urlscan.io logo urlscan.io
SecurityTrails logo

xss.academy Open in urlscan Pro
172.105.73.53  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://security.securitum.com/
Effective URL: https://xss.academy/
Submission: On September 06 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 1 countries across 10 domains to perform 65 HTTP transactions. The main IP is 172.105.73.53, located in Frankfurt am Main, Germany and belongs to LINODE-AP Linode, LLC, US. The main domain is xss.academy.
TLS certificate: Issued by R3 on August 27th 2022. Valid for: 3 months.
This is the only time xss.academy was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

27    172.105.73.53 (Frankfurt am Main, Germany)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li2034-53.members.linode.com
security.securitum.com
xss.academy
4    2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
4    2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
9    2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
6    2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
6    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:828::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
static.doubleclick.net
4    2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
jnn-pa.googleapis.com
1    2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
yt3.ggpht.com
1    2a00:1450:4001:82b::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
i.ytimg.com
Apex Domain
Subdomains		 Transfer
26 xss.academy
xss.academy
2 MB
12 gstatic.com
fonts.gstatic.com
www.gstatic.com
430 KB
9 youtube.com
www.youtube.com — Cisco Umbrella Rank: 91
793 KB
8 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 120
jnn-pa.googleapis.com — Cisco Umbrella Rank: 341
33 KB
4 google.com
www.google.com — Cisco Umbrella Rank: 19
36 KB
3 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 73
static.doubleclick.net — Cisco Umbrella Rank: 439
1 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 94
20 KB
1 ytimg.com
i.ytimg.com — Cisco Umbrella Rank: 107
18 KB
1 ggpht.com
yt3.ggpht.com — Cisco Umbrella Rank: 206
2 KB
1 securitum.com
security.securitum.com
75 B
65 10
Domain Requested by
26 xss.academy xss.academy
9 www.youtube.com xss.academy
www.youtube.com
6 www.gstatic.com www.google.com
www.youtube.com
www.gstatic.com
6 fonts.gstatic.com fonts.googleapis.com
www.youtube.com
www.google.com
4 jnn-pa.googleapis.com www.youtube.com
4 www.google.com xss.academy
www.gstatic.com
www.youtube.com
www.google.com
4 fonts.googleapis.com xss.academy
2 googleads.g.doubleclick.net 1 redirects www.youtube.com
2 www.google-analytics.com xss.academy
www.google-analytics.com
1 i.ytimg.com www.youtube.com
1 yt3.ggpht.com www.youtube.com
1 static.doubleclick.net www.youtube.com
1 security.securitum.com 1 redirects
65 13

This site contains links to these domains. Also see Links.

Domain
research.securitum.com
twitter.com
securitum.pl
blog.bentkowski.info
Subject Issuer Validity Valid
xss.academy
R3		 2022-08-27 -
2022-11-25		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh
edgestatic.com
GTS CA 1C3		 2022-08-15 -
2022-11-07		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://xss.academy/
Frame ID: 17EB2B7CB7846018772F41F8BFAFF5C3
Requests: 38 HTTP requests in this frame

Frame: https://www.youtube.com/embed/mQr8MkSJQXo
Frame ID: F2965673DA709BD708E7D2B5F187BD74
Requests: 20 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Frame ID: 282535EFF5F442780DFFDCEF56DBA773
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

XSS Academy - training by Securitum

Page URL History Show full URLs

  1. https://security.securitum.com/ HTTP 301
    https://xss.academy/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com/(?:v|embed)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

65
Requests

98 %
HTTPS

92 %
IPv6

10
Domains

13
Subdomains

13
IPs

1
Countries

3479 kB
Transfer

6625 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://security.securitum.com/ HTTP 301
    https://xss.academy/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44
  • https://googleads.g.doubleclick.net/pagead/id HTTP 302
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

