khsgdkajwuqwmas.top Open in urlscan Pro
162.0.211.207 Malicious Activity! Public Scan

URL:
https://khsgdkajwuqwmas.top/
Submission: On March 06 via manual (March 6th 2021, 5:39:34 am UTC) from JP

Summary HTTP 90 Redirects Behaviour Indicators

Summary

This website contacted 29 IPs in 6 countries across 15 domains to perform 90 HTTP transactions. The main IP is 162.0.211.207, located in United States and belongs to NAMECHEAP-NET, US. The main domain is khsgdkajwuqwmas.top.
TLS certificate: Issued by R3 on March 5th 2021. Valid for: 3 months.

This is the only time khsgdkajwuqwmas.top was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aplus (Shinsei Bank) (Financial)

Domain & IP information

	IP Address	AS Autonomous System
30	162.0.211.207 162.0.211.207	22612 (NAMECHEAP...) (NAMECHEAP-NET)
3	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
1	184.30.216.191 184.30.216.191	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:170... 2a02:26f0:1700:7::17d5:a1d8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
4	182.22.16.123 182.22.16.123	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1 6	52.199.29.254 52.199.29.254	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0c::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
2	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1 2	142.250.186.166 142.250.186.166	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:170... 2a02:26f0:1700:7::17d5:a1ca	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.192.216.245 52.192.216.245	16509 (AMAZON-02) (AMAZON-02)
1	34.102.249.189 34.102.249.189	15169 (GOOGLE) (GOOGLE)
1	2600:1901:0:8... 2600:1901:0:835b::	15169 (GOOGLE) (GOOGLE)
3	34.120.216.28 34.120.216.28	15169 (GOOGLE) (GOOGLE)
1	34.120.190.172 34.120.190.172	15169 (GOOGLE) (GOOGLE)
1	2600:1901:0:b... 2600:1901:0:b6a9::	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1 2	182.22.89.248 182.22.89.248	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
1	104.244.42.131 104.244.42.131	13414 (TWITTER) (TWITTER)
1 2	34.249.128.36 34.249.128.36	16509 (AMAZON-02) (AMAZON-02)
2 2	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2 2	54.154.164.132 54.154.164.132	16509 (AMAZON-02) (AMAZON-02)
90	29

30 162.0.211.207 (United States)

ASN22612 (NAMECHEAP-NET, US)

khsgdkajwuqwmas.top	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.216.191 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-30-216-191.deploy.static.akamaitechnologies.com

rt.rtoaster.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:1700:7::17d5:a1d8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

dmp.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 182.22.16.123 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

s.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b92.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.199.29.254 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)

sync.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0c::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net

8731124.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:7::17d5:a1ca (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cf.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.192.216.245 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)

score.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.249.189 (Kansas City, United States)

ASN15169 (GOOGLE, US)

open.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:835b:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

atb.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.120.216.28 (Kansas City, United States)

ASN15169 (GOOGLE, US)

atm.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.190.172 (Kansas City, United States)

ASN15169 (GOOGLE, US)

b.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:b6a9:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

b6.im-apps.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 182.22.89.248 (Japan) 1 redirects

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

yjtag.yahoo.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.131 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.249.128.36 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::1c (France) 2 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.154.164.132 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-164-132.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	khsgdkajwuqwmas.top khsgdkajwuqwmas.top	88 KB
18	im-apps.net 1 redirects dmp.im-apps.net sync.im-apps.net cf.im-apps.net score.im-apps.net open.im-apps.net atb.im-apps.net atm.im-apps.net b.im-apps.net b6.im-apps.net	33 KB
11	doubleclick.net 2 redirects stats.g.doubleclick.net 8731124.fls.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	10 KB
9	google.de www.google.de adservice.google.de	2 KB
9	google.com www.google.com adservice.google.com	2 KB
4	yahoo.co.jp 1 redirects yjtag.yahoo.co.jp b92.yahoo.co.jp	3 KB
3	google-analytics.com www.google-analytics.com	19 KB
3	googletagmanager.com www.googletagmanager.com	147 KB
2	adsrvr.org 2 redirects match.adsrvr.org	911 B
2	criteo.com 2 redirects gum.criteo.com	731 B
2	demdex.net 1 redirects dpm.demdex.net	2 KB
2	googleadservices.com www.googleadservices.com	25 KB
2	yimg.jp s.yimg.jp	14 KB
1	twitter.com analytics.twitter.com	575 B
1	rtoaster.jp rt.rtoaster.jp
90	15

	Domain	Requested by
30	khsgdkajwuqwmas.top	khsgdkajwuqwmas.top
8	www.google.de	khsgdkajwuqwmas.top
8	www.google.com	khsgdkajwuqwmas.top
6	googleads.g.doubleclick.net	www.googleadservices.com
6	sync.im-apps.net	1 redirects dmp.im-apps.net cf.im-apps.net
3	atm.im-apps.net	khsgdkajwuqwmas.top
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	www.googletagmanager.com	khsgdkajwuqwmas.top dmp.im-apps.net
2	b92.yahoo.co.jp	s.yimg.jp
2	match.adsrvr.org	2 redirects
2	gum.criteo.com	2 redirects
2	dpm.demdex.net	1 redirects cf.im-apps.net
2	yjtag.yahoo.co.jp	1 redirects cf.im-apps.net
2	score.im-apps.net	khsgdkajwuqwmas.top
2	8731124.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.googleadservices.com	www.googletagmanager.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	s.yimg.jp	www.googletagmanager.com
2	dmp.im-apps.net	khsgdkajwuqwmas.top
1	analytics.twitter.com	cf.im-apps.net
1	cm.g.doubleclick.net	1 redirects
1	adservice.google.de	adservice.google.com
1	adservice.google.com	8731124.fls.doubleclick.net
1	b6.im-apps.net	khsgdkajwuqwmas.top
1	b.im-apps.net	khsgdkajwuqwmas.top
1	atb.im-apps.net	khsgdkajwuqwmas.top
1	open.im-apps.net	khsgdkajwuqwmas.top
1	cf.im-apps.net	khsgdkajwuqwmas.top
1	rt.rtoaster.jp	khsgdkajwuqwmas.top
90	29

This site contains no links.

