urlscan.io logo urlscan.io
SecurityTrails logo

www.user-shield.com Open in urlscan Pro
2606:4700:20::681a:51  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.user-shield.com/evp-stream/?pid=adcash_int&c=257824020_23261218&af_siteid=2948337-1430586844-0&af_click_lookback...
Submission: On February 19 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 16 HTTP transactions. The main IP is 2606:4700:20::681a:51, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.user-shield.com. The Cisco Umbrella rank of the primary domain is 291982.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 10th 2021. Valid for: a year.
This is the only time www.user-shield.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
8 2606:4700:20:... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a03:2880:f02... 32934 (FACEBOOK)
2 151.101.65.44 54113 (FASTLY)
1 141.226.228.48 200478 (TABOOLA-AS)
2 2a03:2880:f12... 32934 (FACEBOOK)
16 6
8    2606:4700:20::681a:51 (United States)

ASN13335 (CLOUDFLARENET, US)
www.user-shield.com
1    2606:4700:3030::6815:212d (United States)

ASN13335 (CLOUDFLARENET, US)
www.libcdn.xyz
2    2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
2    151.101.65.44 (United States)

ASN54113 (FASTLY, US)
cdn.taboola.com
trc.taboola.com
1    141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)
trc-events.taboola.com
2    2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
Apex Domain
Subdomains		 Transfer
8 user-shield.com
www.user-shield.com — Cisco Umbrella Rank: 291982
113 KB
3 taboola.com
cdn.taboola.com — Cisco Umbrella Rank: 983
trc.taboola.com — Cisco Umbrella Rank: 571
trc-events.taboola.com — Cisco Umbrella Rank: 1715
19 KB
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 97
386 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 126
116 KB
1 libcdn.xyz
www.libcdn.xyz — Cisco Umbrella Rank: 295696
2 KB
16 5
Domain Requested by
8 www.user-shield.com www.user-shield.com
2 www.facebook.com
2 connect.facebook.net www.libcdn.xyz
connect.facebook.net
1 trc-events.taboola.com cdn.taboola.com
1 trc.taboola.com cdn.taboola.com
1 cdn.taboola.com www.libcdn.xyz
1 www.libcdn.xyz www.user-shield.com
16 7

This site contains links to these domains. Also see Links.

Domain
app.appsflyer.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-06-10 -
2022-06-09		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-11-28 -
2022-02-26		 3 months crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-28 -
2022-12-29		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.user-shield.com/evp-stream/?pid=adcash_int&c=257824020_23261218&af_siteid=2948337-1430586844-0&af_click_lookback=7d&clickid=16452498812636295693060915071516926&advertiser=105233
Frame ID: FF45D543A2DFCD59A93DFCC209996573
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

(1) Notification

Detected technologies

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery-ui.*\.js

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

5
Domains

7
Subdomains

6
IPs

3
Countries

250 kB
Transfer

782 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.user-shield.com/evp-stream/ 		18 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/evp-stream/?pid=adcash_int&c=257824020_23261218&af_siteid=2948337-1430586844-0&af_click_lookback=7d&clickid=16452498812636295693060915071516926&advertiser=105233
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bc7a72a642a06cc3818e6b958eea489b81ed6e03c41702e9e4d3de40d389071

