ae34808cd4e83f16f23715524bfff79db8860e8c03296
18e7a53e3b3abd7ac0242719f7f62cb56b8efe7065091585b8ad22cbc2b8c41c
1b94946cb3b3b1f924cf79e93e7a6bd2494bb27bc78006559bfe710f606340fb
1ba6f4d154ac3ce7ed0dd64a289e4f2a38ffdf5a4ce7fc84692b4703ca1730f6
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26e189f6fa1647e9905eb19cf008d8f4ddbcdfd6b152d800889814e0a6f1d669
271bd1b888f12dbfa7c14ef58bb3fcd94083e4ae46d2b7fbde001baa4da347de
2c2d7fc364c8ba3d5295b7817c48a7baea14b7a2983fa2989796719a215e0e8c
44b2e685f2c151b49338c5539558ab5d11dd98272fcd0d5c4a436554ed4b7f88
4578cc40b356903805da4ae30bcb6a8551e0d2a464cf4dbaf3c5e99efd770dc6
47d90727acb9bf251d457228fa72d1cbc94d39b389477888e2416c08fbeab7ab
5147a8231c22904e0b506be9ca95eeb3882f3e85a2c3c213ed28c720d0dd48f5
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
598f8c291c7321d1b28233ae7f76f5a92c549b3f39db28ebd605069a9f9b3af5
5faaa9f2b1e0a1e50f9e70635e086fd2fd55396ed5f4da941672d7489b8f208f
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6c3ded7595947b97807ce7feab0f8e44e0c2d6c257cb72268550c21a91489bad
6d463d228d035d3ad8f2a03c125a95f741960bf46567a8aa6a43678dba5f7859
8032af7ae883eaacc49496505827472ffb576d6f7007340d2e2ea713ef26d6db
8f1dd6ebbb5dec91e6869026ca44b38e644eb2970a524a86fea3ac40ea24436d
90b7b3d3cf24dcbeda9657513661418643887b6e4c46cf3a2d9eb78d98dc14db
995456f7211327129612b97dc0a2baa2288f1e3065d1d6ed1882a0eb89d6baac
9d240aaf3d61197b2c0974214b1e74273bc2ae98195c2844cb30a1e80b54c2cd
a59dabada4fe980793de9c904fee9ed1cdcd5b489623273c4037a9a9df63c11c
a5fb6c37dc451c24b8e75c62d980e498c487fbe3b809577864d17f9f5f04eff7
b2f9db008ee83d202539f22980ad01bf251e40e08dd7e124abebb946d8247a71
c56169a170453097cd1dca09eaef318585e47e3fc7b11c0da05e1afd27452b20
d386a8d490fb64324db18390f71f8987c9c2fd6eb8e93f334c416544737b600c
d42085202093b85b6c6bd3c69ef678d75c068074ea2242136b277cdc4b5c8a9d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eed5e77bb0b4ffaa4a4802ade9d4cae485660554e327e4f8d29d37629a03daae
fac6920af02c011b0fb3643356083a3f09ff0ac82e45f54e6e47cfdab1dc5c5a
ff752c1c79bb2c0347c5a8b7f069fa2772047324dbbadf77d21cec4b26ee3881