65 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
xss.academy/
Redirect Chain
  • https://security.securitum.com/
  • https://xss.academy/
41 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
761aa978a32c8c7d6b1be1a4cda080c0110cb7cbb7faf9b83fad467e2b16eee4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-transform
content-encoding
gzip
content-length
9581
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Tue, 06 Sep 2022 10:48:52 GMT
etag
"a539-5b434a50e74f4-gzip"
last-modified
Mon, 16 Nov 2020 07:51:24 GMT
referrer-policy
same-origin
server
nginx
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=Edge
x-xss-protection
1; mode=block

Redirect headers

content-length
178
content-type
text/html
date
Tue, 06 Sep 2022 10:48:51 GMT
location
https://xss.academy
server
nginx
bootstrap.min.css
xss.academy/assets/bootstrap/css/ 		158 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/bootstrap/css/bootstrap.min.css
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
52636bbc089e25ce4faacb7f73645886f5525f93b2efea196dfe436a7932cfcb
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
24774
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"2789c-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css
cache-control
no-transform
accept-ranges
bytes
css
fonts.googleapis.com/ 		6 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Lora:400,700,400italic,700italic
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
457e03b53ba0f6d4b2cde2d03fadc58caa2795b9d36ef251102141b607081ae2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 06 Sep 2022 09:29:47 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Sep 2022 10:48:52 GMT
css
fonts.googleapis.com/ 		1 KB
529 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Cabin:700
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
901e3b4ec961739c8d264b70900f407e327f9494dff634713f0360605d32925a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 06 Sep 2022 10:40:12 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Sep 2022 10:48:52 GMT
css
fonts.googleapis.com/ 		3 KB
608 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Exo+2:400,700
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
f6131edd5227f7d4b60b0bbfaae22879a058b17f7c71075a9011c2bbe21d2818
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 06 Sep 2022 10:33:24 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Sep 2022 10:48:52 GMT
css
fonts.googleapis.com/ 		695 B
439 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Unica+One
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ac0de06f58d616401afae3719c9c8b4b5f92c0b6f664f7b873e162723dc3bf76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 06 Sep 2022 10:40:02 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 06 Sep 2022 10:48:52 GMT
fontawesome-all.min.css
xss.academy/assets/fonts/ 		56 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/fonts/fontawesome-all.min.css
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
19bc4712bca32db280000f294e2d0c1dc178063a9dd4278fc22d30a39c068846
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
12402
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"df26-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css
cache-control
no-transform
accept-ranges
bytes
font-awesome.min.css
xss.academy/assets/fonts/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/fonts/font-awesome.min.css
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
7053
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"7918-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css
cache-control
no-transform
accept-ranges
bytes
fontawesome5-overrides.min.css
xss.academy/assets/fonts/ 		566 B
614 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/fonts/fontawesome5-overrides.min.css
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
a9ce56cf7ddd8c6685ef99fd1301b3908f0db32bdc3d4eb6bacdf19fec00e618
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
219
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"236-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css
cache-control
no-transform
accept-ranges
bytes
aos.css
xss.academy/assets/css/ 		25 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/css/aos.css
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
1b6f88717e97441718b9fbd436b0aa65d4753c36c9901535eb81b7ce4b760bc4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
2260
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Wed, 14 Oct 2020 17:09:30 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"657f-5b1a498364680-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css
cache-control
no-transform
accept-ranges
bytes
styles.css
xss.academy/assets/css/ 		8 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/css/styles.css
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
de6c8e6c5a1ca8a567c2c87ee393661f4c4d67f2a60444c0b8bff1a3268f94d0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
2186
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Wed, 14 Oct 2020 17:13:49 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"1f0d-5b1a4a7a64d40-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css
cache-control
no-transform
accept-ranges
bytes
Michal-Bentkowski.jpg
xss.academy/assets/img/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/Michal-Bentkowski.jpg
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
dcc24b1ae559eac3baff4c2ac3869e73b15cf16730d10709f51a7f54355d2941
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"5a4b-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
23115
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
jquery.min.js
xss.academy/assets/js/ 		86 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/jquery.min.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