Subject Issuer	Validity	Valid
apisuoc.top R3	`2021-03-05` - `2021-06-03`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
rt.rtoaster.jp DigiCert SHA2 Secure Server CA	`2021-01-13` - `2022-01-18`	a year	crt.sh
*.im-apps.net DigiCert Secure Site ECC CA-1	`2020-05-05` - `2021-08-04`	a year	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2021-02-10` - `2022-03-09`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
open.im-apps.net GTS CA 1D2	`2021-02-03` - `2021-05-04`	3 months	crt.sh
atb.im-apps.net GTS CA 1D2	`2021-01-12` - `2021-04-12`	3 months	crt.sh
atm.im-apps.net GTS CA 1D2	`2021-03-01` - `2021-05-30`	3 months	crt.sh
b.im-apps.net GTS CA 1D2	`2021-03-01` - `2021-05-30`	3 months	crt.sh
b6.im-apps.net GTS CA 1D2	`2021-01-23` - `2021-04-23`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
yjtag.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2020-10-04` - `2021-11-04`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.googleadservices.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://khsgdkajwuqwmas.top/
Frame ID: 7AF25649615291B080870564D13E886B
Requests: 79 HTTP requests in this frame

Frame: https://8731124.fls.doubleclick.net/activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F
Frame ID: B4844A81B393E9A140F94482EA5FEAC7
Requests: 1 HTTP requests in this frame

Frame: https://cf.im-apps.net/imid/beacon.html
Frame ID: D39691B2BEF80116BFFF11798A9BAFBD
Requests: 8 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F
Frame ID: BD35CC50E64AC29815FD94B9B0C8463B
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F
Frame ID: 526D43ED3A35D66F2B0BBDABD9E6E99C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

90
Requests

67 %
HTTPS

53 %
IPv6

15
Domains

29
Subdomains

29
IPs

6
Countries

342 kB
Transfer

946 kB
Size

13
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 45

https://8731124.fls.doubleclick.net/activityi;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F HTTP 302
https://8731124.fls.doubleclick.net/activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F

Request Chain 70

https://cm.g.doubleclick.net/pixel?google_nid=intimatemerger_dmp&google_cm HTTP 302
https://sync.im-apps.net/imid/set?cid=5660&tid=gid&uid=CAESEK-28To5Rw8Of8zM7ue-V-U&google_cver=1

Request Chain 71

https://yjtag.yahoo.co.jp/csx?tp=wAiXPd0 HTTP 302
https://sync.im-apps.net/imid/redirect?gdpr=1&cid=8144&tid=yid&uidpfx=%26uid%3D&url=https%3A%2F%2Fyjtag.yahoo.co.jp%2Fcs%3Fbtt%3DQMa8KRbM65bSYvMuD9axVhbtEKfAZrTvk8B-1kZargc%26tp%3DwAiXPd0 HTTP 302
https://yjtag.yahoo.co.jp/cs?btt=QMa8KRbM65bSYvMuD9axVhbtEKfAZrTvk8B-1kZargc&tp=wAiXPd0&uid=erzrRIyoQ5yJc4TzGqST-g&gdpr=1

Request Chain 73

https://dpm.demdex.net/ibs:dpid=14701&dpuuid=erzrRIyoQ5yJc4TzGqST-g HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=14701&dpuuid=erzrRIyoQ5yJc4TzGqST-g

Request Chain 74

https://gum.criteo.com/sync?c=263&r=1&a=1&u=https%3A%2F%2Fsync.im-apps.net%2Fimid%2Fset%3Fcid%3D1000531%26tid%3Dgid%26uid%3D%40USERID%40 HTTP 302
https://gum.criteo.com/sync?s=1&c=263&r=1&a=1&u=https%3A%2F%2Fsync.im-apps.net%2Fimid%2Fset%3Fcid%3D1000531%26tid%3Dgid%26uid%3D%40USERID%40 HTTP 302
https://sync.im-apps.net/imid/set?cid=1000531&tid=gid&uid=R7tgeXdbiHw--bar4tJi-6Iz4NDbws5i

Request Chain 75

https://match.adsrvr.org/track/cmf/generic?ttd_pid=intmerger&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=intmerger&ttd_tpi=1 HTTP 302
https://sync.im-apps.net/imid/set?cid=5664&tid=tdid&uid=54192256-a142-4577-be0d-0f08f5f1f22c

90 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
khsgdkajwuqwmas.top/ 8 KB
3 KB 512ms
157ms Document
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 1511635828c4b3b65a98fe920cbcaec844e741939e09a7865df4cddf0c596e88

Request headers

:method: GET
:authority: khsgdkajwuqwmas.top
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
server: Apache
vary: Accept-Encoding
content-encoding: gzip
content-length: 3032
content-type: text/html; charset=UTF-8

GET
H2 200 tagManagerGoogleForDeclarationDa.js Show response
khsgdkajwuqwmas.top/static/js/ 84 B
180 B 158ms
156ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/tagManagerGoogleForDeclarationDa.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 42da17fa40370bc2cfbb4a963b0d88c5a4985859b51afa92ed6214b4320e9e8b

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "54-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 83

GET
H2 200 style-20201111.css
khsgdkajwuqwmas.top/static/css/ 151 KB
21 KB 170ms
169ms Stylesheet
text/css 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: c9879a8199278ae1686140c95aa6f4b90962514d6ff734877ce8f078f6220a01

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:32 GMT
server: Apache
etag: "25bfb-5bc12dc1eea00-gzip"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 21543

GET
H2 200 login-20170608.js Show response
khsgdkajwuqwmas.top/static/js/ 3 KB
733 B 159ms
158ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/login-20170608.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: d78aea4ac1805c79b9c98c6fafb7d70544818e0461281919250769fbf3bbe986

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "a3e-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 680

GET
H2 200 tagManagerGoogleForCustomPageUse.js Show response
khsgdkajwuqwmas.top/static/js/ 112 B
166 B 158ms
157ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/tagManagerGoogleForCustomPageUse.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: e0e623e6875e227547890040f6f01f079fdc9e02456143524b369a2e4001f5c0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "70-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 114

GET
H2 200 tagManagerGoogleForScript.js Show response
khsgdkajwuqwmas.top/static/js/ 511 B
462 B 169ms
168ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/tagManagerGoogleForScript.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: b8a19af152832f4b7d1d160ad161d6825394389eef4849edd60a45266071526a

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "1ff-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 408

GET
H2 200 Rtoaster.js Show response
khsgdkajwuqwmas.top/static/js/ 8 KB
4 KB 169ms
168ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/Rtoaster.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 3326bed334b58d8e3cf852dd9e264bb62044c773a616b95dd92193991bda9b04

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "20d3-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 4274

GET
H2 200 remind-2.jpg
khsgdkajwuqwmas.top/static/picture/ 11 KB
12 KB 164ms
161ms Image
image/jpeg 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/picture/remind-2.jpg
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: feffa0caa07987c670cae82d6a1c920bb0a68a2207b8f84e3a18a6ef624a0cbb

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:46 GMT
server: Apache
accept-ranges: bytes
etag: "2d93-5bc12d9610280"
content-length: 11667
content-type: image/jpeg

GET
H2 200 bn_facebook.gif
khsgdkajwuqwmas.top/static/picture/ 15 KB
15 KB 164ms
161ms Image
image/gif 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/picture/bn_facebook.gif
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:44 GMT
server: Apache
accept-ranges: bytes
etag: "3b5f-5bc12d9427e00"
content-length: 15199
content-type: image/gif

GET
H2 200 bn_twitter.gif
khsgdkajwuqwmas.top/static/picture/ 15 KB
15 KB 164ms
161ms Image
image/gif 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/picture/bn_twitter.gif
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:44 GMT
server: Apache
accept-ranges: bytes
etag: "3b13-5bc12d9427e00"
content-length: 15123
content-type: image/gif

GET
H2 200 line.gif
khsgdkajwuqwmas.top/static/picture/ 8 KB
8 KB 164ms
161ms Image
image/gif 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/picture/line.gif
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:46 GMT
server: Apache
accept-ranges: bytes
etag: "1eee-5bc12d9610280"
content-length: 7918
content-type: image/gif

