urlscan.io logo urlscan.io
SecurityTrails logo

vmi457887.contaboserver.net Open in urlscan Pro
207.244.225.110  Public Scan

Go To Rescan Add Verdict Report
URL: https://vmi457887.contaboserver.net/
Submission: On October 03 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 3 countries across 8 domains to perform 28 HTTP transactions. The main IP is 207.244.225.110, located in St Louis, United States and belongs to CONTABO, US. The main domain is vmi457887.contaboserver.net.
TLS certificate: Issued by R3 on August 16th 2022. Valid for: 3 months.
This is the only time vmi457887.contaboserver.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

6    207.244.225.110 (St Louis, United States)

ASN40021 (CONTABO, US)
PTR: LightWizzard.com
vmi457887.contaboserver.net
6    2a00:1450:400d:806::2002 (Ireland)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    2a00:1450:400d:804::200e (Ireland)

ASN15169 (GOOGLE, US)
translate.google.com
2    2a00:1450:400d:80d::2002 (Ireland)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
3    2a00:1450:400d:80d::200a (Ireland)

ASN15169 (GOOGLE, US)
translate.googleapis.com
1    142.251.39.2 (United States)

ASN15169 (GOOGLE, US)
PTR: bud02s37-in-f2.1e100.net
partner.googleadservices.com
1    2a00:1450:400d:80e::2002 (Ireland)

ASN15169 (GOOGLE, US)
adservice.google.de
1    2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
2    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2a00:1450:400d:807::2004 (Ireland)

ASN15169 (GOOGLE, US)
www.google.com
3    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
Apex Domain
Subdomains		 Transfer
9 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 131
tpc.googlesyndication.com — Cisco Umbrella Rank: 170
207 KB
6 contaboserver.net
vmi457887.contaboserver.net
531 KB
4 google.com
translate.google.com — Cisco Umbrella Rank: 2189
adservice.google.com — Cisco Umbrella Rank: 136
www.google.com — Cisco Umbrella Rank: 19
28 KB
3 googleapis.com
translate.googleapis.com — Cisco Umbrella Rank: 1683
100 KB
2 gstatic.com
www.gstatic.com
3 KB
2 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 68
5 KB
1 google.de
adservice.google.de — Cisco Umbrella Rank: 5221
792 B
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 1003
647 B
28 8
Domain Requested by
6 pagead2.googlesyndication.com vmi457887.contaboserver.net
pagead2.googlesyndication.com
tpc.googlesyndication.com
6 vmi457887.contaboserver.net vmi457887.contaboserver.net
3 tpc.googlesyndication.com pagead2.googlesyndication.com
tpc.googlesyndication.com
3 translate.googleapis.com translate.googleapis.com
2 www.google.com vmi457887.contaboserver.net
tpc.googlesyndication.com
2 www.gstatic.com translate.googleapis.com
vmi457887.contaboserver.net
2 googleads.g.doubleclick.net pagead2.googlesyndication.com
1 adservice.google.com pagead2.googlesyndication.com
1 adservice.google.de pagead2.googlesyndication.com
1 partner.googleadservices.com pagead2.googlesyndication.com
1 translate.google.com vmi457887.contaboserver.net
28 11

This site contains links to these domains. Also see Links.

Domain
lightwizzard.com
trinaryuniversity.org
www.lulu.com
www.amazon.com
github.com
trinaryscience.com
Subject Issuer Validity Valid
lightwizzard.com
R3		 2022-08-16 -
2022-11-14		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
*.googleadservices.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
*.google.de
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-09-12 -
2022-12-05		 3 months crt.sh

This page contains 7 frames:

Primary Page: https://vmi457887.contaboserver.net/
Frame ID: 4E12BF50F69F39578567FFE24E70E368
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220928/r20190131/zrt_lookup.html
Frame ID: 68B50560A98BD671EA52277E841170EE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1234567890123456&output=html&adk=1812271804&adf=3025194257&lmt=1657649831&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fvmi457887.contaboserver.net%2F&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1664829504907&bpp=4&bdt=258&idt=148&shv=r20220928&mjsv=m202209270101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1228184273580&frm=20&pv=2&ga_vid=683223130.1664829505&ga_sid=1664829505&ga_hid=598491688&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31069993&oid=2&pvsid=2285555852343451&tmod=1775003576&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=1&uci=a!1&fsb=1&dtd=161
Frame ID: 89F92BA68E77F4622D88BEA815D9EDBB
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 4AC1F16209C72A30879D6042B7CF4EC5
Requests: 1 HTTP requests in this frame

