billing.low.ms Open in urlscan Pro
178.62.19.109 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://billing.low.ms/
Effective URL:
https://billing.low.ms/clientarea.php
Submission: On April 03 via automatic, source certstream-suspicious (April 3rd 2020, 1:24:39 am UTC)

Summary HTTP 19 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 9 domains to perform 19 HTTP transactions. The main IP is 178.62.19.109, located in London, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is billing.low.ms.
TLS certificate: Issued by Let's Encrypt Authority X3 on January 29th 2020. Valid for: 3 months.

This is the only time billing.low.ms was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 9	178.62.19.109 178.62.19.109	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2a00:1450:400... 2a00:1450:4001:815::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE)
1	216.58.208.34 216.58.208.34	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:400c:c0b::9b	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	64.233.184.155 64.233.184.155	15169 (GOOGLE) (GOOGLE)
19	10

9 178.62.19.109 (London, United Kingdom) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: web.network.low.ms

billing.low.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.208.34 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra15s12-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0b::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.184.155 (United States)

ASN15169 (GOOGLE, US)
PTR: wa-in-f155.1e100.net

bid.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	low.ms 1 redirects billing.low.ms	805 KB
3	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net bid.g.doubleclick.net	1 KB
2	google.de www.google.de	219 B
2	google.com 1 redirects www.google.com	313 B
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	gstatic.com fonts.gstatic.com	22 KB
1	googleadservices.com www.googleadservices.com	11 KB
1	googletagmanager.com www.googletagmanager.com	28 KB
1	googleapis.com fonts.googleapis.com	762 B
19	9

	Domain	Requested by
9	billing.low.ms	1 redirects billing.low.ms
2	www.google.de	billing.low.ms
2	www.google.com	1 redirects billing.low.ms
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	fonts.gstatic.com	billing.low.ms
1	bid.g.doubleclick.net	www.googleadservices.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	stats.g.doubleclick.net	1 redirects
1	www.googleadservices.com	www.googletagmanager.com
1	www.googletagmanager.com	billing.low.ms
1	fonts.googleapis.com	billing.low.ms
19	11

This site contains links to these domains. Also see Links.

Domain
low.ms

Subject Issuer	Validity	Valid
*.low.ms Let's Encrypt Authority X3	`2020-01-29` - `2020-04-28`	3 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://billing.low.ms/clientarea.php
Frame ID: 43A0866FB6F780198C071B68371C1138
Requests: 18 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: DFC153790B1F4492DE48132450DA900E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://billing.low.ms/ HTTP 302
https://billing.low.ms/clientarea.php Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

19
Requests

100 %
HTTPS

73 %
IPv6

9
Domains

11
Subdomains

10
IPs

4
Countries

887 kB
Transfer

1287 kB
Size

4
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://low.ms/
Title: Home

Search URL Search Domain Scan URL

URL: https://low.ms/game-servers
Title: Game Servers

Search URL Search Domain Scan URL

URL: https://low.ms/dedicated-servers
Title: Dedicated Servers

Search URL Search Domain Scan URL

URL: https://low.ms/faq
Title: FAQ

Search URL Search Domain Scan URL

URL: https://low.ms/contact
Title: Contact

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://billing.low.ms/ HTTP 302
https://billing.low.ms/clientarea.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 13

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1041624953&t=pageview&_s=1&dl=https%3A%2F%2Fbilling.low.ms%2Fclientarea.php&ul=en-us&de=UTF-8&dt=Client%20Area%20-%20LOW.MS&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IGBACUABB~&jid=2004330743&gjid=1680313178&cid=967412775.1585877064&tid=UA-74393698-9&_gid=993113084.1585877064&_r=1&gtm=2ou3p1&z=230673586 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_gid=993113084.1585877064&gjid=1680313178&_v=j81&z=230673586 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_v=j81&z=230673586 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_v=j81&z=230673586&slf_rd=1&random=1629849187