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-type
text/html
x-amz-id-2
4PMj1hfiBz3UDyisiRoP9fvR8VfvNtgkqKgOenpmR5wHI/O6sIgV5vnDS2EVbLoT8up7tKSkDRI=
x-amz-request-id
DC3HPNCDHYY3WVB1
last-modified
Sun, 15 Nov 2020 06:59:58 GMT
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R2oGHdpKvnurbIjMPikiy9ob6Ulqvk62wrg7Mmj3UwbX6sAvaGn%2BtSHmKicOvec09qslyE6GelLihkyFIORr%2FmS8669woWoEJaHnXWcTE61jm7bf%2FFQ69i33LXZE8ji9eqAUPNSU21iwGD3yfCvhL2c%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6dfd4a9e1d199164-FRA
content-encoding
br
jquery-ui.css
www.user-shield.com/evp-stream/ 		32 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/evp-stream/jquery-ui.css
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/evp-stream/?pid=adcash_int&c=257824020_23261218&af_siteid=2948337-1430586844-0&af_click_lookback=7d&clickid=16452498812636295693060915071516926&advertiser=105233
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e50b1d7c5b9b297524faf6c1e5fc95fa08d9ccb4453a417bfa795fbdb11bb4c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
137
cf-polished
origSize=37795
x-amz-request-id
01CAKJM5S7C076EA
x-amz-id-2
HzzWoYNYmpR3Bc3JWe89MG17mJVLZZLYd7WhgUZIFZFwfPqUlPNHOulZ8daqzRuzZXxRsmGqSC8=
last-modified
Sun, 15 Nov 2020 06:59:58 GMT
server
cloudflare
etag
W/"2b068b6e7555a93ad7cb8a611fda4724"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vZhF1Ibp0Lj0R5a86LYEbw5e%2BfG0L9pDHr70gSqYcuq2qPQ1430oMz5qNPG%2B7eBoOZmnQh8szRLMhboMKYdC08oU7K7o%2BEactVvtXKHwZltcpttafBuzQBHvkB1%2BUYan%2FPbTLlTShVjE05eaJS1aE6Y%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=259200
cf-ray
6dfd4a9ebe1f9164-FRA
cf-bgj
minify
spinner.gif
www.user-shield.com/evp-stream/ 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.user-shield.com/evp-stream/spinner.gif
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/evp-stream/?pid=adcash_int&c=257824020_23261218&af_siteid=2948337-1430586844-0&af_click_lookback=7d&clickid=16452498812636295693060915071516926&advertiser=105233
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6678fbb34f3ef18c5649c7cfc1302c671ff5b1c8e9f4365fb51f3d629dab2924

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
137
cf-ray
6dfd4a9ece2b9164-FRA
content-length
19889
x-amz-id-2
83bU5Lua6HCqzMrHwMmTsJJOwOmjA364csSndjWPm6bRbDNXdh2FpP3F90VU3ChjECSa9j0B5hc=
last-modified
Sun, 15 Nov 2020 06:59:58 GMT
server
cloudflare
etag
"5e47c12dca8da91748533fd68bb806ff"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5umfd9BfuH0Yk7i6oQCqLxPsW4ZxfVB0qf4qViOroUe8GaybEwEf7pZfIZ5D4lmr29DFb12I9Axc7SwAhKr1UhRTC0U9lgBj%2BvfFjvlEZoCiCAK5mXo8T%2B4MhD24cIzYWxY7wrWwSHTjnEhFgzHBoEQ%3D"}],"group":"cf-nel","max_age":604800}
x-amz-request-id
01C8SZW3WBHK1QJD
cache-control
max-age=259200
accept-ranges
bytes
content-type
image/gif
rocket-loader.min.js
www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/evp-stream/?pid=adcash_int&c=257824020_23261218&af_siteid=2948337-1430586844-0&af_click_lookback=7d&clickid=16452498812636295693060915071516926&advertiser=105233
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 16 Feb 2022 13:46:32 GMT
server
cloudflare
etag
W/"620d0038-302c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
DENY
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=njPJgeiOXijvcJYZz1huS5P5nurgPY8QlaC02hQNAvlm0mhJNoCetwhaT9lR6jumMV7wRnKQshLEtWqKY%2BRjrVRCcw9rADqvi%2Bu2jWwosf2ccpGcb2DcDwMtvE1aHX4LE5Pf0vLZQXhZKWH8Ckckck0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=172800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
6dfd4a9ece2c9164-FRA
vary
Accept-Encoding
expires
Mon, 21 Feb 2022 06:03:20 GMT
app.js
www.user-shield.com/evp-stream/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/evp-stream/app.js
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
38ba6bac3b1a8ae17bbb45af20d0b6d333d51ecc6a8565f3240fa673f4ced18a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
137
cf-polished
origSize=4083
x-amz-request-id
MVQCGZFH0M5KP086
x-amz-id-2
bSw4LrHR6A2KrYAeQGhOmX/g9YjLEX5xIq3dEQFF525F0oKljH/SDPftMOsQKTPEoLWpQwUmXQU=
last-modified
Sun, 15 Nov 2020 06:59:58 GMT
server
cloudflare
etag
W/"d83aab44b46155bd566687aacb7364f4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Yf8QM9EaQR82rSO72iv8LaI8nb9AdcIwbCUOUiC9OMErIJxE7SjTj3pgvxR1gZAESn9FGNQc7fsUgLlmPLRNKo6A16Z%2BI3cIZzmyWdiESDYBTB%2BUnA%2FQbRTWdG39CFnQHTq267ceOiQAsWhg31OUOw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=259200
cf-ray
6dfd4a9eee639164-FRA
cf-bgj
minify
common_h.js
www.user-shield.com/common/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/common/common_h.js
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08779815d0db2fb987fea58fda561875863bbd8097528bab17ba3a864fd29e57

