www.take-the-money.website Open in urlscan Pro
142.250.185.243  Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.take-the-money.website/	137 KB 35 KB	214ms 162ms	Document text/html	142.250.185.243 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.take-the-money.website/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.243 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f19.1e100.net Software GSE / Resource Hash 1ce61584c48b817faacf3491a4eeb38ae091cda03db6aeebfa8310ee62b7202d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.take-the-money.website :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers x-robots-tag all content-type text/html; charset=UTF-8 expires Fri, 01 Oct 2021 18:18:32 GMT date Fri, 01 Oct 2021 18:18:32 GMT cache-control private, max-age=0 last-modified Thu, 05 Aug 2021 21:59:39 GMT etag W/"5a0d17076979dc687c155ea41452377a158e9c64951fdf2e7afff8807cb4bc89" content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 35572 server GSE
GET H2	200	amp-auto-ads-0.1.js Show response cdn.ampproject.org/v0/	21 KB 8 KB	69ms 22ms	Script text/javascript	142.250.185.97 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js Requested by Host: www.take-the-money.website URL: https://www.take-the-money.website/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.97 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f1.1e100.net Software sffe / Resource Hash 38bcd66d54bde92dcbb590531ada10cc5d654ec50105392cbaa2a70bbfbdc426 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp content-encoding br x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6731 x-xss-protection 0 server sffe date Fri, 01 Oct 2021 18:18:32 GMT strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * vary Accept-Encoding cache-control private, max-age=604800, stale-while-revalidate=604800 etag "20e38e72314fc180" accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" expires Fri, 01 Oct 2021 18:18:32 GMT
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	144 KB 51 KB	67ms 39ms	Script text/javascript	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: www.take-the-money.website URL: https://www.take-the-money.website/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software cafe / Resource Hash 20e19f7125bc9bc0c9b6bffcd9281849b6d1646e3045af4011a85692f6e9548e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51129 x-xss-protection 0 server cafe etag 11767278833705933445 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Fri, 01 Oct 2021 18:18:32 GMT
GET H2	200	show_ads_impl_fy2019.js Show response pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/	257 KB 95 KB	33ms 32ms	Script text/javascript	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software cafe / Resource Hash cc7b69dce7a199a83f41f4f0f14c3955c09788a452a9abc2aa5924ad984ee513 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 97174 x-xss-protection 0 server cafe etag 16831716765010033174 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Fri, 01 Oct 2021 18:18:32 GMT
GET H2	200	zrt_lookup.html Show response googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/ Frame 5FAF	10 KB 5 KB	28ms 6ms	Document text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20210928/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/html/r20210928/r20190131/zrt_lookup.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.take-the-money.website/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Thu, 30 Sep 2021 23:06:38 GMT expires Thu, 14 Oct 2021 23:06:38 GMT content-type text/html; charset=UTF-8 etag 297313706323796346 x-content-type-options nosniff content-encoding gzip server cafe content-length 4617 x-xss-protection 0 age 69114 cache-control public, max-age=1209600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	/ www.take-the-money.website/	11 KB 11 KB	151ms 150ms	Image text/html	142.250.185.243 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.take-the-money.website/ Requested by Host: www.take-the-money.website URL: https://www.take-the-money.website/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.243 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f19.1e100.net Software GSE / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :path / pragma no-cache accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority www.take-the-money.website referer https://www.take-the-money.website/ :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 05 Aug 2021 21:59:39 GMT server GSE etag W/"5a0d17076979dc687c155ea41452377a158e9c64951fdf2e7afff8807cb4bc89" content-type text/html; charset=UTF-8 cache-control private, max-age=0 x-robots-tag all content-length 35572 x-xss-protection 1; mode=block expires Fri, 01 Oct 2021 18:18:32 GMT
