promoimpresos.com Open in urlscan Pro
2607:f1c0:100f:f000::227 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://promoimpresos.com/modules/53/
Effective URL:
https://promoimpresos.com/modules/53/signin.php
Submission: On February 23 via automatic, source phishtank (February 23rd 2020, 5:02:29 am UTC)

Summary HTTP 65 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 25 IPs in 6 countries across 24 domains to perform 65 HTTP transactions. The main IP is 2607:f1c0:100f:f000::227, located in United States and belongs to ONEANDONE-AS Brauerstrasse 48, DE. The main domain is promoimpresos.com.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G1 on January 28th 2020. Valid for: a year.

This is the only time promoimpresos.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fifth Third Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 4	2607:f1c0:100... 2607:f1c0:100f:f000::227	8560 (ONEANDONE...) (ONEANDONE-AS Brauerstrasse 48)
13	95.100.70.38 95.100.70.38	16625 (AKAMAI-AS) (AKAMAI-AS)
3	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE)
4	2.18.232.23 2.18.232.23	16625 (AKAMAI-AS) (AKAMAI-AS)
2	54.154.151.160 54.154.151.160	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:825::2008	15169 (GOOGLE) (GOOGLE)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a02:26f0:6c0... 2a02:26f0:6c00:28c::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	95.100.78.166 95.100.78.166	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:81e::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2a05:f500:10:... 2a05:f500:10:101::b93f:9101	14413 (LINKEDIN) (LINKEDIN)
1	216.58.207.66 216.58.207.66	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	63.35.240.22 63.35.240.22	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	66.117.29.6 66.117.29.6	15224 (OMNITURE) (OMNITURE)
4 8	2a00:1450:400... 2a00:1450:4001:818::2002	15169 (GOOGLE) (GOOGLE)
4 8	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
1	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	15.188.105.205 15.188.105.205	16509 (AMAZON-02) (AMAZON-02)
65	25

4 2607:f1c0:100f:f000::227 (United States) 1 redirects

ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE)

promoimpresos.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 95.100.70.38 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-70-38.deploy.static.akamaitechnologies.com

www.53.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.232.23 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-23.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.154.151.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-151-160.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:28c::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.100.78.166 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a95-100-78-166.deploy.static.akamaitechnologies.com

img.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:10:101::b93f:9101 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.207.66 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s25-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.35.240.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-240-22.eu-west-1.compute.amazonaws.com

fifththird.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.6 (United States)

ASN15224 (OMNITURE, US)

fifththirdbank.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:818::2002 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 4 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.235.40 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.188.105.205 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

stms.53.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	53.com www.53.com stms.53.com	359 KB
8	google.de www.google.de	880 B
8	google.com 4 redirects www.google.com	2 KB
8	doubleclick.net 4 redirects googleads.g.doubleclick.net	7 KB
4	adobedtm.com assets.adobedtm.com	124 KB
4	promoimpresos.com 1 redirects promoimpresos.com	10 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	gstatic.com fonts.gstatic.com	44 KB
3	demdex.net dpm.demdex.net fifththird.demdex.net	2 KB
2	facebook.net connect.facebook.net	55 KB
2	addthis.com s7.addthis.com	189 KB
1	addthisedge.com v1.addthisedge.com	694 B
1	twitter.com analytics.twitter.com	651 B
1	moatads.com z.moatads.com	1 KB
1	omtrdc.net fifththirdbank.tt.omtrdc.net	355 B
1	everesttech.net 1 redirects cm.everesttech.net	527 B
1	t.co t.co	448 B
1	facebook.com www.facebook.com	361 B
1	googleadservices.com www.googleadservices.com	10 KB
1	en25.com img.en25.com	3 KB
1	licdn.com snap.licdn.com	2 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	28 KB
1	googleapis.com fonts.googleapis.com	972 B
65	24

	Domain	Requested by
13	www.53.com	promoimpresos.com
8	www.google.de	promoimpresos.com
8	www.google.com	4 redirects promoimpresos.com
8	googleads.g.doubleclick.net	4 redirects www.googleadservices.com
4	assets.adobedtm.com	www.53.com assets.adobedtm.com
4	promoimpresos.com	1 redirects promoimpresos.com
3	fonts.gstatic.com	promoimpresos.com
2	px.ads.linkedin.com	1 redirects promoimpresos.com
2	connect.facebook.net	assets.adobedtm.com connect.facebook.net
2	dpm.demdex.net	assets.adobedtm.com promoimpresos.com
2	s7.addthis.com	promoimpresos.com s7.addthis.com
1	stms.53.com	assets.adobedtm.com
1	v1.addthisedge.com	s7.addthis.com
1	analytics.twitter.com	static.ads-twitter.com
1	z.moatads.com	s7.addthis.com
1	fifththirdbank.tt.omtrdc.net	assets.adobedtm.com
1	cm.everesttech.net	1 redirects
1	fifththird.demdex.net	assets.adobedtm.com
1	t.co	promoimpresos.com
1	www.facebook.com	promoimpresos.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.linkedin.com	1 redirects
1	img.en25.com	promoimpresos.com
1	snap.licdn.com	assets.adobedtm.com
1	static.ads-twitter.com	assets.adobedtm.com
1	www.googletagmanager.com	assets.adobedtm.com
1	fonts.googleapis.com	promoimpresos.com
65	27

This site contains links to these domains. Also see Links.