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
353
cf-polished
origSize=2128
x-amz-request-id
01CEA0V3JMN9S65A
x-amz-id-2
BaemtL5b/36Ex5ZO2Gh3S/ckQFFEyvRNdp3Esljd7VDzRDvh7xCT8KSAF7Gp4v9WJd2O6m/RL3g=
last-modified
Tue, 24 Aug 2021 16:47:34 GMT
server
cloudflare
etag
W/"e512fac3330354b4813254ce1019d89d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nQnIiAxtlVHRdCKttDZQgnaEdur3ic856me%2B1I5iUAs4OZiQlWd0cMoeaetX6Oqhrk3mI95Xx%2BqYbTqHOWG7zNOR%2BEzFXAF3jjap9wtunDO%2F3CSIdvqeOa%2Bu9rnc2noUkj9tYrDSUuhztoW%2BAHtzDqI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=259200
cf-ray
6dfd4a9eee659164-FRA
cf-bgj
minify
jquery-3.4.1.js
www.user-shield.com/common/ 		140 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/common/jquery-3.4.1.js
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d50d436889f46d5b9455690493e877e02ad30ea4dca963ffcaa3024c45c1d58c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
353
cf-polished
origSize=290962
x-amz-request-id
KKJXEDS6JS73DH9Q
x-amz-id-2
LfZgkTDVwYVtLhZfUuuLCg1HiFfttI14/3MvNNFowNRbqOec5rAO/kjDeZsKaaG+mjgurz3V4ng=
last-modified
Sun, 22 Aug 2021 13:47:26 GMT
server
cloudflare
etag
W/"320fa28debd36316365bb42ed6964314"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PkPg3OZS8GfBbaWJxq4mYbL8Ab7Cn%2Bf%2FvxMTWt6phVDS2TDAdl%2B4XUOZCpHBK4fV5psQ7m8%2BeV5GV6uV%2Fno4dRSFmOVJnSz2V2sBnOhkl1FpL%2Bwo9dY44uzjP5tBhwH69a8IAPl%2BC0V7%2FV3TI05pyHw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=259200
cf-ray
6dfd4a9eee679164-FRA
cf-bgj
minify
jquery.min.js
www.user-shield.com/evp-stream/ 		85 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.user-shield.com/evp-stream/jquery.min.js
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:51 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
137
x-amz-request-id
01C7VKBRF4D3RKWB
x-amz-id-2
ZonVCXMPnufjJSR0GXnY8IAcPOOygy+mNDN/5QvFiPOccQlUTaUrpUphr6FBUluP6SNPF0w8Do8=
last-modified
Sun, 15 Nov 2020 06:59:58 GMT
server
cloudflare
etag
W/"a09e13ee94d51c524b7e2a728c7d4039"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QosmE21k0blfa9le0eEwgq31x3W9S4Id12oNb%2BKTH%2BB2htLMqbv0ThGkagxlflFTlYIBKSqYh2ezEtWULPec9bKZvpV936S0TdAksS3tjrxapOg%2BCMOPWbk%2BfzC0EHr77AtAhb46ZjCQeIIEAGB90o8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=259200
cf-ray
6dfd4a9eee6a9164-FRA
retargeting.js
www.libcdn.xyz/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.libcdn.xyz/js/retargeting.js?_=1645250600827
Requested by
Host: www.user-shield.com
URL: https://www.user-shield.com/common/jquery-3.4.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:212d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e9296f5e01b66de01b50d1ebe2b65f1fb81a383971410201b2916b708bebdb7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:20 GMT
content-encoding
br
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
DC3JVB3BME8K037W
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
OihxdQRBWLs4xHB1WjYf1Ryuznyo+eJSLrcoKV3ybbe4bUNDyosFt1fc/4jf6zv4nD1i7KN1Dqc=
last-modified
Sun, 26 Jul 2020 10:08:04 GMT
server
cloudflare
etag
W/"e3b5de84e1a9a457c7755e77b2670fea"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TZ6YPjRnPkSGxFHMxii5XhRZJ8JWRMwKZTBUsB4JVJNvrzKoXVRKA4XDLx7oEqrNnmFeqnPPmdglS%2F2UQKjtCh1izvFM%2BFZbD1N6XECmnBT1lmHajQ7ciuMSQ18A%2BzRTjaENm4Q0js3HRByxfA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
6dfd4a9f9aa89072-FRA
fbevents.js
connect.facebook.net/en_US/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.libcdn.xyz
URL: https://www.libcdn.xyz/js/retargeting.js?_=1645250600827
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
27bcdc67e32fef9bdd86b785b1bafadd7f6915c49f6b49bed86bfbddf414b2f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length
26236
x-xss-protection
0
pragma
public
x-fb-debug
iN9+J+TfMyQR0lkoWJPlDp5R128bQ5OpkVpw5C5xdNsf+EFKkUJLin/3Nv3t5HmMBcusW+yDyt0LCHsCiink5w==
x-fb-trip-id
917726464
x-frame-options
DENY
date
Sat, 19 Feb 2022 06:03:21 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
tfa.js
cdn.taboola.com/libtrc/unip/1260992/ 		55 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/unip/1260992/tfa.js
Requested by
Host: www.libcdn.xyz
URL: https://www.libcdn.xyz/js/retargeting.js?_=1645250600827
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
009b3e604874503851e76115f89e95dd3c240d9160dd7e58368fe7a5aaa17d28