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request clientarea.php Show response
billing.low.ms/
Redirect Chain

https://billing.low.ms/
https://billing.low.ms/clientarea.php

24 KB
5 KB

331ms
330ms

Document
text/html

178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

acd561fd11a22cab64127976b670f0e65fbbb7f97c64c90f575335e0f29fb932

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

:method: GET
:authority: billing.low.ms
:scheme: https
:path: /clientarea.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: WHMCSqpulqiYprIm5=bpl0b9jujtqt5dk2ubcbn5i8uk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
server: nginx/1.10.3 (Ubuntu)
date: Fri, 03 Apr 2020 01:24:23 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: DENY
x-content-type-options: nosniff
content-encoding: gzip

Redirect headers

status: 302
server: nginx/1.10.3 (Ubuntu)
date: Fri, 03 Apr 2020 01:24:22 GMT
content-type: text/html; charset=utf-8
content-length: 0
location: clientarea.php
set-cookie: WHMCSqpulqiYprIm5=bpl0b9jujtqt5dk2ubcbn5i8uk; path=/; secure; HttpOnly
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
strict-transport-security: max-age=63072000; includeSubdomains
x-frame-options: DENY
x-content-type-options: nosniff

GET
H2 200 css
fonts.googleapis.com/ 5 KB
762 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:815::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 03 Apr 2020 01:24:23 GMT
server: ESF
date: Fri, 03 Apr 2020 01:24:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 03 Apr 2020 01:24:23 GMT

GET
H2 200 all.min.css
billing.low.ms/templates/lowms/css/ 209 KB
46 KB 70ms
69ms Stylesheet
text/css 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://billing.low.ms/templates/lowms/css/all.min.css?v=3b5448

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

7461e8f0986cf5abd0a95dbf6b20b3bbc4342401814b4b784298822653c1d2c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 20 Jan 2020 22:56:40 GMT
server: nginx/1.10.3 (Ubuntu)
x-frame-options: DENY
etag: W/"5e263028-34414"
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63072000; includeSubdomains

GET
H2 200 fontawesome-all.min.css
billing.low.ms/assets/css/ 153 KB
35 KB 99ms
99ms Stylesheet
text/css 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://billing.low.ms/assets/css/fontawesome-all.min.css

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

2c694cfafd5c00ba4a7a2110060eb937afccfc1d7b745a319c49764fe4ef017c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 20 Jan 2020 22:53:24 GMT
server: nginx/1.10.3 (Ubuntu)
x-frame-options: DENY
etag: W/"5e262f64-26338"
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63072000; includeSubdomains

GET
H2 200 custom.css
billing.low.ms/templates/lowms/css/ 10 KB
3 KB 105ms
104ms Stylesheet
text/css 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://billing.low.ms/templates/lowms/css/custom.css

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

6bd308dc8d39183664707675620f47dc6e4ee920ecc125b07d0b36c3112e4c41

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sat, 21 Mar 2020 00:23:55 GMT
server: nginx/1.10.3 (Ubuntu)
x-frame-options: DENY
etag: W/"5e755e9b-2791"
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63072000; includeSubdomains

GET
H2 200 scripts.min.js Show response
billing.low.ms/templates/lowms/js/ 589 KB
590 KB 121ms
120ms Script
application/javascript 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://billing.low.ms/templates/lowms/js/scripts.min.js?v=3b5448

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

62e4fc035e98a20fa15f567780f38ed88db6e375a3f3d1f020bb0079d0076f26

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
last-modified: Mon, 20 Jan 2020 22:56:40 GMT
server: nginx/1.10.3 (Ubuntu)
etag: "5e263028-9332b"
x-frame-options: DENY
content-type: application/javascript
status: 200
strict-transport-security: max-age=63072000; includeSubdomains
accept-ranges: bytes
content-length: 602923

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 76 KB
28 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-74393698-9

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ee6f5365c5be4dd8584c6e3fd2aae1156b826dbe5baaa173c90949f98dff1da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 29063
x-xss-protection: 0
last-modified: Fri, 03 Apr 2020 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 03 Apr 2020 01:24:23 GMT

GET
H2 200 logo.png
billing.low.ms/templates/lowms/img/ 5 KB
5 KB 123ms
122ms Image
image/png 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://billing.low.ms/templates/lowms/img/logo.png

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

6a481b33c90385c8d7ac2de568b31d59ccb11b6d90f3d633c448fdf3553e86cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
last-modified: Mon, 20 Jan 2020 22:56:40 GMT
server: nginx/1.10.3 (Ubuntu)
etag: "5e263028-14ed"
x-frame-options: DENY
content-type: image/png
status: 200
strict-transport-security: max-age=63072000; includeSubdomains
accept-ranges: bytes
content-length: 5357