GET
H2 200 Rtoaster.Popup.js Show response
khsgdkajwuqwmas.top/static/js/ 6 KB
3 KB 166ms
166ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/Rtoaster.Popup.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: ac4bbdfbfeba82ed7277d2014d6768d9654518ba6323a3fc12a77ca400463715

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "16c1-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 3185

GET
H2 200 load-20201111.js Show response
khsgdkajwuqwmas.top/static/js/ 501 B
220 B 302ms
299ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/load-20201111.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 866e858f7b0f50f938e24c7e4d04499b78c0ed4d794a3fe563f4e50e2e1a16a2

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "1f5-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 166

GET
H2 200 tagManagerYahooForScript.js Show response
khsgdkajwuqwmas.top/static/js/ 278 B
213 B 165ms
161ms Script
application/javascript 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/static/js/tagManagerYahooForScript.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 2b66c0a42bdea94814de795a2f82a083720a2308f5829661a9a09e9438e91f57

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:54:34 GMT
server: Apache
etag: "116-5bc12dc3d6e80-gzip"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 161

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 212 KB
63 KB 46ms
25ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KL8TCX4

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/tagManagerGoogleForScript.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c0464d15e50b46b501a8ed55e6bc57176739f608b131245731d2af04b376d8d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:12 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 63519
x-xss-protection: 0
last-modified: Sat, 06 Mar 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 06 Mar 2021 05:39:12 GMT

GET
H2 200 hd-main-bg.png
khsgdkajwuqwmas.top/static/image/ 79 B
156 B 299ms
297ms Image
image/png 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/image/hd-main-bg.png
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2

Request headers

Referer: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:52 GMT
server: Apache
accept-ranges: bytes
etag: "4f-5bc12d9bc9000"
content-length: 79
content-type: image/png

GET
H2 200 hd-logo1.png
khsgdkajwuqwmas.top/static/image/ 1 KB
1 KB 299ms
297ms Image
image/png 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/image/hd-logo1.png
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0

Request headers

Referer: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:52 GMT
server: Apache
accept-ranges: bytes
etag: "4c7-5bc12d9bc9000"
content-length: 1223
content-type: image/png

GET
H2 200 gloval-bg1.png
khsgdkajwuqwmas.top/static/image/ 83 B
129 B 299ms
297ms Image
image/png 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/image/gloval-bg1.png
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa

Request headers

Referer: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:52 GMT
server: Apache
accept-ranges: bytes
etag: "53-5bc12d9bc9000"
content-length: 83
content-type: image/png

GET
H2 200 icon.png
khsgdkajwuqwmas.top/static/image/ 997 B
1 KB 295ms
294ms Image
image/png 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/image/icon.png
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa

Request headers

Referer: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:54 GMT
server: Apache
accept-ranges: bytes
etag: "3e5-5bc12d9db1480"
content-length: 997
content-type: image/png

GET
H2 403 /
rt.rtoaster.jp/t/ 0
0 72ms
22ms Script
text/html 184.30.216.191
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://rt.rtoaster.jp/t/?a=RTA-ede3-18b80ab67e75&m=&l=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&r=&p=&i=0.0387712552933841&c=UTF-8
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/Rtoaster.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.216.191 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-30-216-191.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H/1.1 200
OK itm.js Show response
dmp.im-apps.net/js/1000918/0001/ 1012 B
1 KB 50ms
16ms Script
text/javascript 2a02:26f0:1700:7::17d5:a1d8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://dmp.im-apps.net/js/1000918/0001/itm.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:7::17d5:a1d8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: f17ee94784502c96f142d28971ebe8c468a64870887491269d21f523b1474742

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
x-amz-version-id: JpEAsL87lOcuHTJAiB91D6HNsFqJNq8L
Content-Encoding: gzip
Last-Modified: Fri, 12 Jan 2018 09:09:42 GMT
ETag: "a147a3d8d2b1d8894512996a0f8d1157"
Vary: Accept-Encoding
P3P: CP="NOI PSD OTR"
Cache-Control: max-age=0, no-cache
Date: Sat, 06 Mar 2021 05:39:13 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 600
Expires: Sat, 06 Mar 2021 05:39:13 GMT

GET
H2 200 pagetop1.png
khsgdkajwuqwmas.top/static/image/ 1 KB
1 KB 156ms
156ms Image
image/png 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/image/pagetop1.png
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c

Request headers

Referer: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:54 GMT
server: Apache
accept-ranges: bytes
etag: "40a-5bc12d9db1480"
content-length: 1034
content-type: image/png

GET
H2 200 ft-logo.png
khsgdkajwuqwmas.top/static/image/ 1 KB
1 KB 157ms
156ms Image
image/png 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://khsgdkajwuqwmas.top/static/image/ft-logo.png
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash: 813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27

Request headers

Referer: https://khsgdkajwuqwmas.top/static/css/style-20201111.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
last-modified: Wed, 24 Feb 2021 10:53:52 GMT
server: Apache
accept-ranges: bytes
etag: "446-5bc12d9bc9000"
content-length: 1094
content-type: image/png

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KL8TCX4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 5797
date: Sat, 06 Mar 2021 04:02:36 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Sat, 06 Mar 2021 06:02:36 GMT

GET
H2 200 ytag.js Show response
s.yimg.jp/images/listing/tool/cv/ 23 KB
7 KB 828ms
314ms Script
application/javascript 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/ytag.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KL8TCX4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: fcb5ee7a8fcec48a11b7adf420332a9ff2cf49f99558795d6b7b810618573e35

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 06 Mar 2021 05:38:57 GMT
content-encoding: gzip
last-modified: Wed, 30 Sep 2020 06:06:44 GMT
server: ATS
age: 16
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
via: http/1.1 edge1708.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1731.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 6746
expires: Sat, 06 Mar 2021 05:48:57 GMT

GET
H2 404 jquery-1.10.2.min.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 158ms
156ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/jquery-1.10.2.min.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/load-20201111.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 onmediaquery.min.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 159ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/onmediaquery.min.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/load-20201111.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 swipe.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 158ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/swipe.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/load-20201111.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 common.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 159ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/common.js?v=20201111
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/load-20201111.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 analyze.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 159ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/analyze.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/static/js/load-20201111.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 200 segment Show response
sync.im-apps.net/imid/ 116 B
729 B 746ms
241ms Script
application/javascript 52.199.29.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.im-apps.net/imid/segment?callback=_itm_.c1000918.ia_cb&token=VXoW9wEaCAYxiIkb8Mzm7Q
Requested by: Host: dmp.im-apps.net
URL: https://dmp.im-apps.net/js/1000918/0001/itm.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.199.29.254 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 14fca029e8b3596d6a5fda034c3c9dfb00a7843c9de0178e592be3426efd6ebd

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-im-imid: erzrRIyoQ5yJc4TzGqST-g
date: Sat, 06 Mar 2021 05:39:13 GMT
content-encoding: gzip
server: nginx
x-im-imid-created: 1615009153
p3p: CP="NOI PSD OTR"
access-control-allow-origin: *
cache-control: no-cache
content-type: application/javascript
expires: Sat, 06 Mar 2021 05:39:12 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
391 B 40ms
13ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=2147330836&t=pageview&_s=1&dl=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&dr=&dp=%2FNSA%2Flogin%2Fother&ul=en-us&de=UTF-8&dt=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1925943322&gjid=1618042074&cid=2076218905.1615009153&tid=UA-180808313-4&_gid=242285533.1615009153&_r=1&gtm=2wg2o0KL8TCX4&cg1=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&cg3=%2FNSA%2Flogin%2Fother&cd1=2076218905.1615009153&z=246668423