Domain
www.53.com
locations.53.com
express.53.com
onlinebanking.53.com

Subject Issuer	Validity	Valid
*.promoimpresos.com Encryption Everywhere DV TLS CA - G1	`2020-01-28` - `2021-01-27`	a year	crt.sh
www.53.com DigiCert SHA2 Extended Validation Server CA	`2019-12-03` - `2021-01-30`	a year	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2019-08-14` - `2020-08-18`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-01-16` - `2020-04-15`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.en25.com DigiCert SHA2 Secure Server CA	`2019-06-21` - `2020-08-19`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-19` - `2020-11-25`	3 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-02-12` - `2020-05-06`	3 months	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2019-04-09` - `2020-04-01`	a year	crt.sh
stms.53.com DigiCert SHA2 High Assurance Server CA	`2019-08-25` - `2020-12-02`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://promoimpresos.com/modules/53/signin.php
Frame ID: 35AE8ACD96C1A5AB3A2DFC7199210D4A
Requests: 64 HTTP requests in this frame

Frame: https://fifththird.demdex.net/dest5.html?d_nsid=0
Frame ID: 5790887B14147F1728C6CE867C362DDE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://promoimpresos.com/modules/53/ HTTP 302
https://promoimpresos.com/modules/53/signin.php Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/etc\/designs\//i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Adobe DTM (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/assets.adobedtm.com\//i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Page Statistics

65
Requests

92 %
HTTPS

46 %
IPv6

24
Domains

27
Subdomains

25
IPs

6
Countries

839 kB
Transfer

2530 kB
Size

19
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.53.com/content/fifth-third/en.html
Title:

Search URL Search Domain Scan URL

URL: https://locations.53.com/search.html
Title: Branch & ATM Locator

Search URL Search Domain Scan URL

URL: https://express.53.com/portal/auth/login/Login
Title: Go To Login

Search URL Search Domain Scan URL

URL: https://onlinebanking.53.com/ib/#/forgotPassword
Title: Forgot Password

Search URL Search Domain Scan URL

URL: https://onlinebanking.53.com/ib/#/newUser
Title: Register

Search URL Search Domain Scan URL

URL: https://www.53.com/olb/auth/password-reset?execution=e2s1
Title: View Forgot User ID or Password to change User ID

Search URL Search Domain Scan URL

URL: http://www.53.com/
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://promoimpresos.com/modules/53/ HTTP 302
https://promoimpresos.com/modules/53/signin.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 30

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=93837&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&time=1582434132808 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D93837%26url%3Dhttps%253A%252F%252Fpromoimpresos.com%252Fmodules%252F53%252Fsignin.php%26time%3D1582434132808%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=93837&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&time=1582434132808&liSync=true

Request Chain 36

https://cm.everesttech.net/cm/dd?d_uuid=01978775982489802083931708236276420690 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XlIHVAAAAavZ0i3-

Request Chain 42

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/725123364/?random=1582434132898&cv=9&fst=1582434132898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/725123364/?random=1582434132898&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2745714261&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/725123364/?random=1582434132898&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2745714261&resp=GooglemKTybQhCsO&ipr=y

Request Chain 43

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/783154456/?random=1582434132899&cv=9&fst=1582434132899&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/783154456/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3774506015&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/783154456/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3774506015&resp=GooglemKTybQhCsO&ipr=y

Request Chain 44

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/854346853/?random=1582434132899&cv=9&fst=1582434132899&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/854346853/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2891704746&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/854346853/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2891704746&resp=GooglemKTybQhCsO&ipr=y

Request Chain 45

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/965699254/?random=1582434132899&cv=9&fst=1582434132899&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/965699254/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3407338957&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/965699254/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3407338957&resp=GooglemKTybQhCsO&ipr=y

65 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request signin.php Show response
promoimpresos.com/modules/53/
Redirect Chain

https://promoimpresos.com/modules/53/
https://promoimpresos.com/modules/53/signin.php

45 KB
10 KB

171ms
171ms

Document
text/html

2607:f1c0:100f:f000::227
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: https://promoimpresos.com/modules/53/signin.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2607:f1c0:100f:f000::227 , United States, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache / PHP/7.3.14
Resource Hash: 7d3151f6278b57e755f027e5eed5105a3ccee8f269a30c442652471031989302

Request headers

:method: GET
:authority: promoimpresos.com
:scheme: https
:path: /modules/53/signin.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: document

Response headers

status: 200
content-type: text/html; charset=UTF-8
date: Sun, 23 Feb 2020 05:02:11 GMT
server: Apache
x-powered-by: PHP/7.3.14
content-encoding: gzip

Redirect headers

status: 302
content-type: text/html; charset=UTF-8
content-length: 0
location: ./signin.php
date: Sun, 23 Feb 2020 05:02:10 GMT
server: Apache
x-powered-by: PHP/7.3.14

GET
H/1.1 200
OK style.css
www.53.com/etc/designs/fifth-third/static/css/ 671 KB
144 KB 1255ms
137ms Stylesheet
text/css 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/css/style.css

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

aeaacc45c96f98379ac9653c7e148dc4001915867474c4ad48aec506de3691d1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 20:14:50 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
X-Frame-Options: SAMEORIGIN
ETag: "a7c8e-59e7abdbc8280-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: no-cache="set-cookie"
Transfer-Encoding: chunked
Connection: keep-alive, Transfer-Encoding
Accept-Ranges: bytes

GET
H/1.1 200
OK cms.css
www.53.com/etc/designs/fifth-third/static/css/ 25 KB
6 KB 1246ms
124ms Stylesheet
text/css 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/css/cms.css

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

8c457198fd7227c836688be4d0c292b390ea899797c6111f909561733faed7a6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 21:43:27 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
X-Frame-Options: SAMEORIGIN
ETag: "642d-59e7bfaa77dc0-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Cache-Control: no-cache="set-cookie"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5301