30677
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"15851-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
bootstrap.min.js
xss.academy/assets/bootstrap/js/ 		79 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/bootstrap/js/bootstrap.min.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
f67b782ec5a62c8fcedb89535bcf48cc02ae06a119e3b97fe2b875fad1ff358f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
21677
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"13c1f-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
smart-forms.min.js
xss.academy/assets/js/ 		16 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/smart-forms.min.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
4e6ca427bb9f1e44f17440eccf001b4c27da3ecea684420d4994baab0812e7c0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
4084
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"41c2-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
bs-init.js
xss.academy/assets/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/bs-init.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
e5d04d50f59f46e6488f0a95d356495e140f5e6aa51fc46e84b5321b6455e4f8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
731
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"5ef-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
aos.js
xss.academy/assets/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/aos.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
8acb04628394993656dad11f23029fc6ad13cf90cfaa1f5df89150b2727684a9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
4585
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Wed, 14 Oct 2020 17:08:18 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"37a4-5b1a493eba480-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
jquery.easing.min.js
xss.academy/assets/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/jquery.easing.min.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
1f7723b6b9bfced0deba108df48e3287888dd986f1ff2d5133bacc9807ac0349
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
817
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Wed, 14 Oct 2020 17:08:33 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"9e4-5b1a494d08640-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
smooth-scrolling.js
xss.academy/assets/js/ 		1 KB
1005 B 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/smooth-scrolling.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
944ed5cfd6533f73502919af06474fd0fb148f6c14b1bd7b7767dbc7520da140
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
600
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"50d-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
back-to-top.js
xss.academy/assets/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/back-to-top.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
05ad9913300cb2c979163613e6ea2cb3863cd5269f37c26786c921933a44dc71
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
1011
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"ae6-5b128aa171180-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
lightbox.min.js
xss.academy/assets/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/js/lightbox.min.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
7f36de4455b10ca52ae3e585dc4cafd63851715da1ae3e4b2439f66ac045ebfd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 06 Sep 2022 10:48:52 GMT
vary
Accept-Encoding
content-length
2654
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge
referrer-policy
same-origin
last-modified
Wed, 14 Oct 2020 17:08:56 GMT
server
nginx
x-frame-options
SAMEORIGIN
etag
"2128-5b1a4962f7a00-gzip"
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript
cache-control
no-transform
accept-ranges
bytes
api.js
www.google.com/recaptcha/ 		884 B
1000 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
8fa9ac13711c14ad31d0ed770a37a95b414130617075d5a4b69ddf2ef261d4ca
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
587
x-xss-protection
1; mode=block
expires
Tue, 06 Sep 2022 10:48:52 GMT
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
6412
date
Tue, 06 Sep 2022 09:02:00 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 06 Sep 2022 11:02:00 GMT
mQr8MkSJQXo
www.youtube.com/embed/ Frame F296 		63 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/mQr8MkSJQXo
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2603f9621887f6ffa52b6431b3cdb81660d022cdd8c2b1e881ad9afb5b9763fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
br
content-type
text/html; charset=utf-8
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
date
Tue, 06 Sep 2022 10:48:52 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server
ESF
strict-transport-security
max-age=31536000
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options
nosniff
x-xss-protection
0
securitum-logotyp.png
xss.academy/assets/img/ 		25 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/securitum-logotyp.png
Requested by
Host: xss.academy
URL: https://xss.academy/assets/css/styles.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
6cf2501f66e512cb8dfd2b18ef26def843e4494ccad3da9bf7edc9eb0c549a72
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/assets/css/styles.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"6284-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
25220
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
Hero-arch-05.png
xss.academy/assets/img/ 		526 KB
527 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/Hero-arch-05.png
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
64e1b0757a6c510dea0a15c24d9c30b9d09edb394fed113ba3cda543cb82c7ac
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"836da-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