GET DATA	200 OK	truncated /	627 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6a217480aa6975d5cca42e735655916610429fe4c60dc7f1a21c75badff47d33 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf8
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	59ms 18ms	Script text/javascript	142.250.185.138 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: www.take-the-money.website URL: https://www.take-the-money.website/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.138 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f10.1e100.net Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 30 Sep 2021 10:19:35 GMT content-encoding gzip x-content-type-options nosniff age 115137 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30306 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="hosted-libraries-pushers" expires Fri, 30 Sep 2022 10:19:35 GMT
GET H2	200	cookie.js Show response partner.googleadservices.com/gampad/	212 B 666 B	148ms 25ms	Script text/javascript	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://partner.googleadservices.com/gampad/cookie.js?domain=www.take-the-money.website&callback=_gfp_s_&client=ca-pub-6177682838724025 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS ams15s22-in-f2.1e100.net Software cafe / Resource Hash 0aa87e24e4b80f43ce3070008ec3e2c011daa63e129449516365d18cfbb00d51 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/javascript; charset=UTF-8 cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 201 x-xss-protection 0
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	16ms 15ms	Image image/gif	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fwww.take-the-money.website%2F&tn=DIV&cls=par-tp&ign=false&pw=1600&ph=1200&x=0&y=0 Requested by Host: www.take-the-money.website URL: https://www.take-the-money.website/ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers pragma no-cache date Fri, 01 Oct 2021 18:18:32 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 570 B	148ms 26ms	Script application/javascript	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=www.take-the-money.website Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	403	ads Show response googleads.g.doubleclick.net/pagead/ Frame CF1F	603 B 67 B	62ms 41ms	Document text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6177682838724025&output=html&adk=1812271804&adf=3025194257&lmt=1628200779&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.take-the-money.website%2F&ea=0&flash=0&host=ca-host-pub-1556223355139109&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633112312226&bpp=18&bdt=114&idt=62&shv=r20210928&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1996803772695&frm=20&pv=2&ga_vid=1295703510.1633112312&ga_sid=1633112312&ga_hid=626144053&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062987%2C31060033%2C31062919%2C44748553&oid=3&pvsid=2120176098425764&pem=436&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=74 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash 00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority googleads.g.doubleclick.net :scheme https :path /pagead/ads?client=ca-pub-6177682838724025&output=html&adk=1812271804&adf=3025194257&lmt=1628200779&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.take-the-money.website%2F&ea=0&flash=0&host=ca-host-pub-1556223355139109&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633112312226&bpp=18&bdt=114&idt=62&shv=r20210928&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1996803772695&frm=20&pv=2&ga_vid=1295703510.1633112312&ga_sid=1633112312&ga_hid=626144053&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062987%2C31060033%2C31062919%2C44748553&oid=3&pvsid=2120176098425764&pem=436&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=74 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.take-the-money.website/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Fri, 01 Oct 2021 18:18:32 GMT server cafe content-length 46 x-xss-protection 0 set-cookie test_cookie=CheckForPermission; expires=Fri, 01-Oct-2021 18:33:32 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	72 KB 28 KB	145ms 29ms	Script text/javascript	142.250.74.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.74.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s02-in-f2.1e100.net Software sffe / Resource Hash c72976d3b4c427a85952b5cea1ad2efafcc4b2dc6fdd9ef5a505e5e582e62928 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27601 x-xss-protection 0 server sffe etag "1632957222552500" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="active-view-scs-read-write-acl" expires Fri, 01 Oct 2021 18:18:32 GMT