Frame: https://translate.googleapis.com/translate_static/css/translateelement.css
Frame ID: 3FEACA20989B66EB364A5DD3AE46946A
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 28900EBC9AF1B05480491EC37D40FCC0
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 81B324D151E114EA8AC2DA7BC75A73F9
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

The Light Wizzard in the Flesh

Detected technologies

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/

Page Statistics

28
Requests

79 %
HTTPS

82 %
IPv6

8
Domains

11
Subdomains

12
IPs

3
Countries

877 kB
Transfer

1508 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
vmi457887.contaboserver.net/ 		19 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.244.225.110 St Louis, United States, ASN40021 (CONTABO, US),
Reverse DNS
LightWizzard.com
Software
Apache /
Resource Hash
25132f645d02922a99945d6d0989ff1bf527ac2587798af7570c999d21e4a6ba

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
19941
content-type
text/html; charset=UTF-8
date
Mon, 03 Oct 2022 20:38:24 GMT
etag
"4de5-5e39fad56b7c0"
last-modified
Tue, 12 Jul 2022 18:17:11 GMT
server
Apache
1doc2rule.min.css
vmi457887.contaboserver.net/ 		19 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://vmi457887.contaboserver.net/1doc2rule.min.css
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.244.225.110 St Louis, United States, ASN40021 (CONTABO, US),
Reverse DNS
LightWizzard.com
Software
Apache /
Resource Hash
746610bf42d9c38151f7a1eb423fb5b049795e4bc1c4dcdd9d3e2f35314b68b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
last-modified
Mon, 11 Jan 2021 03:08:23 GMT
server
Apache
accept-ranges
bytes
etag
"4dd2-5b897380557c0"
content-length
19922
content-type
text/css
1doc2rule.min.js
vmi457887.contaboserver.net/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vmi457887.contaboserver.net/1doc2rule.min.js
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.244.225.110 St Louis, United States, ASN40021 (CONTABO, US),
Reverse DNS
LightWizzard.com
Software
Apache /
Resource Hash
722d0f3bee16fcb67bcf7e413fecd98e3d19b9247b8d008d1a86593684617dd0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
last-modified
Mon, 11 Jan 2021 03:08:22 GMT
server
Apache
accept-ranges
bytes
etag
"a17-5b89737f61580"
content-length
2583
content-type
application/javascript
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ 		162 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1234567890123456
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
46a584fa6b26a936f903d62c68f038be1a5d63bfff9c4434999d0092e89e7eae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54689
x-xss-protection
0
server
cafe
etag
18418001045641620527
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 03 Oct 2022 20:38:24 GMT
element.js
translate.google.com/translate_a/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:804::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1012834ca5bf8ff91dbd9d1700bda3386303e4eed1d98a2d1e6580a75a06d28d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 03 Oct 2022 20:38:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
expires
Mon, 01 Jan 1990 00:00:00 GMT
favicon.ico
vmi457887.contaboserver.net/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://vmi457887.contaboserver.net/favicon.ico
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/1doc2rule.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.244.225.110 St Louis, United States, ASN40021 (CONTABO, US),
Reverse DNS
LightWizzard.com
Software
Apache /
Resource Hash
2affb3f86a1c3db09d304bdc82a337cccda2fdf65c1b453cd774bc6bcc61ce48

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/1doc2rule.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
last-modified
Wed, 20 Jan 2016 02:31:00 GMT
server
Apache
accept-ranges
bytes
etag
"436-529bac6d42100"
content-length
1078
content-type
image/vnd.microsoft.icon
lightwizzard.ttf
vmi457887.contaboserver.net/fonts/ 		334 KB
337 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://vmi457887.contaboserver.net/fonts/lightwizzard.ttf
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/1doc2rule.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.244.225.110 St Louis, United States, ASN40021 (CONTABO, US),
Reverse DNS
LightWizzard.com
Software
Apache /
Resource Hash
226a49ddba006a29a70036c3b4140953202a4bfb4b3b7847afd452755146172b

