urlscan.io logo urlscan.io
SecurityTrails logo

quetzalmandarin.com Open in urlscan Pro
2a06:98c1:3121::7  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://gotogml.com/rd/c29940EitaF2364678hsKP32ZAN28272IIqU2334
Effective URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Submission: On February 23 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 5 countries across 14 domains to perform 55 HTTP transactions. The main IP is 2a06:98c1:3121::7, located in United States and belongs to CLOUDFLARENET, US. The main domain is quetzalmandarin.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 18th 2022. Valid for: a year.
This is the only time quetzalmandarin.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Customer Survey Spam (Consumer)

Domain & IP information

2    37.140.197.206 (Russian Federation)

ASN197695 (AS-REG, RU)
PTR: 37-140-197-206.cloudvps.regruhosting.ru
gotogml.com
1    193.124.15.34 (Czech Republic)

ASN49392 (ASBAXETN, RU)
cloridepink.com
1    2606:4700:3031::6815:2f0b (United States)

ASN13335 (CLOUDFLARENET, US)
fosterwheel.com
31    2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)
quetzalmandarin.com
trk-tempore.com
2    2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    143.204.201.254 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-201-254.fra53.r.cloudfront.net
sc-static.net
2    104.19.132.78 (None, )

ASN13335 (CLOUDFLARENET, US)
a.mgid.com
2    2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
3    2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
4    35.186.226.184 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 184.226.186.35.bc.googleusercontent.com
tr.snapchat.com
4    2a06:98c1:3120::7 (United States)

ASN13335 (CLOUDFLARENET, US)
event.trk-tempore.com
Apex Domain
Subdomains		 Transfer
30 quetzalmandarin.com
quetzalmandarin.com
504 KB
5 trk-tempore.com
trk-tempore.com
event.trk-tempore.com
3 KB
4 snapchat.com
tr.snapchat.com — Cisco Umbrella Rank: 943
946 B
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 97
487 B
2 gstatic.com
fonts.gstatic.com
16 KB
2 mgid.com
a.mgid.com — Cisco Umbrella Rank: 17759
6 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 126
114 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 50
97 KB
2 gotogml.com
gotogml.com — Cisco Umbrella Rank: 629695
577 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 31
341 B
1 sc-static.net
sc-static.net — Cisco Umbrella Rank: 1072
7 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35
986 B
1 fosterwheel.com
fosterwheel.com
793 B
1 cloridepink.com
cloridepink.com
505 B
55 14
Domain Requested by
30 quetzalmandarin.com cloridepink.com
quetzalmandarin.com
4 event.trk-tempore.com trk-tempore.com
4 tr.snapchat.com sc-static.net
3 www.facebook.com quetzalmandarin.com
2 fonts.gstatic.com fonts.googleapis.com
2 a.mgid.com quetzalmandarin.com
2 connect.facebook.net quetzalmandarin.com
connect.facebook.net
2 www.googletagmanager.com quetzalmandarin.com
www.googletagmanager.com
2 gotogml.com 1 redirects
1 www.google-analytics.com www.googletagmanager.com
1 sc-static.net quetzalmandarin.com
1 trk-tempore.com quetzalmandarin.com
1 fonts.googleapis.com quetzalmandarin.com
1 fosterwheel.com 1 redirects
1 cloridepink.com gotogml.com
55 15

This site contains links to these domains. Also see Links.

Domain
cartnerz.com
Subject Issuer Validity Valid
cloridepink.com
R3		 2022-02-19 -
2022-05-20		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-02-18 -
2023-02-17		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-02-07 -
2022-05-02		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-02-07 -
2022-05-02		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-12-03 -
2022-03-03		 3 months crt.sh
sc-static.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-27 -
2023-01-27		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2022-02-07 -
2022-05-02		 3 months crt.sh
tr.snapchat.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-01-13 -
2023-01-13		 a year crt.sh

This page contains 4 frames:

Primary Page: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Frame ID: 77C7C19853738C29C42E341C17D6FA59
Requests: 50 HTTP requests in this frame

Frame: https://tr.snapchat.com/cm/i?pid=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Frame ID: EAF2D49C4CA311357DF0437EE378B94B
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/p
Frame ID: 6F99F098FE2F188BDA0C00A39FDE8550
Requests: 1 HTTP requests in this frame

Frame: https://tr.snapchat.com/p
Frame ID: D55055926648331B9FA7DE6D21586388
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

[1] Prämie ausstehend - Dyson - Wir wollen Ihre Meinung!

Page URL History Show full URLs

  1. http://gotogml.com/rd/c29940EitaF2364678hsKP32ZAN28272IIqU2334 Page URL
  2. http://gotogml.com/track/c29940EitaF2364678hsKP32ZAN28272IIqU2334 HTTP 302
    https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272 Page URL
  3. https://fosterwheel.com/?s1=350946&s2=682688565&s3=2791&s4=0&s10=28 HTTP 302
    https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

55
Requests

98 %
HTTPS

64 %
IPv6

14
Domains

15
Subdomains

13
IPs

5
Countries

751 kB
Transfer

1595 kB
Size

13
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://gotogml.com/rd/c29940EitaF2364678hsKP32ZAN28272IIqU2334 Page URL
  2. http://gotogml.com/track/c29940EitaF2364678hsKP32ZAN28272IIqU2334 HTTP 302
    https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272 Page URL
  3. https://fosterwheel.com/?s1=350946&s2=682688565&s3=2791&s4=0&s10=28 HTTP 302
    https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • http://gotogml.com/track/c29940EitaF2364678hsKP32ZAN28272IIqU2334 HTTP 302
  • https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272

55 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
c29940EitaF2364678hsKP32ZAN28272IIqU2334
gotogml.com/rd/ 		235 B
352 B 		Document
General
Check archive.org
Download Go to
Full URL
http://gotogml.com/rd/c29940EitaF2364678hsKP32ZAN28272IIqU2334
Protocol
HTTP/1.1
Server
37.140.197.206 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
37-140-197-206.cloudvps.regruhosting.ru
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Content-Type
text/html; charset=utf-8
Date
Wed, 23 Feb 2022 17:36:18 GMT
Content-Length
235
2364678-32-28272
cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/
Redirect Chain
  • http://gotogml.com/track/c29940EitaF2364678hsKP32ZAN28272IIqU2334
  • https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272
130 B
505 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272
Requested by
Host: gotogml.com
URL: http://gotogml.com/rd/c29940EitaF2364678hsKP32ZAN28272IIqU2334
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.124.15.34 , Czech Republic, ASN49392 (ASBAXETN, RU),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://gotogml.com/rd/c29940EitaF2364678hsKP32ZAN28272IIqU2334