GET
H2 200 init.js Show response
promoimpresos.com/etc/designs/fifth-third/static/dtm/ 0
93 B 177ms
177ms Script
text/html 2607:f1c0:100f:f000::227
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to

Full URL: https://promoimpresos.com/etc/designs/fifth-third/static/dtm/init.js
Requested by: Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2607:f1c0:100f:f000::227 , United States, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

status: 200
date: Sun, 23 Feb 2020 05:02:11 GMT
server: Apache
x-powered-by: PHP/7.3.14
content-length: 0
content-type: text/html;charset=utf-8

GET
H/1.1 200
OK init.js Show response
www.53.com/content/dam/fifth-third/dtm/ 564 B
1 KB 1252ms
131ms Script
application/javascript 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/content/dam/fifth-third/dtm/init.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

109cf1f166ba1e18734ca4a1d07e758e9d08abfab979578ffd0390c489c383ce

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 18:53:01 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
X-Frame-Options: SAMEORIGIN
ETag: "234-59e7999231d40-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: no-cache="set-cookie"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 315

GET
H/1.1 200
OK logo.svg
www.53.com/content/dam/fifth-third/brand/ 5 KB
3 KB 1257ms
136ms Image
image/svg+xml 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.53.com/content/dam/fifth-third/brand/logo.svg

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

617518a4c1f153f1cbcb09ac14a8b3f4be01fb80dd86159b6b02bbee52622ed3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
X-Frame-Options: SAMEORIGIN
ETag: "130b-59e7af220fc40-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: image/svg+xml
Cache-Control: no-cache="set-cookie"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1744

GET
H/1.1 200
OK 1440x565-Other-Service-Blur-1.jpg
www.53.com/content/dam/fifth-third/heroes/ 159 KB
160 KB 1261ms
130ms Image
image/jpeg 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.53.com/content/dam/fifth-third/heroes/1440x565-Other-Service-Blur-1.jpg

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

e6ec5655d511fe1df0f50192184d515a37187b51dc52af87f23d05127c34f171

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Last-Modified: Thu, 13 Feb 2020 20:38:09 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "27b5d-59e7b111f8e40"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: no-cache="set-cookie"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 162653

GET
H2 200 equal_housing_logo.png
promoimpresos.com/content/dam/fifth-third/brand/icons/ 0
93 B 174ms
173ms Image
text/html 2607:f1c0:100f:f000::227
ONEANDONE-AS Brau...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://promoimpresos.com/content/dam/fifth-third/brand/icons/equal_housing_logo.png
Requested by: Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2607:f1c0:100f:f000::227 , United States, ASN8560 (ONEANDONE-AS Brauerstrasse 48, DE),
Reverse DNS
Software: Apache / PHP/7.3.14
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

status: 200
date: Sun, 23 Feb 2020 05:02:12 GMT
server: Apache
x-powered-by: PHP/7.3.14
content-length: 0
content-type: text/html;charset=utf-8

GET patternlab-cbac3b32aafba1f75ada4e371e583304.js
www.53.com/etc/designs/fifth-third/static/js/ 0
0

GET
H/1.1 404
Not Found cms-11278ffb921fb992f4f5a3c60f0db785.js
www.53.com/etc/designs/fifth-third/static/js/ 0
0 139ms
139ms Script
text/html 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.53.com/etc/designs/fifth-third/static/js/cms-11278ffb921fb992f4f5a3c60f0db785.js
Requested by: Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-70-38.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 349 KB
113 KB 68ms
24ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Tue, 21 Jan 2020 20:57:37 GMT
server: nginx/1.15.8
etag: "5e2765c1-57446"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Sun, 23 Feb 2020 05:02:12 GMT
x-host: s7.addthis.com
content-length: 114924

GET
H/1.1 200
OK jquery.min.js Show response
www.53.com/etc/designs/fifth-third/static/js/ 85 KB
30 KB 238ms
236ms Script
application/javascript 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/js/jquery.min.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "15391-59e7af220fc40-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30313

GET
H/1.1 200
OK hogan-3.0.1.js Show response
www.53.com/etc/designs/fifth-third/static/js/ 21 KB
6 KB 131ms
130ms Script
application/javascript 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/js/hogan-3.0.1.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

addb3533e916dd02cef19d2d7bff683829d71dae7306fc18911c0f87d9f8cca0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "534a-59e7af220fc40-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5648

GET
H/1.1 200
OK ba-hashchange.min.js Show response
www.53.com/etc/designs/fifth-third/static/js/swiftype/ 3 KB
1 KB 119ms
118ms Script
application/javascript 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/js/swiftype/ba-hashchange.min.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

54c9af866a425ca417e72c98996d451f4a6cbdcd56ae83eab7f7260f393c85cd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "a02-59e7af220fc40-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1041

GET
H/1.1 200
OK autocomplete.js Show response
www.53.com/etc/designs/fifth-third/static/js/swiftype/ 17 KB
4 KB 130ms
129ms Script
application/javascript 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/js/swiftype/autocomplete.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

cc8862316d76b27ec5f6992e6d32547d03f096e97e6086814ff17eb27a96f422

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "4258-59e7af220fc40-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4162

GET
H/1.1 200
OK autocomplete.css
www.53.com/etc/designs/fifth-third/static/css/ 4 KB
2 KB 326ms
325ms Stylesheet
text/css 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/css/autocomplete.css

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

798db83db0d827e4e2a0b2d872d7b0220320fb95d30f6194c0dc8d6204fa1c0f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