GET H2	200	256-256.png 3.bp.blogspot.com/-T-V-PJOU4v0/XZYzHfq1dYI/AAAAAAAABOw/obz8rMcwKgEvPkHP1ahM2tyAqm8fRYZYwCK4BGAYYCw/w27-h27-p-k-nu/	1 KB 2 KB	69ms 8ms	Image image/png	142.250.74.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://3.bp.blogspot.com/-T-V-PJOU4v0/XZYzHfq1dYI/AAAAAAAABOw/obz8rMcwKgEvPkHP1ahM2tyAqm8fRYZYwCK4BGAYYCw/w27-h27-p-k-nu/256-256.png Requested by Host: www.take-the-money.website URL: https://www.take-the-money.website/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.74.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s02-in-f1.1e100.net Software fife / Resource Hash fdc94d53d1796c028c474c2f2fa236f730b1f0869a42108d706c307422329e21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 15:12:33 GMT x-content-type-options nosniff age 11159 content-disposition inline;filename="256-256.png" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1286 x-xss-protection 0 server fife etag "v4ed" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 07 Sep 2021 11:11:12 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 8 KB	51ms 28ms	XHR application/json	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210928&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software cafe / Resource Hash 64bb446fc45c39b0587b50b4f09f8cf8206c6105cb41cf8150e2272c84e19f1c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers timing-allow-origin * date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8522 x-xss-protection 0
GET H2	200	%25D8%25A3%25D8%25B3%25D9%2587%25D9%2584%2B%25D9%2585%25D9%2588%25D9%2582%25D8%25B9%2B%25D8%25B1%25D8%25A8%25D8%25AD%2B-%2B%25D8%25A7%25D8%25B1%25D8%25A8%25D8%25AD%2B%25D8%25A3%25D9%2583%25D8%25AB%... 1.bp.blogspot.com/-8gGoHYVsUfE/YDtCWO8keZI/AAAAAAAAEZ4/gx1ypPA4_AUSXfGx-PD81RF8YZFnC82fgCPcBGAYYCw/s350/	26 KB 27 KB	256ms 254ms	Image image/jpeg	142.250.74.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://1.bp.blogspot.com/-8gGoHYVsUfE/YDtCWO8keZI/AAAAAAAAEZ4/gx1ypPA4_AUSXfGx-PD81RF8YZFnC82fgCPcBGAYYCw/s350/%25D8%25A3%25D8%25B3%25D9%2587%25D9%2584%2B%25D9%2585%25D9%2588%25D9%2582%25D8%25B9%2B%25D8%25B1%25D8%25A8%25D8%25AD%2B-%2B%25D8%25A7%25D8%25B1%25D8%25A8%25D8%25AD%2B%25D8%25A3%25D9%2583%25D8%25AB%25D8%25B1%2B%25D9%2585%25D9%2586%2B20%2B%25D8%25AF%25D9%2588%25D9%2584%25D8%25A7%25D8%25B1%25D9%258B%25D8%25A7%2B%25D9%2581%25D9%258A%2B%25D8%25A7%25D9%2584%25D9%258A%25D9%2588%25D9%2585%2B%25D8%25A8%25D8%25B7%25D8%25B1%25D9%258A%25D9%2582%25D8%25A9%2B%25D8%25B3%25D9%2587%25D9%2584%25D8%25A9%2B%25D8%25AC%25D8%25AF%25D9%258B%25D8%25A7%2B%25D9%2584%25D9%2584%25D9%2585%25D8%25A8%25D8%25AA%25D8%25AF%25D8%25A6%25D9%258A%25D9%2586.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.74.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s02-in-f1.1e100.net Software fife / Resource Hash a185ae1855a2f74901a321c40cc68c3798193a654c9d35f55ba46c04501f021f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT x-content-type-options nosniff server fife etag "v119e" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="____ ____ ___ - ____ ____ __ 20 _______ __ _____ ______ ____ ____ _________.jpg";filename*=UTF-8''%D8%A3%D8%B3%D9%87%D9%84%20%D9%85%D9%88%D9%82%D8%B9%20%D8%B1%D8%A8%D8%AD%20-%20%D8%A7%D8%B1%D8%A8%D8%AD%20%D8%A3%D9%83%D8%AB%D8%B1%20%D9%85%D9%86%2020%20%D8%AF%D9%88%D9%84%D8%A7%D8%B1%D9%8B%D8%A7%20%D9%81%D9%8A%20%D8%A7%D9%84%D9%8A%D9%88%D9%85%20%D8%A8%D8%B7%D8%B1%D9%8A%D9%82%D8%A9%20%D8%B3%D9%87%D9%84%D8%A9%20%D8%AC%D8%AF%D9%8B%D8%A7%20%D9%84%D9%84%D9%85%D8%A8%D8%AA%D8%AF%D8%A6%D9%8A%D9%86.jpg timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27114 x-xss-protection 0 expires Sat, 02 Oct 2021 18:18:32 GMT