GET
H2 200 clippy.svg
billing.low.ms/assets/img/ 519 B
743 B 83ms
83ms Image
image/svg+xml 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://billing.low.ms/assets/img/clippy.svg

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

686d81e030899b477865d67a01fe34e83d8e68aa8da91a59205ad3e901a3ec71

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
last-modified: Mon, 20 Jan 2020 22:53:24 GMT
server: nginx/1.10.3 (Ubuntu)
etag: "5e262f64-207"
x-frame-options: DENY
content-type: image/svg+xml
status: 200
strict-transport-security: max-age=63072000; includeSubdomains
accept-ranges: bytes
content-length: 519

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/templates/lowms/js/scripts.min.js?v=3b5448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Roboto:400,700
Origin: https://billing.low.ms
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 01 Apr 2020 18:22:23 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 111720
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11016
x-xss-protection: 0
expires: Thu, 01 Apr 2021 18:22:23 GMT

GET
H2 200 fa-solid-900.woff2
billing.low.ms/assets/webfonts/ 120 KB
121 KB 40ms
39ms Font
application/octet-stream 178.62.19.109
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://billing.low.ms/assets/webfonts/fa-solid-900.woff2

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/templates/lowms/js/scripts.min.js?v=3b5448

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.62.19.109 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

web.network.low.ms

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

550f1ae5d566afed493ab8b5f1dd1b4d5a777ef19d1b3c57bf7b01025fefd38c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://billing.low.ms/assets/css/fontawesome-all.min.css
Origin: https://billing.low.ms
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
last-modified: Mon, 20 Jan 2020 22:53:24 GMT
server: nginx/1.10.3 (Ubuntu)
etag: "5e262f64-1e0fc"
x-frame-options: DENY
content-type: application/octet-stream
status: 200
strict-transport-security: max-age=63072000; includeSubdomains
accept-ranges: bytes
content-length: 123132

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/templates/lowms/js/scripts.min.js?v=3b5448

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Roboto:400,700
Origin: https://billing.low.ms
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 31 Jan 2020 00:50:19 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 5445244
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 11020
x-xss-protection: 0
expires: Sat, 30 Jan 2021 00:50:19 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:818::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-74393698-9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 2748
date: Fri, 03 Apr 2020 00:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Fri, 03 Apr 2020 02:38:35 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 27 KB
11 KB 74ms
31ms Script
text/javascript 216.58.208.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-74393698-9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f2.1e100.net

Software

cafe /

Resource Hash

16eb0a70a492521fe8b552e0bbad58808da2e8cc1717133e7716553082aff124

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 03 Apr 2020 01:24:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 10554
x-xss-protection: 0
server: cafe
etag: 10353592511413706603
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 03 Apr 2020 01:24:23 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=1041624953&t=pageview&_s=1&dl=https%3A%2F%2Fbilling.low.ms%2Fclientarea.php&ul=en-us&de=UTF-8&dt=Client%20Area%20-%20LOW.MS&sd=24-bit&sr=1600...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_gid=993113084.1585877064&gjid=1680313178&_v=j81&z=230673586
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_v=j81&z=230673586
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_v=j81&z=230673586&slf_rd=1&random=1629849187

42 B
109 B

17ms
17ms

Image
image/gif

2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_v=j81&z=230673586&slf_rd=1&random=1629849187