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://khsgdkajwuqwmas.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
25 B 29ms
13ms XHR
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=2147330836&t=pageview&_s=1&dl=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&dr=&dp=%2FNSA%2Flogin%2Fother&ul=en-us&de=UTF-8&dt=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDACEABBAAAAC~&jid=1151383425&gjid=1307581733&cid=2076218905.1615009153&tid=UA-180808313-1&_gid=242285533.1615009153&_r=1&gtm=2wg2o0KL8TCX4&cg1=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&cg3=%2FNSA%2Flogin%2Fother&cd1=2076218905.1615009153&z=162207932

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://khsgdkajwuqwmas.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
449 B 42ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-180808313-4&cid=2076218905.1615009153&jid=1925943322&gjid=1618042074&_gid=242285533.1615009153&_u=YEBAAEAAAAAAAC~&z=535143194

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 06 Mar 2021 05:39:13 GMT
content-type: text/plain
access-control-allow-origin: https://khsgdkajwuqwmas.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 42ms
14ms XHR
text/plain 2a00:1450:400c:c0c::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-180808313-1&cid=2076218905.1615009153&jid=1151383425&gjid=1307581733&_gid=242285533.1615009153&_u=YGDACEABBAAAAC~&z=1905695217

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sat, 06 Mar 2021 05:39:13 GMT
content-type: text/plain
access-control-allow-origin: https://khsgdkajwuqwmas.top
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
111 B 18ms
17ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-180808313-4&cid=2076218905.1615009153&jid=1925943322&_u=YEBAAEAAAAAAAC~&z=465334472

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 19ms
18ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-180808313-4&cid=2076218905.1615009153&jid=1925943322&_u=YEBAAEAAAAAAAC~&z=465334472

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
111 B 17ms
16ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-180808313-1&cid=2076218905.1615009153&jid=1151383425&_u=YGDACEABBAAAAC~&z=1069430023

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 19ms
17ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-180808313-1&cid=2076218905.1615009153&jid=1151383425&_u=YGDACEABBAAAAC~&z=1069430023

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 onmediaquery.min.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 157ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/onmediaquery.min.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 swipe.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 158ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/swipe.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 common.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 157ms
156ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/common.js?v=20201111
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 common.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 157ms
157ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/common.js?v=20201111
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H2 404 analyze.js
khsgdkajwuqwmas.top/js/netstation/ 0
0 156ms
155ms Script
text/html 162.0.211.207
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://khsgdkajwuqwmas.top/js/netstation/analyze.js?v=20140210
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.211.207 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:13 GMT
server: Apache
content-length: 266
content-type: text/html; charset=iso-8859-1

GET
H3-Q050 200 gtm.js Show response
www.googletagmanager.com/ 158 KB
46 KB 46ms
32ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5MPCH4K&l=itm_dl1_1000918

Requested by

Host: dmp.im-apps.net
URL: https://dmp.im-apps.net/js/1000918/0001/itm.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

81a9df533b996c33620542757ae8ac0452f65ad01d44ed26790b59125352985f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46363
x-xss-protection: 0
last-modified: Sat, 06 Mar 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 06 Mar 2021 05:39:14 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 32 KB
13 KB 86ms
36ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5MPCH4K&l=itm_dl1_1000918

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

104ff1abbbad8a44885817c01d09b1454d44dfef30c991f25712feb21ffea675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12538
x-xss-protection: 0
server: cafe
etag: 10853274261861872019
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 06 Mar 2021 05:39:14 GMT

GET
H3-Q050

200

activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F Show response
8731124.fls.doubleclick.net/ Frame B484
Redirect Chain

https://8731124.fls.doubleclick.net/activityi;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F?
https://8731124.fls.doubleclick.net/activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=http...

498 B
1001 B

68ms
39ms

Document
text/html

142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8731124.fls.doubleclick.net/activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5MPCH4K&l=itm_dl1_1000918

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

88f28fe1c8044cf04d95a2c55d0738e1faa6c8c6b21349ce1c442d6763dca0fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8731124.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://khsgdkajwuqwmas.top/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 06 Mar 2021 05:39:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 399
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 06-Mar-2021 05:54:14 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 06 Mar 2021 05:39:14 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://8731124.fls.doubleclick.net/activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK beacon.html Show response
cf.im-apps.net/imid/ Frame D396 3 KB
2 KB 45ms
7ms Document
text/html 2a02:26f0:1700:7::17d5:a1ca
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cf.im-apps.net/imid/beacon.html
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:7::17d5:a1ca Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 2501da73967f02086fe9a229482ae0a9f10fdddc455f0940f082d1354666c0cd

Request headers

Host: cf.im-apps.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://khsgdkajwuqwmas.top/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: imid_secure=erzrRIyoQ5yJc4TzGqST-g; imid_created_secure=1615009153
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://khsgdkajwuqwmas.top/

Response headers

x-amz-replication-status: PENDING
Last-Modified: Thu, 25 Feb 2021 18:22:08 GMT
ETag: "5a001b601f30c193c75038361d818c5d"
Accept-Ranges: bytes
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Cache-Control: max-age=86400
Expires: Sun, 07 Mar 2021 05:39:14 GMT
Date: Sat, 06 Mar 2021 05:39:14 GMT
Content-Length: 1671
Connection: keep-alive
P3P: CP="NOI PSD OTR"

GET
H2 200 fraud Show response
score.im-apps.net/v1/ 48 B
210 B 748ms
255ms Script
application/javascript 52.192.216.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://score.im-apps.net/v1/fraud?escvid=17814&callback=im1615009154093
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.192.216.245 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.15.7 /
Resource Hash: 329b44a2986a29bd59207637f032c329793426d4d6dd7fb5949fd51f3121a2a4

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 06 Mar 2021 05:39:14 GMT
cache-control: no-cache
server: nginx/1.15.7
content-type: application/javascript
content-length: 48
expires: Sat, 06 Mar 2021 05:39:13 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-753063994

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6bb6fc3441883ec0bf982eaf5c83f35b34d99e62a84a3a4be41335c8ea5bc630

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39442
x-xss-protection: 0
last-modified: Sat, 06 Mar 2021 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 06 Mar 2021 05:39:14 GMT

GET
H/1.1 200
OK log.js Show response
dmp.im-apps.net/sdk/ 70 KB
24 KB 7ms
7ms Script
text/javascript 2a02:26f0:1700:7::17d5:a1d8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://dmp.im-apps.net/sdk/log.js
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:7::17d5:a1d8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 0f12fa551bd572f8c67b8b64c8aa9fed081add7364ec6ed125e8e551e7614b91

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: DfG.xEi6bO3rIdz.Vpf4oTHZLSsApHw8
Content-Encoding: gzip
Last-Modified: Fri, 05 Mar 2021 08:16:05 GMT
ETag: "6207d885c63a652c29d853e01e21191d"
Vary: Accept-Encoding
P3P: CP="NOI PSD OTR"
Cache-Control: public, max-age=10800
Date: Sat, 06 Mar 2021 05:39:14 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 24239