538330
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
Foto-01.jpg
xss.academy/assets/img/ 		400 KB
401 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/Foto-01.jpg
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
bca8bbfa15b7ac29eadf14e50186c089ba7e2e63196e42bddf3df36d21af8445
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"641cd-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
410061
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
Foto-02.jpg
xss.academy/assets/img/ 		219 KB
219 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/Foto-02.jpg
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
93e07710ced28d5e5147466340f628128649354a4f015081ba39a325a6c6049e
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/jpeg
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"36ae6-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
223974
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7alxw.woff2
fonts.gstatic.com/s/cabin/v26/ 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cabin/v26/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7alxw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cabin:700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45a8badf06824c87461905a8b1871fc3ca3eb5934cee490deadad743ebf99661
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 02 Sep 2022 06:40:30 GMT
x-content-type-options
nosniff
age
360502
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15168
x-xss-protection
0
last-modified
Fri, 24 Jun 2022 18:41:36 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 02 Sep 2023 06:40:30 GMT
DPEuYwWHyAYGVTSmalsRcd3e.woff2
fonts.gstatic.com/s/unicaone/v13/ 		6 KB
7 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/unicaone/v13/DPEuYwWHyAYGVTSmalsRcd3e.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Unica+One
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
617621abcb1f1597ced21e45a143b2dc149b6f602032c04f791f76e67df8b4a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 31 Aug 2022 23:41:34 GMT
x-content-type-options
nosniff
age
472038
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6124
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:26:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 31 Aug 2023 23:41:34 GMT
fontawesome-webfont.woff2
xss.academy/assets/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: xss.academy
URL: https://xss.academy/assets/fonts/font-awesome.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://xss.academy/assets/fonts/font-awesome.min.css
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"12d68-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
77160
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
fa-solid-900.woff2
xss.academy/assets/fonts/ 		74 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/fonts/fa-solid-900.woff2
Requested by
Host: xss.academy
URL: https://xss.academy/assets/fonts/fontawesome-all.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
787d76ad6deab67ccf8bac1b584260205e114f508fc5542b612e3f75d49a34e4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://xss.academy/assets/fonts/fontawesome-all.min.css
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"12934-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
76084
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
fa-brands-400.woff2
xss.academy/assets/fonts/ 		74 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://xss.academy/assets/fonts/fa-brands-400.woff2
Requested by
Host: xss.academy
URL: https://xss.academy/assets/fonts/fontawesome-all.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
8e4560c16c7970efa47680450b2cf239d4a482c056d308acea12bb9022906c8b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://xss.academy/assets/fonts/fontawesome-all.min.css
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
font/woff2
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"128a0-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
75936
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7ilx17r.woff2
fonts.gstatic.com/s/cabin/v26/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/cabin/v26/u-4X0qWljRw-PfU81xCKCpdpbgZJl6XFpfEd7eA9BIxxkbqDH7ilx17r.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Cabin:700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d53bdb93ec5e0fc9d0d746c896f506fc0cf4bf1f53f4d9fe74bdc8bf6e6c29ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Thu, 01 Sep 2022 08:11:36 GMT
x-content-type-options
nosniff
age
441436
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8404
x-xss-protection
0
last-modified
Fri, 24 Jun 2022 18:41:44 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 01 Sep 2023 08:11:36 GMT
test-01.png
xss.academy/assets/img/ 		594 KB
595 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/test-01.png
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
295909adbbbaa43533149bff06337b8f741892f5f8a4f45c68cc5d41e199f591
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/png
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"948ee-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
608494
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
cd-top-arrow.svg
xss.academy/assets/img/ 		562 B
923 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xss.academy/assets/img/cd-top-arrow.svg
Requested by
Host: xss.academy
URL: https://xss.academy/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
172.105.73.53 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
li2034-53.members.linode.com
Software
nginx /
Resource Hash
3d1aa143071e7a7c055e6cc817b05f9f3732febf298008634da840bd3318f552
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://xss.academy/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