Date: Sun, 23 Feb 2020 05:02:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "104a-59e7af220fc40-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1329

GET
H/1.1 200
OK search.css
www.53.com/etc/designs/fifth-third/static/css/ 3 KB
1 KB 122ms
121ms Stylesheet
text/css 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.53.com/etc/designs/fifth-third/static/css/search.css

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-70-38.deploy.static.akamaitechnologies.com

Software

Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3 /

Resource Hash

bf216c3c29cce1a81d8870c7d9fd4fbf71e14a2543d7cae07421539fc8363518

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,User-Agent
Last-Modified: Thu, 13 Feb 2020 20:29:29 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips Communique/4.2.3
ETag: "b12-59e7af220fc40-gzip"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 955

GET
H2 200 css
fonts.googleapis.com/ 12 KB
972 B 17ms
15ms Stylesheet
text/css 2a00:1450:4001:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4ec689fb73223cce87749ae1a79fdbe58e19938a4ff83ab42e19afafc0690257

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: style

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 23 Feb 2020 05:02:12 GMT
server: ESF
date: Sun, 23 Feb 2020 05:02:12 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 23 Feb 2020 05:02:12 GMT

GET
H2 200 launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js Show response
assets.adobedtm.com/ 410 KB
101 KB 92ms
30ms Script
application/x-javascript 2.18.232.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Requested by: Host: www.53.com
URL: https://www.53.com/content/dam/fifth-third/dtm/init.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: bf0cd4169d99b8649d2a6a07f0baa94ac233178e72fe01652046ad3a8c2701e9

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
last-modified: Tue, 18 Feb 2020 21:17:33 GMT
server: AkamaiNetStorage
etag: "178832b733c6947acc22541c19031198:1582060653.374179"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
timing-allow-origin: *
content-length: 102895
expires: Sun, 23 Feb 2020 05:02:12 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 647 B
1 KB 122ms
32ms XHR
application/json 54.154.151.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.5.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=CBBDCBC1557213FE7F000101%40AdobeOrg&d_nsid=0&ts=1582434132731

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-151-160.eu-west-1.compute.amazonaws.com

Software

Resource Hash

6c72acd626808dd42bf5b8bf9e62ad1e8254774756436200f6b0caf9913357b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
Origin: https://promoimpresos.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v062-05824042e.edge-irl1.demdex.com 5.65.0.20200212140016 2ms (+2ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: JTKUXDHUR0o=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://promoimpresos.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 413
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/ 36 KB
13 KB 31ms
30ms Script
application/x-javascript 2.18.232.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7c9cecd10e7ebe0bd54d4c544d872270d4148922ee896d2ad404dc791ad0ef3a

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
last-modified: Wed, 13 Nov 2019 18:34:43 GMT
server: AkamaiNetStorage
etag: "d6e076e7d6ae0d567c0f611bee8f9855:1573670083.361234"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 13335
expires: Sun, 23 Feb 2020 06:02:12 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 18ms
17ms Script
application/javascript 2a00:1450:4001:825::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-983180037

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a9be2f5458ec32ec0608d884db77db96072cf19559dfc8ac84c8393716401b07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28494
x-xss-protection: 0
last-modified: Sun, 23 Feb 2020 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 23 Feb 2020 05:02:12 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 63ms
21ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
age: 74876
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1954
x-served-by: cache-fra19170-FRA
last-modified: Tue, 23 Jan 2018 20:09:00 GMT
x-timer: S1582434133.827750,VS0,VE0
etag: "b7b33882a4f3ffd5cbf07434f3137166+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 126 KB
31 KB 17ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 30466
x-xss-protection: 0
pragma: public
x-fb-debug: rv1SExxuygeqrxbSPYsonZLvJ+hrW0CWnoUcpZFGRHegz2X5jAdr6I3VyqWxqGTxdI4llxRvy+aHlBQAT1APlQ==
x-fb-trip-id: 420120009
date: Sun, 23 Feb 2020 05:02:12 GMT, Sun, 23 Feb 2020 05:02:12 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 21ms
7ms Script
application/x-javascript 2a02:26f0:6c00:28c::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=20762
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H/1.1 200
OK elqCfg.min.js Show response
img.en25.com/i/ 6 KB
3 KB 81ms
25ms Script
application/x-javascript 95.100.78.166
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img.en25.com/i/elqCfg.min.js

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

95.100.78.166 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a95-100-78-166.deploy.static.akamaitechnologies.com

Software

Resource Hash

6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 22 Jan 2020 17:21:27 GMT
ETag: "164336148d1d51:0"
Vary: Accept-Encoding
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-cache, no-store
Date: Sun, 23 Feb 2020 05:02:12 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 2115
Expires: Sun, 23 Feb 2020 05:02:12 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v17/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700
Origin: https://promoimpresos.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 01 Feb 2020 00:05:18 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:45 GMT
server: sffe
age: 1918614
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14380
x-xss-protection: 0
expires: Sun, 31 Jan 2021 00:05:18 GMT

GET icomoon.ttf
www.53.com/etc/designs/fifth-third/static/fonts/ 0
0

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v17/ 15 KB
15 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700
Origin: https://promoimpresos.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sat, 01 Feb 2020 19:32:30 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:57 GMT
server: sffe
age: 1848582
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 15056
x-xss-protection: 0
expires: Sun, 31 Jan 2021 19:32:30 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOUuhp.woff2
fonts.gstatic.com/s/opensans/v17/ 15 KB
15 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UNirkOUuhp.woff2