Request headers

Referer
https://vmi457887.contaboserver.net/1doc2rule.min.css
Origin
https://vmi457887.contaboserver.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
last-modified
Tue, 28 Jan 2020 23:33:59 GMT
server
Apache
accept-ranges
bytes
etag
"53910-59d3ba87dc7c0"
content-length
342288
content-type
font/ttf
mono.ttf
vmi457887.contaboserver.net/fonts/ 		151 KB
152 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://vmi457887.contaboserver.net/fonts/mono.ttf
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/1doc2rule.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.244.225.110 St Louis, United States, ASN40021 (CONTABO, US),
Reverse DNS
LightWizzard.com
Software
Apache /
Resource Hash
6bc028e0452a474bfef8012b143f05f026a157ef76f742800b6ac3b03b91f136

Request headers

Referer
https://vmi457887.contaboserver.net/1doc2rule.min.css
Origin
https://vmi457887.contaboserver.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
last-modified
Wed, 22 Jan 2020 05:44:53 GMT
server
Apache
accept-ranges
bytes
etag
"25a28-59cb4060b3f40"
content-length
154152
content-type
font/ttf
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/ 		349 KB
115 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1234567890123456
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b15b4ed17362cf2f2f37ee2a456a3c6b040ef153821ec30d41834b92643218b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:24 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
117170
x-xss-protection
0
server
cafe
etag
12278090285644547768
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 03 Oct 2022 20:38:24 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20220928/r20190131/ Frame 68B5 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20220928/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-1234567890123456
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://vmi457887.contaboserver.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
80271
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=1209600
content-encoding
gzip
content-length
4420
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 02 Oct 2022 22:20:34 GMT
etag
9671129459699598864
expires
Sun, 16 Oct 2022 22:20:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
translateelement.css
translate.googleapis.com/translate_static/css/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/translate_static/css/translateelement.css
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.n5VdVz6eb04.O/d=1/rs=AN8SPfqVRgLwAFfGrWE2BVtm80bN0uyr5A/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d39ee51a9c2d61184a78111c731cce4b32488c99bcc9b1f8c236705d06145166
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:13:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1497
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3619
x-xss-protection
0
last-modified
Wed, 17 Aug 2022 23:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Mon, 03 Oct 2022 21:13:28 GMT
m=el_main
translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.n5VdVz6eb04.O/d=1/exm=el_conf/ed=1/rs=AN8SPfqVRgLwAFfGrWE2BVtm80bN0uyr5A/ 		262 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.n5VdVz6eb04.O/d=1/exm=el_conf/ed=1/rs=AN8SPfqVRgLwAFfGrWE2BVtm80bN0uyr5A/m=el_main
Requested by
Host:
URL: /_/translate_http/_/js/k=translate_http.tr.de.n5VdVz6eb04.O/d=1/rs=AN8SPfqVRgLwAFfGrWE2BVtm80bN0uyr5A/m=el_conf
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80d::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
522219c3978b635866d1f45a2d0a6438c5a7cee401b7d4a8c22f22c3ed3079d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 20:29:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
346126
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
93874
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 05:12:45 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Fri, 29 Sep 2023 20:29:39 GMT
cookie.js
partner.googleadservices.com/gampad/ 		221 B
647 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=vmi457887.contaboserver.net&callback=_gfp_s_&client=ca-pub-1234567890123456
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.39.2 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bud02s37-in-f2.1e100.net
Software
cafe /
Resource Hash
488f709f5a5a7e266f7ad486d8ffaa69c0444d83766961584a0a3d39dfb37700
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
203
x-xss-protection
0
integrator.js
adservice.google.de/adsid/ 		107 B
792 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.de/adsid/integrator.js?domain=vmi457887.contaboserver.net
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80e::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=vmi457887.contaboserver.net
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 89F9 		603 B
68 B 		Document
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1234567890123456&output=html&adk=1812271804&adf=3025194257&lmt=1657649831&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fvmi457887.contaboserver.net%2F&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1664829504907&bpp=4&bdt=258&idt=148&shv=r20220928&mjsv=m202209270101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1228184273580&frm=20&pv=2&ga_vid=683223130.1664829505&ga_sid=1664829505&ga_hid=598491688&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31069993&oid=2&pvsid=2285555852343451&tmod=1775003576&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=33792&bc=31&ifi=1&uci=a!1&fsb=1&dtd=161
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://vmi457887.contaboserver.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 03 Oct 2022 20:38:25 GMT
expires
Mon, 03 Oct 2022 20:38:25 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 4AC1 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f10fc73f171d7f29cf50a928c6e1752c21bbeae061df4b85867915740372d531