content-security-policy
upgrade-insecure-requests
referrer-policy
same-origin
last-modified
Thu, 08 Oct 2020 13:18:14 GMT
server
nginx
date
Tue, 06 Sep 2022 10:48:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
x-xss-protection
1; mode=block
cache-control
no-transform
etag
"232-5b128aa171180"
strict-transport-security
max-age=63072000; includeSubDomains; preload
accept-ranges
bytes
content-length
562
x-content-type-options
nosniff
x-ua-compatible
IE=Edge
www-player.css
www.youtube.com/s/player/c16db54a/ Frame F296 		353 KB
48 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/c16db54a/www-player.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a291b7a4643f0319ee8244ed6076cd1b5f6379584c1dbb67160030fbfa0c472d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Mon, 05 Sep 2022 06:52:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
100603
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49081
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:46:29 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 05 Sep 2023 06:52:09 GMT
www-embed-player.js
www.youtube.com/s/player/c16db54a/www-embed-player.vflset/ Frame F296 		308 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/c16db54a/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
093a0dd610c16a2b192e9ee3fd1a62f3df8e2a31c7d4092f91084b86fd6d946a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 02 Sep 2022 20:40:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
310095
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
97590
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:46:29 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 02 Sep 2023 20:40:37 GMT
base.js
www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/ Frame F296 		2 MB
574 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3b3d9e317bf262775b4bcf9e188641c831f8c90924b7ec6262e8d605aeb71f08
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 02 Sep 2022 20:41:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
310047
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
587801
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:46:29 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 02 Sep 2023 20:41:25 GMT
fetch-polyfill.js
www.youtube.com/s/player/c16db54a/fetch-polyfill.vflset/ Frame F296 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/c16db54a/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 02 Sep 2022 20:40:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
310095
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2786
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:46:29 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 02 Sep 2023 20:40:37 GMT
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type
image/gif
recaptcha__de.js
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ 		392 KB
157 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
Origin
https://xss.academy
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:12:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2182
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
159560
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:40:58 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 06 Sep 2023 10:12:30 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F296 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 30 Aug 2022 11:18:05 GMT
x-content-type-options
nosniff
age
603047
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 30 Aug 2023 11:18:05 GMT
collect
www.google-analytics.com/j/ 		2 B
204 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=744720321&t=pageview&_s=1&dl=https%3A%2F%2Fxss.academy%2F&ul=en-us&de=UTF-8&dt=XSS%20Academy%20-%20training%20by%20Securitum&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=646675584&gjid=1652636112&cid=146251741.1662461340&tid=UA-182157542-1&_gid=1141095415.1662461340&_r=1&_slc=1&z=42814537
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 06 Sep 2022 10:48:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://xss.academy
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
anchor
www.google.com/recaptcha/api2/ Frame 2825 		42 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
d0b35ef74d861db67debe49de37ee4430b48a9bc033d5ef4b71b6515c4913da9
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-FayCnVa7PhNuSH1lvnRCbA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-length
22023
content-security-policy
script-src 'report-sample' 'nonce-FayCnVa7PhNuSH1lvnRCbA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 06 Sep 2022 10:48:53 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
id
googleads.g.doubleclick.net/pagead/ Frame F296
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/id
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
100 B
146 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H3
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
197613c0afa6930e2d1047dad441c44c029b1034637c11cd5ec05179efe758c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
120
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 06 Sep 2022 10:48:53 GMT
x-content-type-options
nosniff
access-control-allow-origin
https://www.youtube.com
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame F296 		29 B
588 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:34:42 GMT
x-content-type-options
nosniff
age
851
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29
x-xss-protection
0
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 06 Sep 2022 10:49:42 GMT
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Tue, 06 Sep 2022 10:48:53 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame F296 		65 KB
30 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fa8e6d2db97fa2d139bfd5a57f25b16edf8a8872d9ffc19cc34c9f60a22a1ac5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
30511
x-xss-protection
0
remote.js
www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/ Frame F296 		120 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
100c658d1d6478d8c48b113c360ed8e07d28f29cb59900648226509cabebca75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 02 Sep 2022 20:45:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
309796
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37794
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:46:29 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 02 Sep 2023 20:45:37 GMT
yPATJU-uVo-zV-JkA6jSgBQ_ddZVTHGwvkBjTyjUrvU.js
www.google.com/js/th/ Frame F296 		36 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/th/yPATJU-uVo-zV-JkA6jSgBQ_ddZVTHGwvkBjTyjUrvU.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c8f013254fae568fb357e26403a8d280143f75d6554c71b0be40634f28d4aef5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Wed, 31 Aug 2022 05:03:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
539116
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14098
x-xss-protection
0
last-modified
Mon, 29 Aug 2022 11:00:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 31 Aug 2023 05:03:37 GMT
embed.js
www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/ Frame F296 		28 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
102142dcc1e87d25710da65618eb811f6c4545eb15b7ef6211add7e46c022642
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Fri, 02 Sep 2022 20:41:29 GMT
content-encoding
br
x-content-type-options
nosniff
age
310044
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8381
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:46:29 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sat, 02 Sep 2023 20:41:29 GMT
truncated
/ Frame F296 		175 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