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/css?family=Open+Sans:300,400,400i,600,700
Origin: https://promoimpresos.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Wed, 05 Feb 2020 01:07:45 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:31:11 GMT
server: sffe
age: 1569267
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14880
x-xss-protection: 0
expires: Thu, 04 Feb 2021 01:07:45 GMT

GET patternlab-cbac3b32aafba1f75ada4e371e583304.js
www.53.com/etc/designs/fifth-third/static/js/ 0
0

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=93837&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&time=1582434132808
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D93837%26url%3Dhttps%253A%252F%252Fpromoimpresos.com%252Fmodules%252F53%252Fsignin...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=93837&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&time=1582434132808&liSync=true

0
80 B

165ms
164ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=93837&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&time=1582434132808&liSync=true
Requested by: Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

date: Sun, 23 Feb 2020 05:02:13 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: 08WTx3Xv9RWwlav2/CoAAA==

Redirect headers

date: Sun, 23 Feb 2020 05:02:13 GMT
x-content-type-options: nosniff
linkedin-action: 1
status: 302
strict-transport-security: max-age=2592000
content-length: 0
x-li-uuid: hcsSvXXv9RWQhxXkNSsAAA==
server: Play
pragma: no-cache
x-li-pop: prod-efr5
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=93837&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&time=1582434132808&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 1221502774554360 Show response
connect.facebook.net/signals/config/ 100 KB
25 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1221502774554360?v=2.9.15&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

701e23a734ad1e00f39505c976c284ec29c820cf6ecab8fa8e68f423c19a8396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-24=":443"; ma=3600
content-length: 25012
x-xss-protection: 0
pragma: public
x-fb-debug: cOxVySfbeV8ykePyF+viHO2F9F21Wy5hcxwDbL25Gz6QXYCERgF2HiSO2LaJ2u+Xg/uIIqzjWN6rGqfTInycGQ==
x-fb-trip-id: 420120009
date: Sun, 23 Feb 2020 05:02:12 GMT, Sun, 23 Feb 2020 05:02:12 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 26 KB
10 KB 67ms
29ms Script
text/javascript 216.58.207.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-983180037

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.207.66 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s25-in-f2.1e100.net

Software

cafe /

Resource Hash

e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 9478280665056484852
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 23 Feb 2020 05:02:12 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
361 B 17ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1221502774554360&ev=PageView&dl=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&rl=&if=false&ts=1582434132838&sw=1600&sh=1200&v=2.9.15&r=stable&ec=0&o=28&fbp=fb.1.1582434132837.1173951722&it=1582434132817&coo=false&rqm=GET

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sun, 23 Feb 2020 05:02:12 GMT, Sun, 23 Feb 2020 05:02:12 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-24=":443"; ma=3600
content-length: 44
expires: Sun, 23 Feb 2020 05:02:12 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 177ms
139ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ny99k&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

date: Sun, 23 Feb 2020 05:02:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=0
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Sun, 23 Feb 2020 05:02:12 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: ba3882627be09adef28eb98886ceefb6
x-transaction: 00bde68600be90aa
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK Cookie set dest5.html
fifththird.demdex.net/ Frame 5790 0
0 140ms
32ms Document
text/html 63.35.240.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://fifththird.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.35.240.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-35-240-22.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: fifththird.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://promoimpresos.com/modules/53/signin.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=01978775982489802083931708236276420690
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: iframe
Referer: https://promoimpresos.com/modules/53/signin.php

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Fri, 21 Feb 2020 14:08:01 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=01978775982489802083931708236276420690;Path=/;Domain=.demdex.net;Expires=Fri, 21-Aug-2020 05:02:12 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: FYL79jyURJM=
Content-Length: 2785
Connection: keep-alive

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=XlIHVAAAAavZ0i3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=01978775982489802083931708236276420690
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XlIHVAAAAavZ0i3-

42 B
915 B

31ms
31ms

Image
image/gif

54.154.151.160
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=XlIHVAAAAavZ0i3-

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-151-160.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

DCS: dcs-prod-irl1-v062-049952d0c.edge-irl1.demdex.com 5.65.0.20200212140016 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: 1RJ5PZDITL0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Sun, 23 Feb 2020 05:02:12 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XlIHVAAAAavZ0i3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 json Show response
fifththirdbank.tt.omtrdc.net/m2/fifththirdbank/mbox/ 96 B
355 B 131ms
69ms XHR
application/json 66.117.29.6
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://fifththirdbank.tt.omtrdc.net/m2/fifththirdbank/mbox/json?mbox=target-global-mbox&mboxSession=08f4230c6b23481fa2470fd03cf98d01&mboxPC=&mboxPage=9a53ca26524a405db63098893ff2684c&mboxRid=08faea0ae42c45c5a6ebd40f3da265ea&mboxVersion=1.7.0&mboxCount=1&mboxTime=1582437732768&mboxHost=promoimpresos.com&mboxURL=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&mboxReferrer=&browserHeight=1200&browserWidth=1585&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=1F3372A3591B0B6D-63F3948D7D6A4E1F&mboxMCGVID=01939998302942705943935586141653535776&mboxAAMB=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&mboxMCGLH=6
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.117.29.6 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: /
Resource Hash: 0081046e8a7bfce20731ef69089a543f999c338564f8719d0ae2e25f035ba28b

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
Origin: https://promoimpresos.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
status: 200
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://promoimpresos.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 96
x-request-id: 08faea0ae42c45c5a6ebd40f3da265ea