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-amz-version-id
vyMS4WZXMrpk993l1VBFiUSGJxvCDCVs
content-encoding
gzip
etag
"15042ecf135d1da549f0db5ffbe8431c"
age
67
x-cache
HIT
x-amz-replication-status
PENDING
content-length
17365
x-amz-id-2
dEGyfmMYVhOf/GFmRYxzOrhMGA2vT7Co4xw3TA0sC8kTR5c6nwRuQW+m4jETRWpNIknuEkhAYuE=
x-served-by
cache-hhn4080-HHN
last-modified
Sun, 13 Feb 2022 11:07:45 GMT
server
AmazonS3
x-timer
S1645250601.013894,VS0,VE1
date
Sat, 19 Feb 2022 06:03:21 GMT
vary
Accept-Encoding
x-amz-request-id
394WA4RGM0R2692A
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
15
x-cache-hits
1
262165081659310
connect.facebook.net/signals/config/ 		309 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/262165081659310?v=2.9.52&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f22c4d8923c3c349a1c46cfc546e134b92429875e353a1f7444a5a62226acecb
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection
0
pragma
public
x-fb-debug
LX9WZKpFQ1HHsYYfVmsW+Kpt1XbR40MHxWAZ1CXSSblTCHiuURw811vqL+S98OIA+hSFyoerfCMGcfPRF4iboQ==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Sat, 19 Feb 2022 06:03:23 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
json
trc.taboola.com/1260992/trc/3/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1260992/trc/3/json?tim=1645250601033&data=%7B%22id%22%3A390%2C%22ii%22%3A%22%2Fevp-stream%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1645250601029%2C%22cv%22%3A%2220220209-5-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fevp-stream%2F%3Fpid%3Dadcash_int%26c%3D257824020_23261218%26af_siteid%3D2948337-1430586844-0%26af_click_lookback%3D7d%26clickid%3D16452498812636295693060915071516926%26advertiser%3D105233%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%3Fpid%3Dadcash_int%26c%3D257824020_23261218%26af_siteid%3D2948337-1430586844-0%26af_click_lookback%3D7d%26clickid%3D16452498812636295693060915071516926%26advertiser%3D105233%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dtakoomiltd2-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1645250601032%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fwww.user-shield.com%2Fevp-stream%2F%3Fpid%3Dadcash_int%26c%3D257824020_23261218%26af_siteid%3D2948337-1430586844-0%26af_click_lookback%3D7d%26clickid%3D16452498812636295693060915071516926%26advertiser%3D105233%22%2C%22tos%22%3A0%2C%22ssd%22%3A1%2C%22scd%22%3A100%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1260992/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85f03fd3471fdfa5b6e0c7607744866ff69b5a1572a00a07f37b37db5e8d11a4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-vcl-time-ms
37
date
Sat, 19 Feb 2022 06:03:21 GMT
content-encoding
gzip
server
nginx
x-timer
S1645250601.045285,VS0,VE37
x-served-by
cache-hhn4080-HHN
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
unip
trc-events.taboola.com/1260992/log/3/ 		0
250 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1260992/log/3/unip?en=pre_d_eng_tb&tos=1551&scd=100&ssd=1&est=1645250601031&ver=35&isls=true&src=i&invt=1500&rv=1&tim=1645250602583&vi=1645250601029&ri=7f7258d133fe6bd9e5d81f89d6719df9&ref=null&cv=20220209-5-RELEASE&item-url=https%3A%2F%2Fwww.user-shield.com%2Fevp-stream%2F%3Fpid%3Dadcash_int%26c%3D257824020_23261218%26af_siteid%3D2948337-1430586844-0%26af_click_lookback%3D7d%26clickid%3D16452498812636295693060915071516926%26advertiser%3D105233
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1260992/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