Response headers

date
Wed, 23 Feb 2022 17:36:20 GMT
content-type
text/html; charset=UTF-8
server
Apache
content-encoding
gzip
transfer-encoding
chunked
vary
Accept-Encoding

Redirect headers

Content-Type
text/html; charset=utf-8
Location
https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272
Date
Wed, 23 Feb 2022 17:36:18 GMT
Content-Length
116
Primary Request 42c908b7281c6ab3482f8ece80d015dd
quetzalmandarin.com/
Redirect Chain
  • https://fosterwheel.com/?s1=350946&s2=682688565&s3=2791&s4=0&s10=28
  • https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
57 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Requested by
Host: cloridepink.com
URL: https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db29205915744e7a0647d1c39206a1186a84a90eb5cfa0296cb8b79bd1a9db0e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://cloridepink.com/0/0/0/f1e74564fbb79a2564be8ad2b59b6b14/10/2334-29940/2364678-32-28272

Response headers

date
Wed, 23 Feb 2022 17:36:23 GMT
content-type
text/html; charset=UTF-8
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-turbo-charged-by
LiteSpeed
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hrkBlsjZxf6QflyBEyxUt9F9w1pdO1vPmaurEuKfZTEig8dADTBdh7oMevwIf6S5a7W%2Fzl5bxYl%2B5lqUjMyR3pWykx5L8pICZZQ8L%2FsmXj4O4oGHLSyNcIcyC5F6LFG3KwAgIsdl4TblVGTRQ%2B2Fc43d"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e223746cc0891dd-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date
Wed, 23 Feb 2022 17:36:21 GMT
content-type
text/html; charset=UTF-8
location
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-cache, no-store, must-revalidate, max-age=0
pragma
no-cache
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
vary
User-Agent,User-Agent
x-turbo-charged-by
LiteSpeed
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OOPDc6pmIoe9FX5YDx11IUCVuVJO2prpzU9bs%2BzpUktduMavPIAHmkvZyceHX1QPb5FivTL7TUntVJKkygoFz%2FMcdps4eW9bZdpqJmZP%2BksobrClQR6Jet34iQtPb7M2%2FgOUdTx7XG6FwXRn4%2Bw%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e22373e8d056973-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bootstrap.min.css
quetzalmandarin.com/assets/vendors/bootstrap-4.5.3/css/ 		157 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/vendors/bootstrap-4.5.3/css/bootstrap.min.css
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
25413
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 20 Aug 2021 13:04:53 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wakjWtTtkQn3Jy10XICg%2FuuphjH5zt73UDVo1a%2BUXE5Pp7E%2FpZVJ9QJitwRN1zxWWtvwyQ7jaq68kfQJ1U1tS6Dmy51oAqNFUEokqrbx9Qqxmh7UTVie4K%2F20ZZI7jIVdzdCTzCJKRddKfKOxelIJz%2BP"}],"group":"cf-nel","max_age":604800}
content-type
text/css
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223752b97691dd-FRA
expires
Wed, 02 Mar 2022 10:32:50 GMT
all.css
quetzalmandarin.com/assets/vendors/fontawesome/css/ 		72 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/vendors/fontawesome/css/all.css
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
462beb0c8ecb2abb15685c31875f268d166313581df110401c2483fab24a46df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Mon, 19 Jul 2021 19:01:59 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZypRNf%2BxXOBGV%2FazEcy7qMTM2EVi3hizsIqDFBjRTpT%2FSf1myPkz%2FonUnMR2u1LfthFWFvM1cgQJQsbTWbM1TwhdTtPMOJgsjNVwyTCxtOe4lQMXWF3Xyzpby7QIiuA4Mm8V%2FUd3TxNtRneSvHMZ7cjT"}],"group":"cf-nel","max_age":604800}
content-type
text/css
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223752b97e91dd-FRA
expires
Wed, 02 Mar 2022 17:36:23 GMT
common.css
quetzalmandarin.com/assets/css/aprilia/ 		27 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/css/aprilia/common.css?v=55a0fe5e1cadf90b8c154bcff693f485
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4608b1d1b731e007ad5275a1f37f532bdabf5eb76c93fa940bed0d785a0531d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 22 Feb 2022 20:25:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OLmvqfAdGl435XBTr6kx%2BSCJ9yX2LITXi8a12VPtEpEsk1AGH0bTEB5ct8MvlYuNCp8AV6bhQ5cAOWflbrCw7Sfe9WQfJAbuisvDLSjIweCt1lI%2BDZDomPQlzLprfjY%2B1VyHiYVfFOjn0UY2Dw74CrS4"}],"group":"cf-nel","max_age":604800}
content-type
text/css
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223752b98791dd-FRA
expires
Wed, 02 Mar 2022 17:36:23 GMT
msg.js
quetzalmandarin.com/inc/ 		941 B
790 B 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/inc/msg.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfb6708f8e8d5277007f904e261d1e4c7dc1c9240b04bbaccf4ddf472b3cc95a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
25413
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 10 Feb 2022 13:35:10 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kXLBD4EVQ8exwd2sRCgDx6UZthijqZfRGOT6SOCQob4aeOzuqk31RXZQFoqinl0ZACvDGcnDQZfynCOKkaaWcA0SVca6h3c7plZAXMa88at0rqRfkj0EQDcDv0Nijts9S6u3wC6%2FsUynnT5RXv8Gua9n"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223752b98d91dd-FRA
expires
Wed, 02 Mar 2022 10:32:50 GMT
fbcode1.js
quetzalmandarin.com/inc/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/inc/fbcode1.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43fccd349655df7497727c1c95d4fd97033f8aaf649067cbafb2b6d2751cf340
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:23 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
25413
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Wed, 07 Oct 2020 23:35:40 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OsW49PQQD0hPj96QpV%2BiKM3hVVJEjG4Fmr0RXw0ca71peY%2BzZq3Gqrg9zHgQOUjW2sAkkaQgv6i1dbG2gW%2BEoBB9gy4K53zZ%2FHk%2FuMmDqSfJdL17QsLsNeMhER2qudcSlj4saUWR4yA7csxDZBwR6JRy"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223752b99991dd-FRA
expires
Wed, 02 Mar 2022 10:32:50 GMT
972418d365a291d73fdb095b94dbd807.svg
quetzalmandarin.com/fim/28-DE/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/972418d365a291d73fdb095b94dbd807.svg