Content-Type
image/png
AMLnZu8YrfDqariD-9TtSGT6uoJ_fb40Cgz36OA57Ryo=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame F296 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yt3.ggpht.com/ytc/AMLnZu8YrfDqariD-9TtSGT6uoJ_fb40Cgz36OA57Ryo=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
a1139dade29fe9a61db219c0c2c504d01427afa00acc26efef8a2a942762912f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
x-content-type-options
nosniff
age
0
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1685
x-xss-protection
0
server
fife
etag
"v5"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Sat, 03 Sep 2022 09:09:54 GMT
sddefault.webp
i.ytimg.com/vi_webp/mQr8MkSJQXo/ Frame F296 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ytimg.com/vi_webp/mQr8MkSJQXo/sddefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3dd25cf795636042a7b367e3457588393add388fcf9be6a657f705ab7bfa2fe3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
x-content-type-options
nosniff
server
sffe
etag
"1602683311"
vary
Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
image/webp
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18226
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 06 Sep 2022 12:48:53 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 2825 		52 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:08:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2441
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24251
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:40:58 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 06 Sep 2023 10:08:12 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/ Frame 2825 		392 KB
156 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:12:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2183
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
159560
x-xss-protection
0
last-modified
Fri, 02 Sep 2022 18:40:58 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 06 Sep 2023 10:12:30 GMT
generate_204
www.youtube.com/ Frame F296 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.youtube.com/generate_204?xEieCQ
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/mQr8MkSJQXo
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame F296 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2007
x-xss-protection
0
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview"
vary
Accept-Encoding
report-to
{"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 06 Sep 2022 10:48:53 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 2825 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/duyHVVR9Brf6N2GewjkPRfsA/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 30 Aug 2022 18:59:48 GMT
x-content-type-options
nosniff
age
575345
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Tue, 06 Sep 2022 18:59:48 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2825 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 30 Aug 2022 11:18:05 GMT
x-content-type-options
nosniff
age
603048
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 30 Aug 2023 11:18:05 GMT
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 2825 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 30 Aug 2022 18:59:48 GMT
x-content-type-options
nosniff
age
575345
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15552
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 30 Aug 2023 18:59:48 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame 2825 		102 B
134 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=duyHVVR9Brf6N2GewjkPRfsA
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
3444cd05f786fc062fcb5c164604566935c9c5b25706eeab6189b3a0f37d058d
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lf63tYZAAAAADb0a7U2KrMybLJogAUdWErppzhw&co=aHR0cHM6Ly94c3MuYWNhZGVteTo0NDM.&hl=de&v=duyHVVR9Brf6N2GewjkPRfsA&size=invisible&cb=dlbn7wkugq3l
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
cross-origin-embedder-policy
require-corp
x-frame-options
SAMEORIGIN
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Tue, 06 Sep 2022 10:48:53 GMT
cast_sender.js
www.gstatic.com/eureka/clank/105/ Frame F296 		52 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/eureka/clank/105/cast_sender.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c12337c132fc5b05766adf8806c16a2950c0591708c0c45263bc1496979c1870
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