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-74393698-9&cid=967412775.1585877064&jid=2004330743&_v=j81&z=230673586&slf_rd=1&random=1629849187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/860196059/ 2 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/860196059/?random=1585877063589&cv=9&fst=1585877063589&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2ou3p1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fbilling.low.ms%2Fclientarea.php&tiba=Client%20Area%20-%20LOW.MS&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d3b8f5d48e91ef91bf3ccc762d1bcf4283f7afb0ba22a4ca09b560ccd3f98ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Fri, 03 Apr 2020 01:24:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 1038
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/860196059/ 42 B
127 B 19ms
19ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/860196059/?random=1585877063589&cv=9&fst=1585875600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2ou3p1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fbilling.low.ms%2Fclientarea.php&tiba=Client%20Area%20-%20LOW.MS&async=1&fmt=3&is_vtc=1&random=2630044491&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/860196059/ 42 B
110 B 20ms
19ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/860196059/?random=1585877063589&cv=9&fst=1585875600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2ou3p1&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fbilling.low.ms%2Fclientarea.php&tiba=Client%20Area%20-%20LOW.MS&async=1&fmt=3&is_vtc=1&random=2630044491&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: billing.low.ms
URL: https://billing.low.ms/clientarea.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://billing.low.ms/clientarea.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 03 Apr 2020 01:24:23 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
bid.g.doubleclick.net/xbbe/ Frame DFC1 0
0 104ms
40ms Document
text/html 64.233.184.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/pixel?d=KAE

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.233.184.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wa-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: bid.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=KAE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://billing.low.ms/clientarea.php
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://billing.low.ms/clientarea.php

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Fri, 03 Apr 2020 01:24:23 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUlAU_sj-9XPLGFDLLOCOQgDOH5PgaSKZbKgs86LzM1iAQhE9mP7H3zJAyXJ; expires=Sun, 03-Apr-2022 01:24:23 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
expires: Fri, 03 Apr 2020 01:24:23 GMT
cache-control: private

Verdicts & Comments Add Verdict or Comment

78 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.low.ms/	1970-01-19 08:32:43	Name: _gid Value: GA1.2.993113084.1585877064
.low.ms/	1970-01-20 02:02:29	Name: _ga Value: GA1.2.967412775.1585877064
.low.ms/	1970-01-19 08:31:17	Name: _gat_gtag_UA_74393698_9 Value: 1
billing.low.ms/	1969-12-31 23:59:59	Name: WHMCSqpulqiYprIm5 Value: bpl0b9jujtqt5dk2ubcbn5i8uk

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bid.g.doubleclick.net
billing.low.ms
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
178.62.19.109
216.58.208.34
2a00:1450:4001:800::2002
2a00:1450:4001:800::2008
2a00:1450:4001:808::2003
2a00:1450:4001:808::2004
2a00:1450:4001:814::2003
2a00:1450:4001:815::200a
2a00:1450:4001:818::200e
2a00:1450:400c:c0b::9b
64.233.184.155
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
16eb0a70a492521fe8b552e0bbad58808da2e8cc1717133e7716553082aff124
2c694cfafd5c00ba4a7a2110060eb937afccfc1d7b745a319c49764fe4ef017c
4d3b8f5d48e91ef91bf3ccc762d1bcf4283f7afb0ba22a4ca09b560ccd3f98ea
550f1ae5d566afed493ab8b5f1dd1b4d5a777ef19d1b3c57bf7b01025fefd38c
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
62e4fc035e98a20fa15f567780f38ed88db6e375a3f3d1f020bb0079d0076f26
686d81e030899b477865d67a01fe34e83d8e68aa8da91a59205ad3e901a3ec71
6a481b33c90385c8d7ac2de568b31d59ccb11b6d90f3d633c448fdf3553e86cb
6bd308dc8d39183664707675620f47dc6e4ee920ecc125b07d0b36c3112e4c41
7461e8f0986cf5abd0a95dbf6b20b3bbc4342401814b4b784298822653c1d2c0
acd561fd11a22cab64127976b670f0e65fbbb7f97c64c90f575335e0f29fb932
d32996520262a9559a26eafe3413cf1a2fe53f448da989d0493e7851f887a1b0
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d
ee6f5365c5be4dd8584c6e3fd2aae1156b826dbe5baaa173c90949f98dff1da8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

billing.low.ms Open in urlscan Pro 178.62.19.109 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

19 Requests

100 %HTTPS

73 %IPv6

9 Domains

11 Subdomains

10 IPs

4 Countries

887 kBTransfer

1287 kBSize

4 Cookies

5 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

78 JavaScript Global Variables

4 Cookies

Security Headers

Indicators

billing.low.ms Open in urlscan Pro
178.62.19.109 Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

100 %
HTTPS

73 %
IPv6

9
Domains

11
Subdomains

10
IPs

4
Countries

887 kB
Transfer

1287 kB
Size

4
Cookies

19 HTTP transactions
0 data transactions