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab46cf459c603ff82541cb6d8422e39c4657e582c85f86ad3d55ffd470ecf3cf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qSzPCcxx5RItWeQ1jGi%2BZ5Jop%2FYhahEe6Z7ajI583mgyF5yke1G8RG95xf1yzKCSSI6GnhEqGsp62DHcNx9W%2Bzk1dJ%2BXHKdFOcSba2g%2Bl1zGNZaWzDKraFiUHwK3EVlxDbUnHoNXqweaq2HAStipmw6u"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e22375738109140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
3d71761aa3e8f5398eeca26b4035afce.png
quetzalmandarin.com/fim/28-DE/ 		221 KB
221 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/3d71761aa3e8f5398eeca26b4035afce.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba666e9da743215b8bb68e8281ebe1d86936618b615385b76749bed067a57986
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
225982
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zAPdTz4X64GrzZEM86zNcBPPNMMBokRHkVu1Jg76JSQCBWKhN4gyiyee7EJdJKPDjWP56gi9bv52p%2F9tcXe7ILWksSvKrfouwUZptK9Zx4KPVfVn66j5r8UjG6XUpSUvvR6qmisVDgCSxbXid0mGrZYr"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738159140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
6c6cf6aebdefd0d84e39ad6f5505b12c.svg
quetzalmandarin.com/fim/28-DE/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/6c6cf6aebdefd0d84e39ad6f5505b12c.svg
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7080e089dab3a0ae988d8605e0228194997e26bbb43079ac5772315032c966a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TLL47onXjNaetgl%2FuKl%2FlzxoM7myGIipQWKGQJW7BWkH7PBLjdyccgFlu%2F3EWNC5jZH1s4qoeZxBBEInc4Zat63o%2B0Kj7bT3EzanKX%2BPGlsSB94PiuEaxuatsj3x9NfkMbFHqxT1fm1e6C%2FTAT2UDRst"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e22375738189140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
87e808df33c97b78f52eab2768884728.png
quetzalmandarin.com/fim/28-DE/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/87e808df33c97b78f52eab2768884728.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6da5cf6e99c9e5b4eac83104070645628b698579cb3b457dbb0097befc548dc2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13039
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mXiPMzc7bCKqkGTnaggFY9WVIVOU2zK2HPu9DTvkfwc2%2FULas5%2BcfMbMB%2BUqDIU0rNIboc5plJWGMWprbto5IYxdK0OlEe8xu4B1V2IbtG6lgbgv8iSdLjD7FxUUnmetXKYqv3GC5FC2KJJYjBz4C3P1"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757381a9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
ecf3a313091b405759c221ba9504c8f2.png
quetzalmandarin.com/fim/28-DE/ 		619 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/ecf3a313091b405759c221ba9504c8f2.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e47f6803f61ca30955c2dcf1d7b2d7361891cdb2a3ad96d667f71a5079a2931
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
619
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OxsBh6n7f0KO2q54817ZDXpTIjrCmwvC41TdW6LF9N0JNMuZpYhC7VNPdqWTUZ2cNQ%2BzLCHiDqDMatjZORMSPmjdPJ6ZbaUQKln5akuxPU6Q8y0FOc5xoQ5dNrAHAOZgP9rpbarOuDuzybOK1e36oOJ7"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757381b9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
4ef065c7f57233c4442a31ebe4654818.png
quetzalmandarin.com/fim/28-DE/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/4ef065c7f57233c4442a31ebe4654818.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f98f95589e14b4ab6405c1a9dd70832ba177c05cf8aa0bb048cd4f28bd1aba1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
4862
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PFKaOzTwAQwKAfCDmwIFZ2HxpNnx5eG8Pw8kyhoa1AxwznPozJumIgVhmqazxWJpf11cAh490aV9tzxSHz9v0SxkF1WW8FxYwfRDVvS8LQQY5fv8QlCvblir6690VzFPx%2BTcsD%2FFBI9geyyHRfIvYdXj"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757381c9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
182a79fc61d5d3a76c727cddbd3f0370.png
quetzalmandarin.com/fim/28-DE/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/182a79fc61d5d3a76c727cddbd3f0370.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85e69233cd6795c61fe1383eae608d874ca8a2c87ba21027ebf7eaf238891351
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
16327
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pDNJlmqJMhHjOfY%2BSdj3aTcx4DncrYizO4pRI4PfdrTJsvt8m6nZ8%2FJsNLfv9Hqr2Of11TNlECLsvsAYW%2B2uqMumsz0uiS7QY4KlKab7nZWdts5kMZ3C5Y9inypwLeFobxyNZwc%2FIAVZBWo3Fkw5efQr"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738209140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
1d4b753c81d184b6b217af5e8fe6aee0.png
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/1d4b753c81d184b6b217af5e8fe6aee0.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
acdbb507399cf91d06d28c73e8500279d2b6eb8023cdd86b938ecac324c2fd28
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1361
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ib8AMdAilkUaUngIKvc5RIvu8dvPL8sJnSIgITmv42e%2Fj9DbB%2FCfUarDk3kJRxpxns26bZkfIW3rIBsIwaXZRaq06eqaBYIGtZTGEIuNooOEshtmtqPe59RL08BCKBRQmCljxboYnHW5yv1eFAoD22f1"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738249140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
743aff94c727813186d21b4f0918b56e.png
quetzalmandarin.com/fim/28-DE/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/743aff94c727813186d21b4f0918b56e.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d79ca3b13098126f0c0fc76aed54a8acf6e645e62eb5f0ff90571141dfe24b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
8047
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nPZn3oPC%2BrwjI2Ug5dYaj3K%2BHYWn0yiMN3ZDXA%2F06KRBwYWEv8FpZLYJu5pkgF3fDm0D02NOlA%2BK6m96EsVjw2mZyFlFNyciWkrP98re4t1kT9j5KaAdbWnGmptKO96yArT0RFUlsXNIu5bu0cmyaTQy"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738299140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
2cace384183c2c6ec511b08ae5919921.png
quetzalmandarin.com/fim/28-DE/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/2cace384183c2c6ec511b08ae5919921.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