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/983180037/ 2 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/983180037/?random=1582434132896&cv=9&fst=1582434132896&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2db1fbe1d93bac32e9f629216ab0a0f8a4f9dc9d83f20cc26efc6d078278845a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1046
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/787644850/ 2 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/787644850/?random=1582434132898&cv=9&fst=1582434132898&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e632005c83c78ac70639baa5584b2d2a88f7425e295fe6ec2191afe157ebd376

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1046
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/847447334/ 2 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/847447334/?random=1582434132899&cv=9&fst=1582434132899&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfbe4a28302a16ae24ab5a60eb2662400dabacb67d6036eb1c0f9f66235dbeaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1043
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/936762750/ 2 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:818::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/936762750/?random=1582434132900&cv=9&fst=1582434132900&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28555ab9a4944f9c1172909bc6989272b95bae00dfe04c3913a7572934cbb171

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1044
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/725123364/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/725123364/?random=1582434132898&cv=9&fst=1582434132898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/725123364/?random=1582434132898&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/725123364/?random=1582434132898&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

19ms
19ms

Image
image/gif

2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/725123364/?random=1582434132898&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2745714261&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/725123364/?random=1582434132898&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2745714261&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/783154456/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/783154456/?random=1582434132899&cv=9&fst=1582434132899&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/783154456/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/783154456/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

18ms
18ms

Image
image/gif

2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/783154456/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3774506015&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/783154456/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3774506015&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/854346853/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/854346853/?random=1582434132899&cv=9&fst=1582434132899&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/854346853/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/854346853/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

18ms
18ms

Image
image/gif

2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/854346853/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2891704746&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/854346853/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=2891704746&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/965699254/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/965699254/?random=1582434132899&cv=9&fst=1582434132899&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/965699254/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/965699254/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

18ms
18ms

Image
image/gif

2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/965699254/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3407338957&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/965699254/?random=1582434132899&cv=9&fst=1582434000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&is_vtc=1&random=3407338957&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/983180037/ 42 B
119 B 20ms
19ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/983180037/?random=1582434132896&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=2083782937&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/983180037/ 42 B
110 B 19ms
19ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/983180037/?random=1582434132896&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=2083782937&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/787644850/ 42 B
119 B 19ms
18ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/787644850/?random=1582434132898&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=3874570506&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/787644850/ 42 B
110 B 19ms
18ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/787644850/?random=1582434132898&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=3874570506&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/847447334/ 42 B
119 B 20ms
20ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/847447334/?random=1582434132899&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=2002121916&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/847447334/ 42 B
110 B 19ms
19ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/847447334/?random=1582434132899&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=2002121916&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/936762750/ 42 B
119 B 17ms
17ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/936762750/?random=1582434132900&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=3330573283&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/936762750/ 42 B
110 B 19ms
19ms Image
image/gif 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/936762750/?random=1582434132900&cv=9&fst=1582434000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&tiba=Login%20%7C%20Fifth%20Third%20Bank&async=1&fmt=3&is_vtc=1&random=3330573283&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Sun, 23 Feb 2020 05:02:12 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET en.html
www.53.com/content/fifth-third/ 0
0

GET
H/1.1 404
Not Found cms-11278ffb921fb992f4f5a3c60f0db785.js
www.53.com/etc/designs/fifth-third/static/js/ 0
0 130ms
130ms Script
text/html 95.100.70.38
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.53.com/etc/designs/fifth-third/static/js/cms-11278ffb921fb992f4f5a3c60f0db785.js
Requested by: Host: promoimpresos.com
URL: https://promoimpresos.com/modules/53/signin.php
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.100.70.38 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-100-70-38.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

GET icomoon.woff
www.53.com/etc/designs/fifth-third/static/fonts/ 0
0

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/ 25 KB
9 KB 30ms
30ms Script
application/x-javascript 2.18.232.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 19742d915958a7525879a20699efdda3cb8214cf7eaf07c18a0fffaf12c71b63

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:13 GMT
content-encoding: gzip
last-modified: Wed, 13 Nov 2019 18:34:43 GMT
server: AkamaiNetStorage
etag: "46e2aa1bef425becb0cb4651c23fff38:1573670083.753497"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8769
expires: Sun, 23 Feb 2020 06:02:13 GMT

GET
H/1.1 200
OK moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 88ms
29ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

Date: Sun, 23 Feb 2020 05:02:13 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 Nov 2019 20:13:52 GMT
Server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
ETag: "f14b4e1f799b14f798a195f43cf58376"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=22437
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 RCaac05d6061834e998c7762867e58c1f4-source.min.js Show response
assets.adobedtm.com/cadf1530cead/3d6f9db110e0/73c0e5f74a8d/ 1 KB
813 B 31ms
31ms Script
application/x-javascript 2.18.232.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/cadf1530cead/3d6f9db110e0/73c0e5f74a8d/RCaac05d6061834e998c7762867e58c1f4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENf0bbb7156e514ac9ac6520d4cb47577a-staging.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-23.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7b229438555764b5955549ed5740f7b26e3f15020cd470eb3b189699aeee733b

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:13 GMT
content-encoding: gzip
last-modified: Tue, 18 Feb 2020 21:17:34 GMT
server: AkamaiNetStorage
etag: "44c5b4f2c3515e775e3a7ba3f5eb19bb:1582060654.670763"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 567
expires: Sun, 23 Feb 2020 06:02:13 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 176ms
133ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=ny99k&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 112
pragma: no-cache
last-modified: Sun, 23 Feb 2020 05:02:13 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 39bf119f20e646bc278569c68b3c1109
x-transaction: 00205aa20060fb75
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-57fbbf0f65d1f6cb/ 1 KB
694 B 192ms
191ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-57fbbf0f65d1f6cb/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5acfc48a41239342182d717cae97a3f2eeaadc65de5197a453d9c22916a6d2e8