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Type
text/html;charset=UTF-8
translate_24dp.png
www.gstatic.com/images/branding/product/2x/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/2x/translate_24dp.png
Requested by
Host: translate.googleapis.com
URL: https://translate.googleapis.com/translate_static/css/translateelement.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://translate.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:22:39 GMT
x-content-type-options
nosniff
age
946
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1842
x-xss-protection
0
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 03 Oct 2023 20:22:39 GMT
translateelement.css
translate.googleapis.com/translate_static/css/ Frame 3FEA 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://translate.googleapis.com/translate_static/css/translateelement.css
Requested by
Host: translate.googleapis.com
URL: https://translate.googleapis.com/_/translate_http/_/js/k=translate_http.tr.de.n5VdVz6eb04.O/d=1/exm=el_conf/ed=1/rs=AN8SPfqVRgLwAFfGrWE2BVtm80bN0uyr5A/m=el_main
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:80d::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d39ee51a9c2d61184a78111c731cce4b32488c99bcc9b1f8c236705d06145166
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:13:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1497
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/rosetta
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3619
x-xss-protection
0
last-modified
Wed, 17 Aug 2022 23:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="rosetta"
vary
Accept-Encoding
report-to
{"group":"rosetta","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/rosetta"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Mon, 03 Oct 2022 21:13:28 GMT
translate_24dp.png
www.gstatic.com/images/branding/product/1x/ 		846 B
936 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/product/1x/translate_24dp.png
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 18:03:58 GMT
x-content-type-options
nosniff
age
9267
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
846
x-xss-protection
0
last-modified
Thu, 14 Oct 2021 09:08:00 GMT
server
sffe
vary
Origin
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 03 Oct 2023 18:03:58 GMT
cleardot.gif
www.google.com/images/ 		43 B
598 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/images/cleardot.gif
Requested by
Host: vmi457887.contaboserver.net
URL: https://vmi457887.contaboserver.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 03 Oct 2022 20:38:25 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:30:00 GMT
server
sffe
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220928&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b65dc54df7f6a931b2fb8e5ffbb474da21bf144d395c961d5ce1c95647951746
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11217
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209270101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-1234567890123456&plah=vmi457887.contaboserver.net&bust=31069993
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 03 Oct 2022 20:38:28 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 2890 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://vmi457887.contaboserver.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
13053
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 03 Oct 2022 17:00:55 GMT
expires
Tue, 03 Oct 2023 17:00:55 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 81B3 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f7b3ecf4a29b8fc6b5a0354bc8218ef7aeffb267384e87b91848c20ea91e1ebb
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-dVJ2UWRFwTGyvYwfN1dyfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://vmi457887.contaboserver.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
513
content-security-policy
script-src 'report-sample' 'nonce-dVJ2UWRFwTGyvYwfN1dyfA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 03 Oct 2022 20:38:28 GMT
expires
Mon, 03 Oct 2022 20:38:28 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js
pagead2.googlesyndication.com/bg/ Frame 2890 		36 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 11:36:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
32510
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15918
x-xss-protection
0
last-modified
Tue, 27 Sep 2022 16:58:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 03 Oct 2023 11:36:38 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 81B3 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220928&jk=2285555852343451&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers
generate_204
tpc.googlesyndication.com/ Frame 2890 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?OuJk2Q
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Mon, 03 Oct 2022 20:38:28 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220928&jk=2285555852343451&bg=!2dql2p7NAAYQgTJdMIE7ACkAdvg8WkoDLL1C9iPU0sXdO1nf5d4BRE_ZIQN2mR6wK7FuyFhA4GN8nAIAAABWUgAAAANoAQcKAMjm8A4YPlGHEYUHHVadjSEHzx4pWNb2DQicK6tu2yZU4uAlO6nFUUtPb574t4nTUvfgmiGgyLERPbfZ239yETlrhEZ_e9wd00q6h6sQ-kAdu78UcgBMK4kL40Cf3fHA8MGhl2uitrt0rbTW55UeitEoh54O-H7tu3rnQcdHl-6wXH9snsbj4qEJVvxwlYUO2OVNMcPbhQpq5kmrBrbyxbZ4UBFtlUcxZ6fjr0RkrfY04QhnUUQEFIfvdht2pV5t2CbOSfbXDcRyEpkCr0KB4QKvY3xS6igcRPiFe8gDM4ykSbe6DGNUZKDH98jeTRkcbd4bGEl2jvDC2gsJTqsYPzLLSGfIAyWunjpoSnL4Fc91jEy3GKu2mzgE1oWqNU3U70vGlnjZZidP7bOMeU5c6yz-5iucm5WGujQnqc6Cf87VR_XV7D4CwOloswQhrPywPTkwxdmUF3OIm_2r8kyEBaLHa3AtvQs62aXmzbH4KZty3imlQpZt1WAwgePDIXKezp6htrxW2f88Erzh7H1h-mVib92raC_XqefaKDHccQXl75_2myNfIo_WKMHczR0Zi5mQy29AObfI8aUYN_XFlg9hA5FB-Y3bVfgHUGy6cZBqY7M1Zs5cJ42xQHw-g33_HT1VslJwcAhvdQWVX1KR1eRyWC-cxcWSRy9Z_-T6G8YcztUB06Ebjd2G5xp7cm56_Ryr5bwcviVdD6PJixpNf_mxKV_ExHN1glweNhv-JV7sjKWcLC1K9raC41z-w291donhETwSbLPV2jddVlTNJiimqD8MR4onezA-nuT5TzeG-f9jEthv3thqlC8CYMQcRuRJj0zDUNlk5TY0KyY9d_ejzdKtztM5dG1CcJRIvoyL8BnWPkCZSPgu_rLHI0A0Tn7Kj0NHjnYykCu48iAZ3ZozHvuXD8di5HpP1uGt8xMtPutaT3AgyS-YqLBgDux4SGpvRkgEZh4vD6_AUNFIrxu3mPYzlzmpjwIKxgcldgRTAhKlVy1bccK44RFEq-7QySVe-JToMvts89xOwRWNB30hZZ2UrWC7oQ0fh5CcIeQToXznNPztgKXZQEbBIRFsWXJvyVXSabNDCxs7iV1MEv9eP0POxZb6HU9jXAniFmSXwnzRPTJaMg0hhf3dh3UusHAF97zdO8ddhjJc4HYns6WgapnyunTLsL4czA
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:806::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://vmi457887.contaboserver.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