18b60afc8548639623f2395f3f828b2ea05d029d0218b9632ee85909ef8071f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1543
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=02761YASrq2d0zDjx4EmF0Ipe0Aop7US45eHpOmyj3sgLuUMBoRUFbYXuWPVjeTx2lwKXbk%2B6ru3NLeopHjxLbA1gda2BqJO8yEtUQYoh5NAzWa3izGhKgPa7FcTKOZvW9RvkzxyadD7YIJB3xZBA%2FOF"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757382b9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
e8d150522389140d5c3e10573d2f9ded.png
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/e8d150522389140d5c3e10573d2f9ded.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a15c7fd6cff51cb3a08a1b705e578578f16f316835547063e9298a27257936b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1399
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tk%2Bi7ehreQ0g1%2F7bCPhM0K9fVGQ48vzOXkDheYjsHBWbJDvgLFWV21YbqZMn8lIlTa45GuTwNMh3nISVfi71Iur7d8Cs3edOYemMbjJPTdVNsJOkR6TX8M9xIyucs7mu7Z%2BtICYGYzKE3jZouvCYO%2B1S"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757382d9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
a26a02ec42be04f20c9326dbf7cbbcb8.png
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/a26a02ec42be04f20c9326dbf7cbbcb8.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ad0615765bf17bdb85ae307eb8f9eee2e1fb0b600117bdd991a1efe9c834078
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1385
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zbUTLuPZ08%2BD1j8rom3tFK6GCsl%2FlQ9K2E3TJejEeDzEX1QVZgExSc0smf3Ihmw2LVCYMdQ2sF7LKL8rCgj857oLMCmsHD9lrgS1tzlZD1tAqpkSuyDEA1C0HHOwZyBsbdepN%2Fo7pKQBqiLj1nvqvO%2Fi"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757382e9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
7dc2cc9c5e0e42bec4b9252b5c56a5b2.jpg
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/7dc2cc9c5e0e42bec4b9252b5c56a5b2.jpg
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b0c81aa2f2e5fda1c499501edad4927ade4d57d5d31887c076e5769e9ea2866
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1086
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:22 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2F306BkTdwQ3h3FcC1anzy2eZFnKKvqWoUY%2BDAgqZMAFVTNUVd5tWaxyApJIYTYdJMSWRUdqH9DvFGwFLLCecNjXSMCfeOr8ZP1QMJzKUGzuEzClwyIOF7ZYKJiIrXxJ8aAc8I9kBmXG07ZgdEn0Sh51"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738309140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
c75821b1aa985f70442904869f671e81.png
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/c75821b1aa985f70442904869f671e81.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4604e524a2131ee561e13c9fe760267a0bbc64ca91027ab92fd355ff4dc1514d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1120
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:23 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hoo%2BljVmXgQil2BhLoyjrzz43atPWyPWjyXlsCR7gg%2FEgUCaBVtqWHibEj%2BlIqn9LmY8%2FJgwaKfYO5fYo4YKbpEULzFm8RbnsQcuL8Zw8aCbVjQrEbMFoAP4QtZlkGEub4RxnYTTfPLindMqpdb%2BUjd9"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738319140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
e9c20c1f587521e75e165b40709e8a0b.png
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/e9c20c1f587521e75e165b40709e8a0b.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c6c0ed2601deeefd179e1922d9f017701169372b21079f842fc67e44022a126
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1188
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:23 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tX9LRBR5GkITgt%2BMz%2BoP6eeDkbHivLs2mq6XcPMQgiu6vSlc8Ab5eoXH4bRGzmBRkeIfriWF%2Bh0rjmcHG%2BteB0Dg20zUpEFLu0msfsnTlRGkLjxG7mLTj%2Bwwyem%2FvvjxDpREygZ5gneFNDoeqyk%2F%2BjQ%2B"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738339140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
54124021b9bd7b1b37b3719c700b4d1d.png
quetzalmandarin.com/fim/28-DE/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/54124021b9bd7b1b37b3719c700b4d1d.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
596505ae2d99cbcc964752ea4c998a6b51c5c829c6b8befd5ec5e90571ac6c0a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1526
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:23 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KHv8I%2BJ01WrQrMl1LMWI2YNArySzQDOpCOEpy8bCuELhZQQJhbDKy2xxTjcwYFu7uEqjPJ9O7ekhqnTz2k53hftTDROVHENAav3hqXm%2FNPjaUcDG22c0gSvESv5IqSb93tFD0%2Bz3F9NXR8ocJZHm%2Fmv%2F"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738349140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
39fd33e1bccee1adda6790a6d5b25f52.png
quetzalmandarin.com/fim/28-DE/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://quetzalmandarin.com/fim/28-DE/39fd33e1bccee1adda6790a6d5b25f52.png
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5389
x-xss-protection
1; mode=block
last-modified
Wed, 23 Feb 2022 17:36:23 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uen1Fp0L4YR3P5XvHM1pwUe2ZduDpmimiyn37fJTy9WNEYrp7YNuJToCaDD2rlki1KTw5uyBctden%2Fh5bla%2FxGGUZSsq1n5bmHv93h4fsbHK%2B7KsbXmnAEwxrwJmjt3qaUuvz0%2FHxL9fOBec7j%2BeibMT"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e22375738389140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
email-decode.min.js
quetzalmandarin.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Feb 2022 13:46:32 GMT
server
cloudflare
etag
W/"620d0038-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bfpjfBrh6V%2BwNff8kGvfMWv8JxMsJkgx396YBCm2PCY%2FILyJV%2BTakr4KA42jNob0NzdOGsLBE01l63U%2F7OhexjHuzgsXnvpybHwHleR89UH1MDmWOb%2FOEST%2FgBRnfdpowWMcf5gZzsUwJuhAV702CglQ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6e22375548ef9140-FRA
vary
Accept-Encoding
expires
Fri, 25 Feb 2022 17:36:23 GMT
jquery-3.4.1.min.js