GET
H2 200 evaluate Show response
open.im-apps.net/ 1 KB
1 KB 460ms
417ms XHR
application/json 34.102.249.189
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://open.im-apps.net/evaluate?model=fs-1
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.249.189 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: 8edd755f5d6942cb2ff072bdb3cdb832da6c810b3c27e587b69a15b174d97c7a

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
vary: Origin
content-type: application/json
access-control-allow-origin: https://khsgdkajwuqwmas.top
access-control-allow-credentials: true
alt-svc: clear
content-length: 1064

GET
H2 200 fraud Show response
score.im-apps.net/v1/ 48 B
211 B 736ms
251ms Script
application/javascript 52.192.216.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://score.im-apps.net/v1/fraud?escvid=21811&callback=im1615009154100
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.192.216.245 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.15.7 /
Resource Hash: 8205a1bb2d94e157f83bf037b9fa42b3eb127c8de356d434cfac8dd7f50e74a3

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sat, 06 Mar 2021 05:39:14 GMT
cache-control: no-cache
server: nginx/1.15.7
content-type: application/javascript
content-length: 48
expires: Sat, 06 Mar 2021 05:39:13 GMT

GET
H2 200 /
atb.im-apps.net/a/imset/1000918/10022248/ 43 B
208 B 261ms
239ms Image
image/gif 2600:1901:0:835b::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atb.im-apps.net/a/imset/1000918/10022248/?token=af8ef8e6b0ddfd25e1852912be5a8cfb
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:835b:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 beacon.gif
atm.im-apps.net/a/ 43 B
208 B 282ms
237ms Image
image/gif 34.120.216.28
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atm.im-apps.net/a/beacon.gif?cid=1004154&c1=1006133&c2=GTM-5MPCH4K&c3=&c4=&c5=&d=
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.216.28 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 beacon.gif
atm.im-apps.net/a/ 43 B
103 B 282ms
238ms Image
image/gif 34.120.216.28
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atm.im-apps.net/a/beacon.gif?cid=1004154&c1=1000918&c2=GTM-5MPCH4K&c3=&c4=&c5=&d=Complete
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.216.28 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 beacon.gif
atm.im-apps.net/a/ 43 B
103 B 282ms
238ms Image
image/gif 34.120.216.28
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://atm.im-apps.net/a/beacon.gif?cid=1004154&c1=1003286&c2=GTM-5MPCH4K&c3=&c4=&c5=&d=www.shinseibank.com%2Fcrm%2Fcommunity%2Fhousing%2FinputCompleted
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.216.28 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 tracker
b.im-apps.net/ 43 B
208 B 277ms
240ms Image
image/gif 34.120.190.172
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b.im-apps.net/tracker?action_name=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&idsite=1000918&rec=1&cdptm=0&r=757834&h=6&m=39&s=14&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&_id=170247b28d0ebb12&_idts=1615009154&_idvc=1&_idn=0&_refts=0&_viewts=1615009154&send_image=1&cookie=1&res=1600x1200&data=%7B%7D&gt_ms=158&pv_id=gSQBrA&__lang=en-us&__dpr=1&__cvid=0&__escvid=17814
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.190.172 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
b6.im-apps.net/ 43 B
208 B 256ms
230ms Image
image/gif 2600:1901:0:b6a9::
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b6.im-apps.net/collect?action_name=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&idsite=1000918&rec=1&cdptm=0&r=136279&h=6&m=39&s=14&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&_id=170247b28d0ebb12&_idts=1615009154&_idvc=1&_idn=0&_refts=0&_viewts=1615009154&send_image=1&cookie=1&res=1600x1200&data=%7B%22cv%22%3A0%7D&gt_ms=158&pv_id=GuQgeF&__lang=en-us&__dpr=1
Requested by: Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:b6a9:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
via: 1.1 google
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: clear
content-length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 set
sync.im-apps.net/imid/ Frame D396 43 B
592 B 240ms
240ms Image
image/gif 52.199.29.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.im-apps.net/imid/set?no_sync=1
Requested by: Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.199.29.254 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
server: nginx
x-im-imid-created: 1615009153
p3p: CP="NOI PSD OTR"
x-im-imid: erzrRIyoQ5yJc4TzGqST-g
cache-control: no-cache
content-type: image/gif
expires: Sat, 06 Mar 2021 05:39:13 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/804014472/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/804014472/?random=1615009154191&cv=9&fst=1615009154191&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&ig=1&data=segment_eids%3D%3Bfraud%3D0%3Bml_score%3D0&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4ce0746620a8e4435a2a3dd8cccf9cca0f29f1ce4c7c28efe6ba5a328652bbbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1085
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/753063994/ 2 KB
1 KB 78ms
63ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/753063994/?random=1615009154196&cv=9&fst=1615009154196&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2o0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7bad4503c0459e019ead5daf50f0303724b31069e433d35081e0e4e2f86af602

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1051
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/753063994/ 2 KB
2 KB 48ms
33ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/753063994/?random=1615009154197&cv=9&fst=1615009154197&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2o0&sendb=1&ig=1&data=event%3Dimid&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87849aeff031e4ba57c1fbe027906a669b1899cc72ff9d9bf72493b811d17e78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1075
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/804014472/ 42 B
66 B 43ms
27ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/804014472/?random=1615009154191&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=segment_eids%3D%3Bfraud%3D0%3Bml_score%3D0&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=1668751281&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/804014472/ 42 B
66 B 43ms
27ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/804014472/?random=1615009154191&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=segment_eids%3D%3Bfraud%3D0%3Bml_score%3D0&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=1668751281&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/753063994/ 42 B
530 B 41ms
25ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/753063994/?random=1615009154197&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2o0&sendb=1&data=event%3Dimid&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=3926464400&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/753063994/ 42 B
530 B 42ms
27ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/753063994/?random=1615009154197&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2o0&sendb=1&data=event%3Dimid&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=3926464400&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/753063994/ 42 B
66 B 40ms
25ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/753063994/?random=1615009154196&cv=9&fst=1615006800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2o0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=3620275321&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/753063994/ 42 B
66 B 41ms
27ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/753063994/?random=1615009154196&cv=9&fst=1615006800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa2o0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=3620275321&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: khsgdkajwuqwmas.top
URL: https://khsgdkajwuqwmas.top/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F Show response
adservice.google.com/ddm/fls/i/ Frame BD35 497 B
871 B 43ms
23ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F

Requested by

Host: 8731124.fls.doubleclick.net
URL: https://8731124.fls.doubleclick.net/activityi;dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a131e2924d073685644dfab48d98a25af2bb3749b33d2414d4cfe7cef883d0d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.com
:scheme: https
:path: /ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8731124.fls.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://8731124.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 06 Mar 2021 05:39:14 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 398
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F Show response
adservice.google.de/ddm/fls/i/ Frame 526D 194 B
877 B 37ms
17ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: adservice.google.de
:scheme: https
:path: /ddm/fls/i/dc_pre=CKe4xff5mu8CFUXO1Qodu8wD3Q;src=8731124;type=invmedia;cat=ufj070;ord=332743105515;gtm=2wg2o0;auiddc=373417429.1615009153;u1=21811;u2=0;~oref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://adservice.google.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sat, 06 Mar 2021 05:39:14 GMT
expires: Sat, 06 Mar 2021 05:39:14 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H2