date
Tue, 06 Sep 2022 07:31:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11832
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15116
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 15:05:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview-release"
vary
Accept-Encoding
report-to
{"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
expires
Wed, 07 Sep 2022 07:31:41 GMT
GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame F296 		98 B
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/player_ias.vflset/de_DE/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
61ce8da9aeec1178139c49c7dff4fd65714783ee71326cb8fd0eb4448bbc78c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Tue, 06 Sep 2022 10:48:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
118
x-xss-protection
0
GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Tue, 06 Sep 2022 10:48:53 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
log_event
www.youtube.com/youtubei/v1/ Frame F296 		28 B
54 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/c16db54a/www-embed-player.vflset/www-embed-player.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
X-Goog-Request-Time
1662461342705
Content-Type
application/json
X-YouTube-Utc-Offset
0
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/mQr8MkSJQXo
X-YouTube-Client-Version
1.20220831.01.01
X-YouTube-Time-Zone
Etc/Unknown
X-Goog-Visitor-Id
CgtqMmVnT2NVclZ6SSiUy9yYBg%3D%3D
X-YouTube-Ad-Signals
dt=1662461340064&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C540%2C304&vis=1&wgl=true&ca_type=image

Response headers

date
Tue, 06 Sep 2022 10:48:55 GMT
content-encoding
br
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Tue, 06 Sep 2022 10:48:55 GMT

Verdicts & Comments Add Verdict or Comment

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| GoogleAnalyticsObject function| ga function| $ function| jQuery object| bootstrap object| AOS boolean| scrolling object| lightbox object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| recaptcha object| closure_lm_282418