quetzalmandarin.com/assets/vendors/ 		86 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/vendors/jquery-3.4.1.min.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 20 Aug 2021 13:04:53 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2BtaQrf8Mn%2FozK9XFd%2FWwDddIU%2FHK5B4YMtkqrmtXDnZ%2BP0sgbxti94A2tzjPRRsZbC2m2vOmnUmktoVrnxFskmaZCTGmMYJD8Kmqe1oqcX3sAeuZjVLntNpsyEFjRUoTs%2FhDpyG3dI%2B4aKi6%2BcFnKx8"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e22375589f19140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
bootstrap.min.js
quetzalmandarin.com/assets/vendors/bootstrap-4.5.3/js/ 		62 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/vendors/bootstrap-4.5.3/js/bootstrap.min.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
24888
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 20 Aug 2021 13:04:53 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fk6cVifvmiUAdYyW1GElQZERkttFUcB21ut1EOrNISiooS6zGWfgObonDc5zYoecPG4s3boJzKmD6NhGjHzYgVMpW%2F%2FB07lrbuvt2Jcfb6rQMPtGwscfi5NyAnVqPcE9p16Mboe06bAi7lGMh18LvEui"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e2237569e399140-FRA
expires
Wed, 02 Mar 2022 10:41:36 GMT
functions.js
quetzalmandarin.com/assets/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/js/functions.js?v=55a0fe5e1cadf90b8c154bcff693f485
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4287b02969d0fe7f047dfa7663cf5fe3635ad92adf1995598297917fe55b18a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 25 Mar 2021 02:06:15 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TS4cYkKMuuxdIEBAUUQdxZ0dosepR8Cik36KfZbR172pefsdxmPe7%2FnAzkxVWphTAzpSwMAWUwNAE6bK5ag0GAB9iZe4HC%2F%2B4VsFFKp%2FcqxZeatmKRRb8D%2Ba4EgHaW2B4O0ISY%2BKZ3xUefiEQB89nNrI"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223757380a9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
common.js
quetzalmandarin.com/assets/js/aprilia/ 		35 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/js/aprilia/common.js?v=55a0fe5e1cadf90b8c154bcff693f485
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5b70666f88f8ed30958d70b394ab6c64e739193334a24b1aa1c7c1736dc6145
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 22 Feb 2022 20:25:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nNolK0IK58l7IspcdQHBwcMexqkG%2FAsXO1y6bR0waOEFHEHLCwKrcZ1cpKROmnK8fBS72i7i%2BiAn0Ljsa2gPOU7f2e859Sj%2BKm8Nsd%2BHOSEp7E%2Brbh1Xca0TC7hNrZ360uTzGKprDerqxEDSpD37D1AJ"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
vary
Accept-Encoding,User-Agent,User-Agent
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
6e223757380e9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
gtm.js
www.googletagmanager.com/ 		87 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NK3N874
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
993c4624aaae44213ee9707db2f433d4067497ed04d7324cdfe2aa2cc0e6cf92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34095
x-xss-protection
0
last-modified
Wed, 23 Feb 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 23 Feb 2022 17:36:24 GMT
css2
fonts.googleapis.com/ 		2 KB
986 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@400;700&display=swap
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/assets/css/aprilia/common.css?v=55a0fe5e1cadf90b8c154bcff693f485
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2469d98cbdae0c1d6c712ecf52e2717a0baf3430f3adf1d7a8a759c9e0ac142c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 23 Feb 2022 17:29:53 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Wed, 23 Feb 2022 17:36:24 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 23 Feb 2022 17:36:24 GMT
v9e118mez8
trk-tempore.com/scripts/push/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-tempore.com/scripts/push/v9e118mez8
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/inc/msg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa4b74cc94b96ff49ac4462f2a335fcaf85777e2a8857b805d08da763d8647ff
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RaDmHWA4PC3XfereFt0WWbN5%2FZWSfwX5yBQ23SaX56l0y7R2mD1koMHe2K5Pg1R06DGWwWV0%2Fzl0skA%2Bv098TcyiQl9%2BEngpR43PgvRCORZhBBddXWBsOu0GEMjwr7zpMJphH5pgHQwhpXPEA0M%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript;charset=UTF-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
cf-ray
6e223757a9e08fd6-FRA
expires
0
fbevents.js
connect.facebook.net/en_US/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/inc/fbcode1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
26236
x-xss-protection
0
pragma
public
x-fb-debug
2jSD3HgBbUoAVEJOT/fs6bd4xbSbPRlPS8y6v9ZSNK/YqYxjmukXy0uYyOkiIKKGDGguiVaXIAh929KfRj5mrQ==
x-fb-trip-id
686109401
x-frame-options
DENY
date
Wed, 23 Feb 2022 17:36:24 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
scevent.min.js
sc-static.net/ 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sc-static.net/scevent.min.js
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/inc/fbcode1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.201.254 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-201-254.fra53.r.cloudfront.net
Software
CloudFront /
Resource Hash
af3f350dca72e0309a29b508ce47c6a81588c1f1c4925407a397c53163d541b9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
gzip
server
CloudFront
x-amz-cf-pop
FRA53-C1
x-cache
LambdaGeneratedResponse from cloudfront
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
private, s-maxage=0, max-age=600
access-control-allow-headers
Content-Type
content-length
6261
via
1.1 110641d379117242a91443ac729d6dee.cloudfront.net (CloudFront)
x-amz-cf-id
TvloawL0V_AwMbsR2revFdOksEzrkynu_MOaIgxxsd8jeia2JZw3pw==
mgsensor.js
a.mgid.com/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.mgid.com/mgsensor.js?d=1645637784184
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/inc/fbcode1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.132.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8098c6938d10947bf06e59e59b684daf1ef70c1e520bd7e6d4d85e28ee94f00