200

set
sync.im-apps.net/imid/ Frame D396
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=intimatemerger_dmp&google_cm
https://sync.im-apps.net/imid/set?cid=5660&tid=gid&uid=CAESEK-28To5Rw8Of8zM7ue-V-U&google_cver=1

43 B
592 B

238ms
238ms

Image
image/gif

52.199.29.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.im-apps.net/imid/set?cid=5660&tid=gid&uid=CAESEK-28To5Rw8Of8zM7ue-V-U&google_cver=1
Requested by: Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.199.29.254 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
server: nginx
x-im-imid-created: 1615009153
p3p: CP="NOI PSD OTR"
x-im-imid: erzrRIyoQ5yJc4TzGqST-g
cache-control: no-cache
content-type: image/gif
expires: Sat, 06 Mar 2021 05:39:13 GMT

Redirect headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.im-apps.net/imid/set?cid=5660&tid=gid&uid=CAESEK-28To5Rw8Of8zM7ue-V-U&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 305
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200

cs
yjtag.yahoo.co.jp/ Frame D396
Redirect Chain

https://yjtag.yahoo.co.jp/csx?tp=wAiXPd0
https://sync.im-apps.net/imid/redirect?gdpr=1&cid=8144&tid=yid&uidpfx=%26uid%3D&url=https%3A%2F%2Fyjtag.yahoo.co.jp%2Fcs%3Fbtt%3DQMa8KRbM65bSYvMuD9axVhbtEKfAZrTvk8B-1kZargc%26tp%3DwAiXPd0
https://yjtag.yahoo.co.jp/cs?btt=QMa8KRbM65bSYvMuD9axVhbtEKfAZrTvk8B-1kZargc&tp=wAiXPd0&uid=erzrRIyoQ5yJc4TzGqST-g&gdpr=1

35 B
936 B

268ms
268ms

Image
image/gif

182.22.89.248
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yjtag.yahoo.co.jp/cs?btt=QMa8KRbM65bSYvMuD9axVhbtEKfAZrTvk8B-1kZargc&tp=wAiXPd0&uid=erzrRIyoQ5yJc4TzGqST-g&gdpr=1

Requested by

Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

182.22.89.248 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
X-BT-RequestId: 49f076a0-7e3e-11eb-bd68-0000ac1c45d7
X-Content-Type-Options: nosniff
Age: 0
Date: Sat, 06 Mar 2021 05:39:15 GMT
P3P: policyref="http://privacy.yahoo.co.jp/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Cache-Control: private, must-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

x-im-imid: erzrRIyoQ5yJc4TzGqST-g
date: Sat, 06 Mar 2021 05:39:15 GMT
server: nginx
x-im-imid-created: 1615009153
p3p: CP="NOI PSD OTR"
location: https://yjtag.yahoo.co.jp/cs?btt=QMa8KRbM65bSYvMuD9axVhbtEKfAZrTvk8B-1kZargc&tp=wAiXPd0&uid=erzrRIyoQ5yJc4TzGqST-g&gdpr=1
cache-control: no-cache
expires: Sat, 06 Mar 2021 05:39:14 GMT

GET
H2 200 adsct
analytics.twitter.com/i/ Frame D396 43 B
575 B 183ms
134ms Image
image/gif 104.244.42.131
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_id=980&p_user_id=erzrRIyoQ5yJc4TzGqST-g

Requested by

Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.131 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 113
pragma: no-cache
last-modified: Sat, 06 Mar 2021 05:39:14 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: c849187653101718e0604114d09df345
x-transaction: 0070195200dde6fa
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame D396
Redirect Chain

https://dpm.demdex.net/ibs:dpid=14701&dpuuid=erzrRIyoQ5yJc4TzGqST-g
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=14701&dpuuid=erzrRIyoQ5yJc4TzGqST-g

42 B
915 B

31ms
31ms

Image
image/gif

34.249.128.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=14701&dpuuid=erzrRIyoQ5yJc4TzGqST-g

Requested by

Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.128.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v089-0aaba09ea.edge-irl1.demdex.com 5.80.6.20210202104731 0ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: EfDYTT1jRbs=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: dEFrUIkoQS4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=14701&dpuuid=erzrRIyoQ5yJc4TzGqST-g
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

set
sync.im-apps.net/imid/ Frame D396
Redirect Chain

https://gum.criteo.com/sync?c=263&r=1&a=1&u=https%3A%2F%2Fsync.im-apps.net%2Fimid%2Fset%3Fcid%3D1000531%26tid%3Dgid%26uid%3D%40USERID%40
https://gum.criteo.com/sync?s=1&c=263&r=1&a=1&u=https%3A%2F%2Fsync.im-apps.net%2Fimid%2Fset%3Fcid%3D1000531%26tid%3Dgid%26uid%3D%40USERID%40
https://sync.im-apps.net/imid/set?cid=1000531&tid=gid&uid=R7tgeXdbiHw--bar4tJi-6Iz4NDbws5i

43 B
592 B

241ms
241ms

Image
image/gif

52.199.29.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.im-apps.net/imid/set?cid=1000531&tid=gid&uid=R7tgeXdbiHw--bar4tJi-6Iz4NDbws5i
Requested by: Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.199.29.254 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
server: nginx
x-im-imid-created: 1615009153
p3p: CP="NOI PSD OTR"
x-im-imid: erzrRIyoQ5yJc4TzGqST-g
cache-control: no-cache
content-type: image/gif
expires: Sat, 06 Mar 2021 05:39:13 GMT

Redirect headers

location: https://sync.im-apps.net/imid/set?cid=1000531&tid=gid&uid=R7tgeXdbiHw--bar4tJi-6Iz4NDbws5i
strict-transport-security: max-age=31536000
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2987
date: Sat, 06 Mar 2021 05:39:13 GMT
content-length: 215
content-type: text/html; charset=utf-8

GET
H2

200

set
sync.im-apps.net/imid/ Frame D396
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=intmerger&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=intmerger&ttd_tpi=1
https://sync.im-apps.net/imid/set?cid=5664&tid=tdid&uid=54192256-a142-4577-be0d-0f08f5f1f22c

43 B
592 B

238ms
238ms

Image
image/gif

52.199.29.254
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.im-apps.net/imid/set?cid=5664&tid=tdid&uid=54192256-a142-4577-be0d-0f08f5f1f22c
Requested by: Host: cf.im-apps.net
URL: https://cf.im-apps.net/imid/beacon.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.199.29.254 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer: https://cf.im-apps.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:14 GMT
server: nginx
x-im-imid-created: 1615009153
p3p: CP="NOI PSD OTR"
x-im-imid: erzrRIyoQ5yJc4TzGqST-g
cache-control: no-cache
content-type: image/gif
expires: Sat, 06 Mar 2021 05:39:13 GMT

Redirect headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:14 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://sync.im-apps.net/imid/set?cid=5664&tid=tdid&uid=54192256-a142-4577-be0d-0f08f5f1f22c
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 215