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

date: Sun, 23 Feb 2020 05:02:13 GMT
content-encoding: gzip
etag: 823650384--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=59, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 519

GET
H2 200 s13011321182980 Show response
stms.53.com/b/ss/fifththirdbankdev/10/JS-2.17.0-LAQ5/ 445 B
893 B 153ms
58ms Script
application/x-javascript 15.188.105.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://stms.53.com/b/ss/fifththirdbankdev/10/JS-2.17.0-LAQ5/s13011321182980?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=23%2F1%2F2020%206%3A2%3A13%200%20-60&d.&nsid=0&jsonv=1&.d&sdid=1F3372A3591B0B6D-63F3948D7D6A4E1F&mid=01939998302942705943935586141653535776&aamlh=6&ce=UTF-8&pageName=fifth%20third%20bank%20%7C%20modules%20%7C%2053%20%7C%20signin.php&g=promoimpresos.com%2Fmodules%2F53%2Fsignin.php&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c2=fifth%20third%20bank%20%7C%20modules%20%7C%2053%20%7C%20signin.php&v2=fifth%20third%20bank%20%7C%20modules%20%7C%2053%20%7C%20signin.php&c40=https%3A%2F%2Fpromoimpresos.com%2Fmodules%2F53%2Fsignin.php&v40=promoimpresos.com%2Fmodules%2F53%2Fsignin.php&c64=1&v64=New&c65=2.2&c66=First%20Visit&c67=%7Cundefined%7Cundefined&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=CBBDCBC1557213FE7F000101%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP5e9ec493dfa0465eaa797b523b09d3f7/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

10427737569704e958cf1b37cd9e38915e7f3390bbb90b38697e127f37ed752b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

x-aam-tid: GjK9/My+TQc=
date: Sun, 23 Feb 2020 05:02:13 GMT
x-content-type-options: nosniff
x-c: master-1169.Ie4359b.M0-349
p3p: CP="This is not a P3P policy"
status: 200
content-length: 445
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-v062-0c31125cd.edge-irl1.demdex.com 5.65.0.20200212140016 5ms (+0ms)
pragma: no-cache
last-modified: Mon, 24 Feb 2020 05:02:13 GMT
server: jag
xserver: anedge-5bb688c676-tz97r
etag: 3398251424739852288-4614825701338755092
vary: *
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sat, 22 Feb 2020 05:02:13 GMT

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 24ms
24ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://promoimpresos.com/modules/53/signin.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36 Edg/80.0.361.50
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Sun, 23 Feb 2020 05:02:13 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.53.com
URL: https://www.53.com/etc/designs/fifth-third/static/js/patternlab-cbac3b32aafba1f75ada4e371e583304.js

Domain: www.53.com
URL: https://www.53.com/etc/designs/fifth-third/static/fonts/icomoon.ttf

Domain: www.53.com
URL: https://www.53.com/etc/designs/fifth-third/static/js/patternlab-cbac3b32aafba1f75ada4e371e583304.js

Domain: www.53.com
URL: http://www.53.com/content/fifth-third/en.html

Domain: www.53.com
URL: https://www.53.com/etc/designs/fifth-third/static/fonts/icomoon.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fifth Third Bank (Banking)

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-19 11:53:06	Name: dextp Value: 903-1-1582434133043\|275754-1-1582434133143
.promoimpresos.com/	1970-01-20 09:50:42	Name: s_lv Value: 1582434133184
.promoimpresos.com/	1970-01-19 07:33:55	Name: gpv Value: fifth%20third%20bank%20%7C%20modules%20%7C%2053%20%7C%20signin.php
.promoimpresos.com/	1970-01-19 08:17:06	Name: s_getNewRepeat Value: 1582434133183-New
.promoimpresos.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.promoimpresos.com/	1970-01-19 07:33:55	Name: s_invisit Value: true
.promoimpresos.com/	1970-01-19 09:43:30	Name: _gcl_au Value: 1.1.2062171818.1582434133
.promoimpresos.com/	1970-01-20 01:06:32	Name: AMCV_CBBDCBC1557213FE7F000101%40AdobeOrg Value: -432600572%7CMCIDTS%7C18316%7CMCMID%7C01939998302942705943935586141653535776%7CMCAAMLH-1583038932%7C6%7CMCAAMB-1583038932%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1582441332s%7CNONE%7CMCSYNCSOP%7C411-18323%7CvVersion%7C4.5.2
.promoimpresos.com/	1970-01-19 16:19:30	Name: s_vnum Value: 1613970133182%26vn%3D1
.promoimpresos.com/	1969-12-31 23:59:59	Name: s_ppvl Value: %5B%5BB%5D%5D
.demdex.net/	1970-01-19 11:53:06	Name: demdex Value: 01978775982489802083931708236276420690
.promoimpresos.com/	1969-12-31 23:59:59	Name: s_ppv Value: fifth%2520third%2520bank%2520%257C%2520modules%2520%257C%252053%2520%257C%2520signin.php%2C90%2C0%2C0%2C1600%2C1200%2C1600%2C1200%2C1%2CL
.promoimpresos.com/	1970-01-19 09:43:30	Name: _fbp Value: fb.1.1582434132837.1173951722
promoimpresos.com/	1970-01-19 17:01:15	Name: __atuvc Value: 1%7C9
.promoimpresos.com/	1969-12-31 23:59:59	Name: AMCVS_CBBDCBC1557213FE7F000101%40AdobeOrg Value: 1
.promoimpresos.com/	1970-01-20 01:07:58	Name: mbox Value: session#08f4230c6b23481fa2470fd03cf98d01#1582435994\|PC#08f4230c6b23481fa2470fd03cf98d01.26_0#1645678934
.promoimpresos.com/	1970-01-19 07:33:55	Name: s_lv_s Value: First%20Visit
promoimpresos.com/	1970-01-19 07:33:55	Name: __atuvs Value: 5e52075594b87278000
.promoimpresos.com/	1969-12-31 23:59:59	Name: check Value: true