access-control-allow-origin
https://www.user-shield.com
pragma
no-cache
date
Sat, 19 Feb 2022 06:03:22 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
/
www.facebook.com/tr/ 		44 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=262165081659310&ev=PageView&dl=https%3A%2F%2Fwww.user-shield.com%2Fevp-stream%2F%3Fpid%3Dadcash_int%26c%3D257824020_23261218%26af_siteid%3D2948337-1430586844-0%26af_click_lookback%3D7d%26clickid%3D16452498812636295693060915071516926%26advertiser%3D105233&rl=&if=false&ts=1645250603064&sw=1600&sh=1200&v=2.9.52&r=stable&ec=0&o=30&fbp=fb.1.1645250603062.370964216&it=1645250601026&coo=false&exp=p0&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:23 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length
44
expires
Sat, 19 Feb 2022 06:03:23 GMT
/
www.facebook.com/tr/ 		44 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=262165081659310&ev=Microdata&dl=https%3A%2F%2Fwww.user-shield.com%2Fevp-stream%2F%3Fpid%3Dadcash_int%26c%3D257824020_23261218%26af_siteid%3D2948337-1430586844-0%26af_click_lookback%3D7d%26clickid%3D16452498812636295693060915071516926%26advertiser%3D105233&rl=&if=false&ts=1645250604568&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22(1)%20Notification%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.52&r=stable&ec=1&o=30&fbp=fb.1.1645250603062.370964216&it=1645250601026&coo=false&es=automatic&tm=3&exp=p0&rqm=GET
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Sat, 19 Feb 2022 06:03:24 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority
u=3,i
expires
Sat, 19 Feb 2022 06:03:24 GMT

Verdicts & Comments Add Verdict or Comment

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| __cfQR function| $ function| jQuery string| pixelType object| text_lang object| lang_list boolean| __cfRLUnblockHandlers function| fbq function| _fbq object| _tfa function| _typeof object| TFASC object| TRC object| _taboola number| taboola_view_id object| TRCImpl function| __trcError

1 Cookies

Domain/Path Name / Value
.user-shield.com/ Name: _fbp
Value: fb.1.1645250603062.370964216