GET
H3-Q050 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 32 KB
13 KB 68ms
39ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5MPCH4K&l=itm_dl1_1000918

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

104ff1abbbad8a44885817c01d09b1454d44dfef30c991f25712feb21ffea675

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Mar 2021 05:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12538
x-xss-protection: 0
server: cafe
etag: 10853274261861872019
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 06 Mar 2021 05:39:16 GMT

GET
H2 200 ytag.js Show response
s.yimg.jp/images/listing/tool/cv/ 23 KB
7 KB 255ms
254ms Script
application/javascript 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.yimg.jp/images/listing/tool/cv/ytag.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5MPCH4K&l=itm_dl1_1000918
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),
Reverse DNS
Software: ATS /
Resource Hash: fcb5ee7a8fcec48a11b7adf420332a9ff2cf49f99558795d6b7b810618573e35

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Sat, 06 Mar 2021 05:38:57 GMT
content-encoding: gzip
last-modified: Wed, 30 Sep 2020 06:06:44 GMT
server: ATS
age: 19
vary: Accept-Encoding
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
via: http/1.1 edge1708.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ]), http/1.1 edge1731.img.bbt.yahoo.co.jp (ApacheTrafficServer [cRs f ])
cache-control: public, max-age=600
accept-ranges: bytes
content-type: application/javascript
content-length: 6746
expires: Sat, 06 Mar 2021 05:48:57 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/925929578/ 2 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/925929578/?random=1615009156060&cv=9&fst=1615009156060&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&ig=1&data=fraud%3D1&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c76fbdda6b55c4014a4fd4cadc56ca2e0ca6075fa244702d02f049a5e7d202eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1038
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/428150443/ 3 KB
1 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/428150443/?random=1615009156062&cv=9&fst=1615009156062&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&ig=1&data=segment_eids%3D%3Bscore%3D0%3Bml_score%3D10069277%3Bim10074394%3D0%3Bim10074395%3D0%3Bim10075181%3D0%3Bim10075182%3D0%3Bim10075480%3D0&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9be01752c6beeec4bba0c5affb3de264fe3659738127de6ab6ed4f0e219514eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1117
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/480654610/ 2 KB
1 KB 186ms
185ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/480654610/?random=1615009156063&cv=9&fst=1615009156063&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&ig=1&data=segment_eids%3D%3Bscore%3D0%3Bml_score%3D10069277&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd554980d0c7c6f7582eb9bf30bc4352e267701459a6ac73c20fc15b738e6854

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1090
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/925929578/ 42 B
89 B 18ms
18ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/925929578/?random=1615009156060&cv=9&fst=1615006800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=fraud%3D1&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=180591820&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/925929578/ 42 B
89 B 19ms
18ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/925929578/?random=1615009156060&cv=9&fst=1615006800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=fraud%3D1&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=180591820&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/428150443/ 42 B
66 B 22ms
20ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/428150443/?random=1615009156062&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=segment_eids%3D%3Bscore%3D0%3Bml_score%3D10069277%3Bim10074394%3D0%3Bim10074395%3D0%3Bim10075181%3D0%3Bim10075182%3D0%3Bim10075480%3D0&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=2152974836&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/428150443/ 42 B
66 B 18ms
18ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/428150443/?random=1615009156062&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=segment_eids%3D%3Bscore%3D0%3Bml_score%3D10069277%3Bim10074394%3D0%3Bim10074395%3D0%3Bim10075181%3D0%3Bim10075182%3D0%3Bim10075480%3D0&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=2152974836&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
b92.yahoo.co.jp/search/ 0
660 B 280ms
278ms Script
text/javascript 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL

https://b92.yahoo.co.jp/search/?p=P0X82D2FG3&label=fraud&ref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&rref=&pt=&item=&cat=&price=&quantity=&r=1615009156.8849201&pvid=fwcb42p2j29klxar4bc&tsyjad=0&_impl=ytag

Requested by

Host: s.yimg.jp
URL: https://s.yimg.jp/images/listing/tool/cv/ytag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ATS
age: 0
x-frame-options: SAMEORIGIN
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
via: http/1.1 edge1731.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
cache-control: private, no-cache, no-store, post-check=0, pre-check=0
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-xss-protection: 1;mode=block
expires: -1

GET
H2 200 / Show response
b92.yahoo.co.jp/search/ 0
435 B 279ms
278ms Script
text/javascript 182.22.16.123
YAHOO Yahoo Japan...

General

Check archive.org

Show headers Download Go to

Full URL

https://b92.yahoo.co.jp/search/?p=MUBWQ3EC03&label=&ref=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&rref=&pt=&item=&cat=&price=&quantity=&r=1615009156.6178992&pvid=fwcb42p2j29klxar4bc&tsyjad=1615009156&_impl=ytag

Requested by

Host: s.yimg.jp
URL: https://s.yimg.jp/images/listing/tool/cv/ytag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.22.16.123 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ATS
age: 0
x-frame-options: SAMEORIGIN
p3p: policyref="http://privacy.yahoo.co.jp/w3c/p3p_jp.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
via: http/1.1 edge1731.img.bbt.yahoo.co.jp (ApacheTrafficServer [c sSf ])
cache-control: private, no-cache, no-store, post-check=0, pre-check=0
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-xss-protection: 1;mode=block
expires: -1

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/480654610/ 42 B
66 B 19ms
18ms Image
image/gif 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/480654610/?random=1615009156063&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=segment_eids%3D%3Bscore%3D0%3Bml_score%3D10069277&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=2174262162&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/480654610/ 42 B
66 B 20ms
19ms Image
image/gif 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/480654610/?random=1615009156063&cv=9&fst=1615006800000&num=1&userId=erzrRIyoQ5yJc4TzGqST-g&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg2o0&sendb=1&data=segment_eids%3D%3Bscore%3D0%3Bml_score%3D10069277&frm=0&url=https%3A%2F%2Fkhsgdkajwuqwmas.top%2F&tiba=%E3%83%AD%E3%82%B0%E3%82%A4%E3%83%B3%20%7C%20%E3%82%A2%E3%83%97%E3%83%A9%E3%82%B9&async=1&fmt=3&is_vtc=1&random=2174262162&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://khsgdkajwuqwmas.top/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 06 Mar 2021 05:39:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aplus (Shinsei Bank) (Financial)

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.im-apps.net/	1970-01-19 16:41:08	Name: synced_group_g1_secure Value: 1615009154
.im-apps.net/	1970-01-20 10:08:01	Name: synced_imid_secure Value: 1615009154
.khsgdkajwuqwmas.top/	1970-01-19 16:36:49	Name: _gat_UA-180808313-4 Value: 1
khsgdkajwuqwmas.top/	1970-01-19 16:36:50	Name: _im_ses.1000918 Value: 1
.im-apps.net/	1970-01-20 10:08:01	Name: imid_created_secure Value: 1615009153
.khsgdkajwuqwmas.top/	1970-01-20 10:08:01	Name: _ga_cdt Value: GA1.2.2076218905.1615009153
.doubleclick.net/	1970-01-20 01:58:25	Name: IDE Value: AHWqTUmit8qYAKAOS2RMikEpc2M0767LXJm6v6gjqb9VhdftRBw1r3zgW_35-CyQ
khsgdkajwuqwmas.top/	1970-01-19 16:38:15	Name: _im_ml_score Value: 10069277
.khsgdkajwuqwmas.top/	1970-01-19 16:38:15	Name: _ga_cdt_gid Value: GA1.2.242285533.1615009153
khsgdkajwuqwmas.top/	1970-01-20 02:02:44	Name: _im_id.1000918 Value: 170247b28d0ebb12.1615009154.1.1615009154.1615009154.
.im-apps.net/	1970-01-20 10:08:01	Name: imid_secure Value: erzrRIyoQ5yJc4TzGqST-g
.khsgdkajwuqwmas.top/	1970-01-19 16:36:49	Name: _gat_UA-180808313-1 Value: 1
.khsgdkajwuqwmas.top/	1970-01-19 18:46:25	Name: _gcl_au Value: 1.1.373417429.1615009153