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-mg-request-uuid
a5aac904-94fe-47b0-afee-e9650c8ebb8c
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
p3p
CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cf-ray
6e2237579a8b910c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
server
cloudflare
fa-solid-900.woff2
quetzalmandarin.com/assets/vendors/fontawesome/webfonts/ 		78 KB
79 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/vendors/fontawesome/webfonts/fa-solid-900.woff2
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/assets/vendors/fontawesome/css/all.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c916669cf923b4f1b2db5c5107c83b6ca205e7ad0dcd840b251e63f0c8d28a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quetzalmandarin.com/assets/vendors/fontawesome/css/all.css
Origin
https://quetzalmandarin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
80252
x-xss-protection
1; mode=block
last-modified
Mon, 19 Jul 2021 19:01:59 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FoWEzJTvRGZc6f3LxuVJZSFffsAK%2FU%2FMsuXx2CphGTBcwpTQBpQ2Yb1dc1Jch8MWjJPYwdjSrh2FAoSA%2BtuGMXB4IXZIfFEXIRXKxgcyfcsYADEFmDxE4c0H4%2Fk1fljHhQezc42ZEFVJIKyXMvP%2Fy4JI"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757483b9140-FRA
expires
Wed, 02 Mar 2022 17:36:24 GMT
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v19/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v19/pxiEyp8kv8JHgFVrJJfecg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://quetzalmandarin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 19:31:44 GMT
x-content-type-options
nosniff
age
597880
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7884
x-xss-protection
0
last-modified
Wed, 26 Jan 2022 19:17:03 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 16 Feb 2023 19:31:44 GMT
pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v19/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://quetzalmandarin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 16 Feb 2022 19:31:44 GMT
x-content-type-options
nosniff
age
597880
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7816
x-xss-protection
0
last-modified
Wed, 26 Jan 2022 19:11:40 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Thu, 16 Feb 2023 19:31:44 GMT
fa-regular-400.woff2
quetzalmandarin.com/assets/vendors/fontawesome/webfonts/ 		13 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://quetzalmandarin.com/assets/vendors/fontawesome/webfonts/fa-regular-400.woff2
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/assets/vendors/fontawesome/css/all.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b3b8c21edfe6c5e402fdc607366fd8d15949a65914f58134733dc68922bc8d61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quetzalmandarin.com/assets/vendors/fontawesome/css/all.css
Origin
https://quetzalmandarin.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13588
x-xss-protection
1; mode=block
last-modified
Mon, 19 Jul 2021 19:01:59 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
User-Agent,User-Agent, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FruE9xeVszvpDBslvgzUZNoggJ0CDmCS02Dci84H2nfkWpSc5Uw76fMC%2FkpVCGUMpj%2FH%2FPIBEYKEZ0umSmp4cdpvylljyLOTvy5I5A01PfULgSk7f9sqXjXF1C0kXb3FUDFkiZrRkLgb2t9SYtDzaJH2"}],"group":"cf-nel","max_age":604800}
content-type
font/woff2
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
cf-ray
6e223757483d9140-FRA
expires
Wed, 02 Mar 2022 17:36:25 GMT
399694290689525
connect.facebook.net/signals/config/ 		307 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/399694290689525?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
6272eebd99425fcc8ec6a1d843d989391dadd54661536183e96dba489f04d857
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
89198
x-xss-protection
0
pragma
public
x-fb-debug
u2fMQqPigw5VBmO9anttW7CD+89S4NFkQjXkyvxsJ5tL3I5Nug6oGm0UkU5kbKeIXMSl94NMfjwdDjzTML87gw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Wed, 23 Feb 2022 17:36:24 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		173 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-JMJ044GLKX&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NK3N874
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9873b66352cb06d965c141a8a5c6a3440695cad62912d339239b7a4d995a88ee
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
65001
x-xss-protection
0
expires
Wed, 23 Feb 2022 17:36:24 GMT
/
www.facebook.com/tr/ 		44 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=399694290689525&ev=PageView&dl=https%3A%2F%2Fquetzalmandarin.com%2F42c908b7281c6ab3482f8ece80d015dd&rl=https%3A%2F%2Fcloridepink.com%2F&if=false&ts=1645637784361&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&fbp=fb.1.1645637784359.652645718&it=1645637784267&coo=false&rqm=GET
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Wed, 23 Feb 2022 17:36:24 GMT
/
www.facebook.com/tr/ 		44 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=399694290689525&ev=ViewContent&dl=https%3A%2F%2Fquetzalmandarin.com%2F42c908b7281c6ab3482f8ece80d015dd&rl=https%3A%2F%2Fcloridepink.com%2F&if=false&ts=1645637784364&sw=1600&sh=1200&v=2.9.52&r=stable&ec=1&o=30&fbp=fb.1.1645637784359.652645718&it=1645637784267&coo=false&rqm=GET
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:24 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Wed, 23 Feb 2022 17:36:24 GMT
1x1.gif
a.mgid.com/ 		43 B
397 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.mgid.com/1x1.gif?id=507061&type=c&tg=&r=https%3A%2F%2Fquetzalmandarin.com%2F42c908b7281c6ab3482f8ece80d015dd&utmc=0&utmt=0&nv=1&utms=&utmcp=&utmm=&clid=&cmgid=0&cmtid=0&cmtuid=0&d=1645637784381
Requested by
Host: quetzalmandarin.com
URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.132.78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Feb 2022 17:36:24 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
6e22375899c992b9-FRA
p3p
CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cache-control
max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
collect
www.google-analytics.com/g/ 		0
341 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-JMJ044GLKX&gtm=2oe2g0&_p=1605127473&sr=1600x1200&ul=en-us&cid=1430783329.1645637784&_s=1&dl=https%3A%2F%2Fquetzalmandarin.com%2F42c908b7281c6ab3482f8ece80d015dd&dr=https%3A%2F%2Fcloridepink.com%2F&dt=%5B1%5D%20Pr%C3%A4mie%20ausstehend%20-%20Dyson%20-%20Wir%20wollen%20Ihre%20Meinung!&sid=1645637784&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JMJ044GLKX&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 23 Feb 2022 17:36:24 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://quetzalmandarin.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
is_enabled
tr.snapchat.com/collector/ 		46 B
313 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/collector/is_enabled?pids=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Requested by
Host: sc-static.net
URL: https://sc-static.net/scevent.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
6ca85050a0100ca28b3ab77cb0e059dafe18082b35e45ac2d9fc77aca5857775
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
via
1.1 google
server
nginx/1.19.6
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46
i
tr.snapchat.com/cm/ Frame EAF2 		0
241 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/cm/i?pid=cc25c7df-1e44-4f51-8ff1-8c175d6334c1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/