107 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| googleTranslateElementInit function| subst function| numberWithCommas function| goBack function| targetBlank function| AddAttribute function| setAgent object| google_js_reporting_queue number| google_srt object| google_logging_queue number| tmod object| google_ad_modifications object| ggeac object| google_persistent_state_async boolean| google_measure_js_timing object| google_tag_data object| google_reactive_ads_global_state object| adsbygoogle boolean| _gfp_a_ object| google_sa_queue function| google_process_slots function| google_spfd number| google_unique_id object| google_sv_map number| google_rum_task_id_counter string| google_user_agent_client_hint function| _DumpException object| default_tr string| MSG_TRANSLATE string| MSG_CANCEL string| MSG_CLOSE function| MSGFUNC_PAGE_TRANSLATED_TO function| MSGFUNC_TRANSLATED_TO string| MSG_GENERAL_ERROR string| MSG_LEARN_MORE function| MSGFUNC_POWERED_BY string| MSG_TRANSLATE_PRODUCT_NAME string| MSG_TRANSLATION_IN_PROGRESS function| MSGFUNC_TRANSLATE_PAGE_TO function| MSGFUNC_VIEW_PAGE_IN string| MSG_RESTORE string| MSG_SSL_INFO_LOCAL_FILE string| MSG_SSL_INFO_SECURE_PAGE string| MSG_SSL_INFO_INTRANET_PAGE string| MSG_SELECT_LANGUAGE function| MSGFUNC_TURN_OFF_TRANSLATION function| MSGFUNC_TURN_OFF_FOR string| MSG_ALWAYS_HIDE_AUTO_POPUP_BANNER string| MSG_ORIGINAL_TEXT string| MSG_FILL_SUGGESTION string| MSG_SUBMIT_SUGGESTION string| MSG_SHOW_TRANSLATE_ALL string| MSG_SHOW_RESTORE_ALL string| MSG_SHOW_CANCEL_ALL string| MSG_TRANSLATE_TO_MY_LANGUAGE function| MSGFUNC_TRANSLATE_EVERYTHING_TO string| MSG_SHOW_ORIGINAL_LANGUAGES string| MSG_OPTIONS string| MSG_TURN_OFF_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_SUGGESTION string| MSG_ALT_ACTIVITY_HELPER_TEXT string| MSG_USE_ALTERNATIVES string| MSG_DRAG_TIP string| MSG_CLICK_FOR_ALT string| MSG_DRAG_INSTUCTIONS string| MSG_SUGGESTION_SUBMITTED string| MSG_MANAGE_TRANSLATION_FOR_THIS_SITE string| MSG_ALT_AND_CONTRIBUTE_ACTIVITY_HELPER_TEXT string| MSG_ORIGINAL_TEXT_NO_COLON string| MSG_LANGUAGE_UNSUPPORTED string| MSG_LANGUAGE_TRANSLATE_WIDGET string| MSG_RATE_THIS_TRANSLATION string| MSG_FEEDBACK_USAGE_FOR_IMPROVEMENT function| _exportVersion function| _getCallbackFunction function| _exportMessages function| _loadJs function| _loadCss function| _isNS function| _setupNS object| google function| google_sa_impl object| googleToken object| googleIMState boolean| _gfp_p_ function| processGoogleToken number| google_global_correlator object| google_prev_clients object| gaGlobal object| ampInaboxIframes object| ampInaboxPendingMessages object| closure_lm_561920 object| GoogleGcLKhOms