5 Cookies

Domain/Path Name / Value
.youtube.com/ Name: YSC
Value: 4e5E6iT7KcI
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: j2egOcUrVzI
.xss.academy/ Name: _ga
Value: GA1.2.146251741.1662461340
.xss.academy/ Name: _gid
Value: GA1.2.1141095415.1662461340
.xss.academy/ Name: _gat
Value: 1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
jnn-pa.googleapis.com
security.securitum.com
static.doubleclick.net
www.google-analytics.com
www.google.com
www.gstatic.com
www.youtube.com
xss.academy
yt3.ggpht.com
172.105.73.53
2a00:1450:4001:803::2004
2a00:1450:4001:806::2002
2a00:1450:4001:806::200a
2a00:1450:4001:809::2003
2a00:1450:4001:811::200e
2a00:1450:4001:813::2003
2a00:1450:4001:813::200a
2a00:1450:4001:828::2006
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2016
2a00:1450:4001:830::2001
05ad9913300cb2c979163613e6ea2cb3863cd5269f37c26786c921933a44dc71
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
093a0dd610c16a2b192e9ee3fd1a62f3df8e2a31c7d4092f91084b86fd6d946a
100c658d1d6478d8c48b113c360ed8e07d28f29cb59900648226509cabebca75
102142dcc1e87d25710da65618eb811f6c4545eb15b7ef6211add7e46c022642
197613c0afa6930e2d1047dad441c44c029b1034637c11cd5ec05179efe758c2
19bc4712bca32db280000f294e2d0c1dc178063a9dd4278fc22d30a39c068846
1b6f88717e97441718b9fbd436b0aa65d4753c36c9901535eb81b7ce4b760bc4
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1f7723b6b9bfced0deba108df48e3287888dd986f1ff2d5133bacc9807ac0349
2603f9621887f6ffa52b6431b3cdb81660d022cdd8c2b1e881ad9afb5b9763fc
295909adbbbaa43533149bff06337b8f741892f5f8a4f45c68cc5d41e199f591
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
3444cd05f786fc062fcb5c164604566935c9c5b25706eeab6189b3a0f37d058d
3b3d9e317bf262775b4bcf9e188641c831f8c90924b7ec6262e8d605aeb71f08
3d1aa143071e7a7c055e6cc817b05f9f3732febf298008634da840bd3318f552
3dd25cf795636042a7b367e3457588393add388fcf9be6a657f705ab7bfa2fe3
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
457e03b53ba0f6d4b2cde2d03fadc58caa2795b9d36ef251102141b607081ae2
45a8badf06824c87461905a8b1871fc3ca3eb5934cee490deadad743ebf99661
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
4e6ca427bb9f1e44f17440eccf001b4c27da3ecea684420d4994baab0812e7c0
52636bbc089e25ce4faacb7f73645886f5525f93b2efea196dfe436a7932cfcb
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
617621abcb1f1597ced21e45a143b2dc149b6f602032c04f791f76e67df8b4a2
61ce8da9aeec1178139c49c7dff4fd65714783ee71326cb8fd0eb4448bbc78c6
64e1b0757a6c510dea0a15c24d9c30b9d09edb394fed113ba3cda543cb82c7ac
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6cf2501f66e512cb8dfd2b18ef26def843e4494ccad3da9bf7edc9eb0c549a72
761aa978a32c8c7d6b1be1a4cda080c0110cb7cbb7faf9b83fad467e2b16eee4
787d76ad6deab67ccf8bac1b584260205e114f508fc5542b612e3f75d49a34e4
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f36de4455b10ca52ae3e585dc4cafd63851715da1ae3e4b2439f66ac045ebfd
8acb04628394993656dad11f23029fc6ad13cf90cfaa1f5df89150b2727684a9
8e4560c16c7970efa47680450b2cf239d4a482c056d308acea12bb9022906c8b
8fa9ac13711c14ad31d0ed770a37a95b414130617075d5a4b69ddf2ef261d4ca
901e3b4ec961739c8d264b70900f407e327f9494dff634713f0360605d32925a
93e07710ced28d5e5147466340f628128649354a4f015081ba39a325a6c6049e
944ed5cfd6533f73502919af06474fd0fb148f6c14b1bd7b7767dbc7520da140
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a1139dade29fe9a61db219c0c2c504d01427afa00acc26efef8a2a942762912f
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a291b7a4643f0319ee8244ed6076cd1b5f6379584c1dbb67160030fbfa0c472d
a9ce56cf7ddd8c6685ef99fd1301b3908f0db32bdc3d4eb6bacdf19fec00e618
ac0de06f58d616401afae3719c9c8b4b5f92c0b6f664f7b873e162723dc3bf76
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bca8bbfa15b7ac29eadf14e50186c089ba7e2e63196e42bddf3df36d21af8445
c12337c132fc5b05766adf8806c16a2950c0591708c0c45263bc1496979c1870
c8f013254fae568fb357e26403a8d280143f75d6554c71b0be40634f28d4aef5
caf2650aa985d277b2dd131a6261888bc64e6c9bc15e5564bfb9b380bcf82a10
cbea10abc6a4fb6c6db32f7ff91d4e53f496579268f4f28e4e15f14c76cdd088
d0b35ef74d861db67debe49de37ee4430b48a9bc033d5ef4b71b6515c4913da9
d53bdb93ec5e0fc9d0d746c896f506fc0cf4bf1f53f4d9fe74bdc8bf6e6c29ee
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
dcc24b1ae559eac3baff4c2ac3869e73b15cf16730d10709f51a7f54355d2941
de6c8e6c5a1ca8a567c2c87ee393661f4c4d67f2a60444c0b8bff1a3268f94d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d04d50f59f46e6488f0a95d356495e140f5e6aa51fc46e84b5321b6455e4f8
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
f6131edd5227f7d4b60b0bbfaae22879a058b17f7c71075a9011c2bbe21d2818
f67b782ec5a62c8fcedb89535bcf48cc02ae06a119e3b97fe2b875fad1ff358f
fa8e6d2db97fa2d139bfd5a57f25b16edf8a8872d9ffc19cc34c9f60a22a1ac5