Response headers

server
nginx/1.19.6
date
Wed, 23 Feb 2022 17:36:25 GMT
content-type
text/html
content-length
0
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
p
tr.snapchat.com/ Frame 6F99 		0
206 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/p
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
Origin
https://quetzalmandarin.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/

Response headers

server
nginx/1.19.6
date
Wed, 23 Feb 2022 17:36:25 GMT
content-type
text/html
content-length
0
access-control-allow-origin
*
cache-control
no-cache, no-transform
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
p
tr.snapchat.com/ Frame D550 		0
186 B 		Document
General
Check archive.org
Download Go to
Full URL
https://tr.snapchat.com/p
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.226.184 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
184.226.186.35.bc.googleusercontent.com
Software
nginx/1.19.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
Origin
https://quetzalmandarin.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/

Response headers

server
nginx/1.19.6
date
Wed, 23 Feb 2022 17:36:25 GMT
content-type
text/html
content-length
0
access-control-allow-origin
*
cache-control
no-cache, no-transform
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
v9e118mez8
event.trk-tempore.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Requested by
Host: trk-tempore.com
URL: https://trk-tempore.com/scripts/push/v9e118mez8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quetzalmandarin.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-type
application/json

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
expires
0
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=buq52Jc6%2F%2BSGSISr%2FglKd6kP%2F%2BhwxB2krIMEESPYlDHeaa2Ezfc41jgr3Dt8tsS0RroVOfFQhYPWvIPRNhf4ILqhwilZnC%2Fpi0%2FyQC1ybuIbGKu%2B3gu1Ulf2uFYSQ9FkF6cpJkSekRZAYx%2BmHN1hlt6REeg%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://quetzalmandarin.com
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
access-control-allow-credentials
true
cf-ray
6e2237603b1b8ff8-FRA
x-pushplatformapp-params
v9e118mez8
event.trk-tempore.com/register/event_log/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://quetzalmandarin.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
content-length
0
access-control-allow-headers
content-type
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-allow-origin
https://quetzalmandarin.com
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials
true
access-control-allow-methods
POST
access-control-max-age
1800
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nvBs4LN7h3eqPKMZ84UWaBZPzeo3%2F2PVPxOhXGifMhNFYG5VM3E9fvMwOrLtZPz2%2BO8dRNzUyxX4W3Q4jm1sjFAExQ7f0BwgUlVYkAMUGME%2BVyC6u7%2BHL1K9vMFCJlsFD1bidNe1m9vLuTdXpr5YOC%2BUE84%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e22375ebc4d9280-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
v9e118mez8
event.trk-tempore.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Requested by
Host: trk-tempore.com
URL: https://trk-tempore.com/scripts/push/v9e118mez8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://quetzalmandarin.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-type
application/json

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
expires
0
server
cloudflare
x-frame-options
DENY
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L8Ko1I1BeUYKjVeZvlvizwal8HBKttumRPEeopffT0kdLiAGSIU4Bcd35a0%2BdXU6wcPWkc27F2yMJF%2BzgzFsJtYJndxG6N5Tu7y0%2Ff2vxgkQOZxq6aSjOj6IYj1l6OtdSB7xZFAWhksyjfVFqBXbOwuD%2FkI%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://quetzalmandarin.com
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; fullscreen 'self'; payment 'none'
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
access-control-allow-credentials
true
cf-ray
6e2237603b178ff8-FRA
x-pushplatformapp-params
v9e118mez8
event.trk-tempore.com/register/event_log/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-tempore.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://quetzalmandarin.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
content-length
0
access-control-allow-headers
content-type
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-allow-origin
https://quetzalmandarin.com
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-credentials
true
access-control-allow-methods
POST
access-control-max-age
1800
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=01qVI70jLOfRBY%2FCgTHEltAiodIm8Ewk3mxYG0SM6JZghbru7a6VOzOdXeMx%2FYr5%2F39lr5edhdN1qJyU%2BWWl5QQIMGnSVF6Mq9I45%2BL%2BU9fiGQIxDxWBQFO4fmKjpYKBFl%2BPBGXE15XNVc6fv9St75yKJOs%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6e22375ebc549280-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=399694290689525&ev=Microdata&dl=https%3A%2F%2Fquetzalmandarin.com%2F42c908b7281c6ab3482f8ece80d015dd&rl=https%3A%2F%2Fcloridepink.com%2F&if=false&ts=1645637785865&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%5B1%5D%20Pr%C3%A4mie%20ausstehend%20-%20Dyson%20-%20Wir%20wollen%20Ihre%20Meinung!%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.52&r=stable&ec=2&o=30&fbp=fb.1.1645637784359.652645718&it=1645637784267&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://quetzalmandarin.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Wed, 23 Feb 2022 17:36:25 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Wed, 23 Feb 2022 17:36:25 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Customer Survey Spam (Consumer)

94 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| dataLayer object| MYCALL string| s1 string| s2 string| esource string| pshpub string| pshdomain function| fbq function| _fbq function| snaptr object| r object| MgSensorData object| snaptrContext boolean| triedToSendCookieToNative object| WebJSBridge object| google_tag_manager object| MgSensor function| MgSensorInvoke function| MgSensorInvoke0 object| _mgq function| _mgqp number| _mgqt number| _mgqi object| _mgr object| _mghl object| google_tag_data object| gaGlobal function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore function| $ function| jQuery object| bootstrap function| datehax function| startTimer string| attrChoices string| domain number| count string| pipeline string| zipcode string| state_selected object| states function| birthdayFill function| beforeShowQuestion function| showOfferWall function| createQuestion function| nextQuestion function| replaceUrlParam function| startsurvey number| box_trying boolean| oneclick function| formatPhoneNumber function| switchTypeQuestions function| validatePhone function| validateEmail function| validateZip function| sendZipIp function| validateHeightF function| validateHeightI function| validateWeight function| validateAll function| validateName function| validateLName function| validateBirthday function| days function| daysInMonth function| dashedNumber function| alpha function| validateKeyStrokes function| showStreetState function| leadgenForm function| showDisclaimer function| preventS number| answered number| prevProgress number| stepsTotal number| progress string| cheerstx string| txt function| cheers function| onYouTubeIframeAPIReady