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.53.com/content/dam/fifth-third/dtm/init.js(Line 12) Message: STAGE DTM
console-api	log	(Line 10) Message: Eloqua Fired

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.twitter.com
assets.adobedtm.com
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
fifththird.demdex.net
fifththirdbank.tt.omtrdc.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
img.en25.com
promoimpresos.com
px.ads.linkedin.com
s7.addthis.com
snap.licdn.com
static.ads-twitter.com
stms.53.com
t.co
v1.addthisedge.com
www.53.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
z.moatads.com
www.53.com
104.244.42.195
104.244.42.5
15.188.105.205
151.101.12.157
2.18.232.23
2.18.235.40
216.58.207.66
23.210.248.44
2607:f1c0:100f:f000::227
2a00:1450:4001:808::2004
2a00:1450:4001:818::2002
2a00:1450:4001:819::2003
2a00:1450:4001:81e::2003
2a00:1450:4001:81f::200a
2a00:1450:4001:825::2008
2a02:26f0:6c00:28c::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:10:101::b93f:9101
2a05:f500:11:101::b93f:9005
54.154.151.160
63.35.240.22
66.117.28.86
66.117.29.6
95.100.70.38
95.100.78.166
0081046e8a7bfce20731ef69089a543f999c338564f8719d0ae2e25f035ba28b
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
10427737569704e958cf1b37cd9e38915e7f3390bbb90b38697e127f37ed752b
109cf1f166ba1e18734ca4a1d07e758e9d08abfab979578ffd0390c489c383ce
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1491de1b31182d38593bcf660c99bc6018af8e192d91663f67ec9d045a3b5ccc
19742d915958a7525879a20699efdda3cb8214cf7eaf07c18a0fffaf12c71b63
28555ab9a4944f9c1172909bc6989272b95bae00dfe04c3913a7572934cbb171
2db1fbe1d93bac32e9f629216ab0a0f8a4f9dc9d83f20cc26efc6d078278845a
319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
4ec689fb73223cce87749ae1a79fdbe58e19938a4ff83ab42e19afafc0690257
4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de
54c9af866a425ca417e72c98996d451f4a6cbdcd56ae83eab7f7260f393c85cd
5a91c6d3e635c0bd1551a53cf0769328132151a7732039170280d500dbcb4685
5acfc48a41239342182d717cae97a3f2eeaadc65de5197a453d9c22916a6d2e8
617518a4c1f153f1cbcb09ac14a8b3f4be01fb80dd86159b6b02bbee52622ed3
6b4ebd6049c806e3eef1bd770b2d8b4fdd75803861ead3584ee753e41988efae
6c72acd626808dd42bf5b8bf9e62ad1e8254774756436200f6b0caf9913357b1
701e23a734ad1e00f39505c976c284ec29c820cf6ecab8fa8e68f423c19a8396
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
798db83db0d827e4e2a0b2d872d7b0220320fb95d30f6194c0dc8d6204fa1c0f
7b229438555764b5955549ed5740f7b26e3f15020cd470eb3b189699aeee733b
7c9cecd10e7ebe0bd54d4c544d872270d4148922ee896d2ad404dc791ad0ef3a
7d3151f6278b57e755f027e5eed5105a3ccee8f269a30c442652471031989302
8c457198fd7227c836688be4d0c292b390ea899797c6111f909561733faed7a6
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
a9be2f5458ec32ec0608d884db77db96072cf19559dfc8ac84c8393716401b07
ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
addb3533e916dd02cef19d2d7bff683829d71dae7306fc18911c0f87d9f8cca0
aeaacc45c96f98379ac9653c7e148dc4001915867474c4ad48aec506de3691d1
bf0cd4169d99b8649d2a6a07f0baa94ac233178e72fe01652046ad3a8c2701e9
bf216c3c29cce1a81d8870c7d9fd4fbf71e14a2543d7cae07421539fc8363518
bfbe4a28302a16ae24ab5a60eb2662400dabacb67d6036eb1c0f9f66235dbeaa
cc8862316d76b27ec5f6992e6d32547d03f096e97e6086814ff17eb27a96f422
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e613df9aa843851d019cc12e6184972311e2229c14299d2f6c80f4aadf2d844a
e632005c83c78ac70639baa5584b2d2a88f7425e295fe6ec2191afe157ebd376
e6ec5655d511fe1df0f50192184d515a37187b51dc52af87f23d05127c34f171
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

promoimpresos.com Open in urlscan Pro 2607:f1c0:100f:f000::227 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

65 Requests

92 %HTTPS

46 %IPv6

24 Domains

27 Subdomains

25 IPs

6 Countries

839 kBTransfer

2530 kBSize

19 Cookies

7 Outgoing links

Page URL History

Redirected requests

65 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

promoimpresos.com Open in urlscan Pro
2607:f1c0:100f:f000::227 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

65
Requests

92 %
HTTPS

46 %
IPv6

24
Domains

27
Subdomains

25
IPs

6
Countries

839 kB
Transfer

2530 kB
Size

19
Cookies

65 HTTP transactions
0 data transactions