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8731124.fls.doubleclick.net
adservice.google.com
adservice.google.de
analytics.twitter.com
atb.im-apps.net
atm.im-apps.net
b.im-apps.net
b6.im-apps.net
b92.yahoo.co.jp
cf.im-apps.net
cm.g.doubleclick.net
dmp.im-apps.net
dpm.demdex.net
googleads.g.doubleclick.net
gum.criteo.com
khsgdkajwuqwmas.top
match.adsrvr.org
open.im-apps.net
rt.rtoaster.jp
s.yimg.jp
score.im-apps.net
stats.g.doubleclick.net
sync.im-apps.net
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
yjtag.yahoo.co.jp
104.244.42.131
142.250.185.194
142.250.185.98
142.250.186.166
162.0.211.207
182.22.16.123
182.22.89.248
184.30.216.191
2600:1901:0:835b::
2600:1901:0:b6a9::
2a00:1450:4001:809::2003
2a00:1450:4001:809::200e
2a00:1450:4001:80f::2004
2a00:1450:4001:810::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::2008
2a00:1450:4001:813::200e
2a00:1450:4001:827::2002
2a00:1450:4001:827::2003
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2004
2a00:1450:400c:c0c::9d
2a02:2638::1c
2a02:26f0:1700:7::17d5:a1ca
2a02:26f0:1700:7::17d5:a1d8
34.102.249.189
34.120.190.172
34.120.216.28
34.249.128.36
52.192.216.245
52.199.29.254
54.154.164.132
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
0bf85b852f5aa189bd34c2944b5093d14182cfedb62f5f01cd8e4763384c9aaa
0f12fa551bd572f8c67b8b64c8aa9fed081add7364ec6ed125e8e551e7614b91
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
104ff1abbbad8a44885817c01d09b1454d44dfef30c991f25712feb21ffea675
14fca029e8b3596d6a5fda034c3c9dfb00a7843c9de0178e592be3426efd6ebd
1511635828c4b3b65a98fe920cbcaec844e741939e09a7865df4cddf0c596e88
2501da73967f02086fe9a229482ae0a9f10fdddc455f0940f082d1354666c0cd
2b66c0a42bdea94814de795a2f82a083720a2308f5829661a9a09e9438e91f57
329b44a2986a29bd59207637f032c329793426d4d6dd7fb5949fd51f3121a2a4
3326bed334b58d8e3cf852dd9e264bb62044c773a616b95dd92193991bda9b04
42da17fa40370bc2cfbb4a963b0d88c5a4985859b51afa92ed6214b4320e9e8b
4aa74984a49acbbd2b76baf9b9ffdd7578ff355e150c6bbbbf42299d08f17d7c
4ce0746620a8e4435a2a3dd8cccf9cca0f29f1ce4c7c28efe6ba5a328652bbbc
65e17e668c3d58082c325dfba0943414fdce67de6bcbc2f56e2bd56ad74278fa
6bb6fc3441883ec0bf982eaf5c83f35b34d99e62a84a3a4be41335c8ea5bc630
7bad4503c0459e019ead5daf50f0303724b31069e433d35081e0e4e2f86af602
813a1e9758bb99a4744c6b6b84233b6442b8998ad1a83fc36642425232f44b27
81a9df533b996c33620542757ae8ac0452f65ad01d44ed26790b59125352985f
8205a1bb2d94e157f83bf037b9fa42b3eb127c8de356d434cfac8dd7f50e74a3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
866e858f7b0f50f938e24c7e4d04499b78c0ed4d794a3fe563f4e50e2e1a16a2
8735828b2e32b3ed356ae4bf91b0d95b464d31716702bbcb472a93d0ab560c01
87849aeff031e4ba57c1fbe027906a669b1899cc72ff9d9bf72493b811d17e78
88f28fe1c8044cf04d95a2c55d0738e1faa6c8c6b21349ce1c442d6763dca0fa
8edd755f5d6942cb2ff072bdb3cdb832da6c810b3c27e587b69a15b174d97c7a
9be01752c6beeec4bba0c5affb3de264fe3659738127de6ab6ed4f0e219514eb
a131e2924d073685644dfab48d98a25af2bb3749b33d2414d4cfe7cef883d0d3
ac4bbdfbfeba82ed7277d2014d6768d9654518ba6323a3fc12a77ca400463715
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b2f5063644a8bf6df9f21bbf528454a2413bce5e01287a940aed548ac5c957e0
b8a19af152832f4b7d1d160ad161d6825394389eef4849edd60a45266071526a
b923088ea8deadb010739d6c188b3a5128f538df0b4004e4ab8e520d4934b170
bd554980d0c7c6f7582eb9bf30bc4352e267701459a6ac73c20fc15b738e6854
c0464d15e50b46b501a8ed55e6bc57176739f608b131245731d2af04b376d8d8
c76fbdda6b55c4014a4fd4cadc56ca2e0ca6075fa244702d02f049a5e7d202eb
c9879a8199278ae1686140c95aa6f4b90962514d6ff734877ce8f078f6220a01
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d78aea4ac1805c79b9c98c6fafb7d70544818e0461281919250769fbf3bbe986
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e0a2c557ff82f058d09f93d4ff276190915d21f7ff70155eacb74017e87463a2
e0e623e6875e227547890040f6f01f079fdc9e02456143524b369a2e4001f5c0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f17ee94784502c96f142d28971ebe8c468a64870887491269d21f523b1474742
f59085841b5eff890edddfb58d9507eaa5d2b12f42c68d5254f805450dd3de69
fcb5ee7a8fcec48a11b7adf420332a9ff2cf49f99558795d6b7b810618573e35
feffa0caa07987c670cae82d6a1c920bb0a68a2207b8f84e3a18a6ef624a0cbb

khsgdkajwuqwmas.top Open in urlscan Pro 162.0.211.207 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

90 Requests

67 %HTTPS

53 %IPv6

15 Domains

29 Subdomains

29 IPs

6 Countries

342 kBTransfer

946 kBSize

13 Cookies

0 Outgoing links

Redirected requests

90 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

khsgdkajwuqwmas.top Open in urlscan Pro
162.0.211.207 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

90
Requests

67 %
HTTPS

53 %
IPv6

15
Domains

29
Subdomains

29
IPs

6
Countries

342 kB
Transfer

946 kB
Size

13
Cookies

90 HTTP transactions
0 data transactions