13 Cookies

Domain/Path Name / Value
sc-static.net/scevent.min.js Name: X-AB
Value: 0d6e407936704bd380072f5891d28b0e
cloridepink.com/ Name: uid2791
Value: 682688565-20220223123619-4bc7106784929d88713e33ccfb38fe2f-
fosterwheel.com/ Name: PHPSESSID
Value: a5cf964f4182a5dea31c347fe40ff2ee
quetzalmandarin.com/ Name: PHPSESSID
Value: a42c91132d4b995b236ecfecfcebf522
.quetzalmandarin.com/ Name: _fbp
Value: fb.1.1645637784359.652645718
.mgid.com/ Name: muidn
Value: m1nok4WP7QA9
.mgid.com/ Name: __cf_bm
Value: 3f55d3026e139e32e404664a905bd847f257d76b-1645637784-0-AeO9Ivq9KLkDAdAvj8TGLxKJofANRuDlYF2iLbGTpzi9TzNcC2u2gwb1bo5N/fRhl/zX8sAQ45B2v6SMOQ5swB4=
quetzalmandarin.com/ Name: MgidSensorNVis
Value: 1
quetzalmandarin.com/ Name: MgidSensorHref
Value: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
.quetzalmandarin.com/ Name: _ga_JMJ044GLKX
Value: GS1.1.1645637784.1.0.1645637784.0
.quetzalmandarin.com/ Name: _ga
Value: GA1.1.1430783329.1645637784
.quetzalmandarin.com/ Name: _scid
Value: 5bb8fdc5-ce3f-41cf-9a6e-3a3707ffe2a1
.snapchat.com/ Name: sc_at
Value: v2|H4sIAAAAAAAAAAXBgRUAIAQFwIm8V/2QcSKmMHx3z9IqRCkNRnvhkh8oOaYzV7yo1T1ls0D1cI8PtxDexzIAAAA=

1 Console Messages

Source Level URL
Text
other error URL: https://quetzalmandarin.com/42c908b7281c6ab3482f8ece80d015dd
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.mgid.com
cloridepink.com
connect.facebook.net
event.trk-tempore.com
fonts.googleapis.com
fonts.gstatic.com
fosterwheel.com
gotogml.com
quetzalmandarin.com
sc-static.net
tr.snapchat.com
trk-tempore.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
104.19.132.78
143.204.201.254
193.124.15.34
2606:4700:3031::6815:2f0b
2a00:1450:4001:808::200a
2a00:1450:4001:808::200e
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2008
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a06:98c1:3120::7
2a06:98c1:3121::7
35.186.226.184
37.140.197.206
0ad0615765bf17bdb85ae307eb8f9eee2e1fb0b600117bdd991a1efe9c834078
0d79ca3b13098126f0c0fc76aed54a8acf6e645e62eb5f0ff90571141dfe24b2
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
18b60afc8548639623f2395f3f828b2ea05d029d0218b9632ee85909ef8071f4
2469d98cbdae0c1d6c712ecf52e2717a0baf3430f3adf1d7a8a759c9e0ac142c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
2b0c81aa2f2e5fda1c499501edad4927ade4d57d5d31887c076e5769e9ea2866
2e47f6803f61ca30955c2dcf1d7b2d7361891cdb2a3ad96d667f71a5079a2931
3c6c0ed2601deeefd179e1922d9f017701169372b21079f842fc67e44022a126
4287b02969d0fe7f047dfa7663cf5fe3635ad92adf1995598297917fe55b18a0
43fccd349655df7497727c1c95d4fd97033f8aaf649067cbafb2b6d2751cf340
4604e524a2131ee561e13c9fe760267a0bbc64ca91027ab92fd355ff4dc1514d
4608b1d1b731e007ad5275a1f37f532bdabf5eb76c93fa940bed0d785a0531d2
462beb0c8ecb2abb15685c31875f268d166313581df110401c2483fab24a46df
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
596505ae2d99cbcc964752ea4c998a6b51c5c829c6b8befd5ec5e90571ac6c0a
5f98f95589e14b4ab6405c1a9dd70832ba177c05cf8aa0bb048cd4f28bd1aba1
6272eebd99425fcc8ec6a1d843d989391dadd54661536183e96dba489f04d857
6c916669cf923b4f1b2db5c5107c83b6ca205e7ad0dcd840b251e63f0c8d28a2
6ca85050a0100ca28b3ab77cb0e059dafe18082b35e45ac2d9fc77aca5857775
6da5cf6e99c9e5b4eac83104070645628b698579cb3b457dbb0097befc548dc2
7080e089dab3a0ae988d8605e0228194997e26bbb43079ac5772315032c966a2
7a15c7fd6cff51cb3a08a1b705e578578f16f316835547063e9298a27257936b
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
85e69233cd6795c61fe1383eae608d874ca8a2c87ba21027ebf7eaf238891351
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
9873b66352cb06d965c141a8a5c6a3440695cad62912d339239b7a4d995a88ee
993c4624aaae44213ee9707db2f433d4067497ed04d7324cdfe2aa2cc0e6cf92
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
aa4b74cc94b96ff49ac4462f2a335fcaf85777e2a8857b805d08da763d8647ff
ab46cf459c603ff82541cb6d8422e39c4657e582c85f86ad3d55ffd470ecf3cf
acdbb507399cf91d06d28c73e8500279d2b6eb8023cdd86b938ecac324c2fd28
af3f350dca72e0309a29b508ce47c6a81588c1f1c4925407a397c53163d541b9
b3b8c21edfe6c5e402fdc607366fd8d15949a65914f58134733dc68922bc8d61
ba666e9da743215b8bb68e8281ebe1d86936618b615385b76749bed067a57986
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
cfb6708f8e8d5277007f904e261d1e4c7dc1c9240b04bbaccf4ddf472b3cc95a
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
db29205915744e7a0647d1c39206a1186a84a90eb5cfa0296cb8b79bd1a9db0e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8098c6938d10947bf06e59e59b684daf1ef70c1e520bd7e6d4d85e28ee94f00
f5b70666f88f8ed30958d70b394ab6c64e739193334a24b1aa1c7c1736dc6145
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194