2 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.contaboserver.net/ Name: __gads
Value: ID=0253dd7b2a375895-22eb37043ace0054:T=1664829505:RT=1664829505:S=ALNI_Mbg5fU1ESl4_0pcEQECY0QpJ-kELg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
tpc.googlesyndication.com
translate.google.com
translate.googleapis.com
vmi457887.contaboserver.net
www.google.com
www.gstatic.com
142.251.39.2
207.244.225.110
2a00:1450:4001:800::2003
2a00:1450:4001:80b::2002
2a00:1450:4001:82a::2001
2a00:1450:400d:804::200e
2a00:1450:400d:806::2002
2a00:1450:400d:807::2004
2a00:1450:400d:80d::2002
2a00:1450:400d:80d::200a
2a00:1450:400d:80e::2002
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
1012834ca5bf8ff91dbd9d1700bda3386303e4eed1d98a2d1e6580a75a06d28d
226a49ddba006a29a70036c3b4140953202a4bfb4b3b7847afd452755146172b
25132f645d02922a99945d6d0989ff1bf527ac2587798af7570c999d21e4a6ba
2affb3f86a1c3db09d304bdc82a337cccda2fdf65c1b453cd774bc6bcc61ce48
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
46a584fa6b26a936f903d62c68f038be1a5d63bfff9c4434999d0092e89e7eae
488f709f5a5a7e266f7ad486d8ffaa69c0444d83766961584a0a3d39dfb37700
4dac0026fbfa2615dce30c0af12830863fe885f84387a0147b9e338f548d5d82
522219c3978b635866d1f45a2d0a6438c5a7cee401b7d4a8c22f22c3ed3079d0
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5a861509b658aa24fc3aed2867ac3c061e7d818d90b9990959afc6d1b5d4ff99
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6bc028e0452a474bfef8012b143f05f026a157ef76f742800b6ac3b03b91f136
722d0f3bee16fcb67bcf7e413fecd98e3d19b9247b8d008d1a86593684617dd0
746610bf42d9c38151f7a1eb423fb5b049795e4bc1c4dcdd9d3e2f35314b68b5
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
b15b4ed17362cf2f2f37ee2a456a3c6b040ef153821ec30d41834b92643218b0
b65dc54df7f6a931b2fb8e5ffbb474da21bf144d395c961d5ce1c95647951746
d39ee51a9c2d61184a78111c731cce4b32488c99bcc9b1f8c236705d06145166
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f10fc73f171d7f29cf50a928c6e1752c21bbeae061df4b85867915740372d531
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
f7b3ecf4a29b8fc6b5a0354bc8218ef7aeffb267384e87b91848c20ea91e1ebb
f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758