GET H2	200	%25D8%25A7%25D9%2584%25D8%25AA%25D9%2582%25D8%25A7%25D8%25B7.PNG 1.bp.blogspot.com/-7K_e1iL_J7Q/YDawR6eOU_I/AAAAAAAAEWs/bUuSX0vQGTI-VLOx0SJ5026zb_cXeQWmwCLcBGAsYHQ/s350/	24 KB 24 KB	291ms 290ms	Image image/png	142.250.74.193 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://1.bp.blogspot.com/-7K_e1iL_J7Q/YDawR6eOU_I/AAAAAAAAEWs/bUuSX0vQGTI-VLOx0SJ5026zb_cXeQWmwCLcBGAsYHQ/s350/%25D8%25A7%25D9%2584%25D8%25AA%25D9%2582%25D8%25A7%25D8%25B7.PNG Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.74.193 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s02-in-f1.1e100.net Software fife / Resource Hash 90949e963d6721cb2d9fe54d8095f9971d2ce60c83f24960a95e109f642da226 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT x-content-type-options nosniff server fife etag "v116c" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="______.PNG";filename*=UTF-8''%D8%A7%D9%84%D8%AA%D9%82%D8%A7%D8%B7.PNG timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24801 x-xss-protection 0 expires Sat, 02 Oct 2021 18:18:32 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	46ms 24ms	Script text/javascript	142.250.186.33 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109290101/show_ads_impl_fy2019.js?bust=31062987 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.33 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f1.1e100.net Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Fri, 01 Oct 2021 18:18:32 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Fri, 01 Oct 2021 18:18:32 GMT
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/224/ Frame 3FAB	12 KB 5 KB	43ms 17ms	Document text/html	142.250.186.33 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.33 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f1.1e100.net Software sffe / Resource Hash 4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/224/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.take-the-money.website/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5029 date Fri, 01 Oct 2021 16:06:50 GMT expires Sat, 01 Oct 2022 16:06:50 GMT last-modified Wed, 02 Jun 2021 17:09:45 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 7902 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	aframe Show response www.google.com/recaptcha/api2/ Frame 4CC8	783 B 1 KB	68ms 27ms	Document text/html	142.250.185.196 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.196 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s52-in-f4.1e100.net Software GSE / Resource Hash aa9c504df5909301c1072c4a639997b39b2735944a88bfc78082f92570ad3edc Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-nkKwkzqfQunIiqyKRCGjQQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/aframe pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.take-the-money.website/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy-report-only require-corp; report-to="recaptcha" report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Fri, 01 Oct 2021 18:18:32 GMT date Fri, 01 Oct 2021 18:18:32 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-nkKwkzqfQunIiqyKRCGjQQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 513 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	LftQ-87gh8ukbv8P1dh67h7Vjfro8G7aRn_R6x3uKA4.js Show response pagead2.googlesyndication.com/bg/ Frame 3FAB	35 KB 13 KB	7ms 7ms	Script text/javascript	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/LftQ-87gh8ukbv8P1dh67h7Vjfro8G7aRn_R6x3uKA4.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software sffe / Resource Hash 2dfb50fbcee087cba46eff0fd5d87aee1ed58dfae8f06eda467fd1eb1dee280e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 30 Sep 2021 16:42:13 GMT content-encoding br x-content-type-options nosniff age 92179 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13320 x-xss-protection 0 last-modified Mon, 27 Sep 2021 10:18:00 GMT server sffe vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="botguard-scs" expires Fri, 30 Sep 2022 16:42:13 GMT
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 4CC8	0 0	22ms 22ms	Image text/html	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20210928&jk=2120176098425764&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers
GET H3	204	sodar pagead2.googlesyndication.com/pagead/	0 0	33ms 33ms	Image text/html	142.250.185.98 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210928&jk=2120176098425764&bg=!FhWlFVHNAAZE-GIIRPg7ACkAdvg8WoReoorlK5XlOCVbt2sDxolrwu30QrCyGFRK7sZ1N1oO_1AUUwIAAABmUgAAAAtoAQcKABImftkQm7op-GG6hylkR20g2j6ZArSsFnAT57tlOpJJ6sTiYDepT4-nC3C9k9Qbwr2Uh_pqu0azkqMsIsMBpAyBG-DBvI_Mo-hDFTiAg0yzOAGo-ZfYp85V7GDtWDcQPxsYl_BzDE7Z18Fn6cgIszSaF7SyyeEJuRnvTJd5zJErv0r5yBh6byf1vKwAIQWz8YW_KSuis-1dpK0eWCH07yYp5O0e1yJXa49JIPU2JwNGxgJd1idLM3Z8GOmwQtw7ziQSa6773UYPsawxwPod00R17iwl6AwH8EQe7hLeBqVLwcrzbPi8mYmUOdnoNKyvAJRXxA3JXrQ-QzxCWbInqbD-l9IUFr9OjPhNqUitiQWEII3HbjqNzv7PTozNZnsqTJgcUPTN_YRlmUgU8q31937m2QCD7_LVA0fyNnYyK0qZkOnuUT_hPzLlJ9MXel8P8BdzgnbKEvSEmOjZeV7r_YL5qZJhytnVhJrbTIRjfB9UuLClbv-bt5s6e45bJZAcCh3ybTPZtWHqlU5L6swbZIbLdQ9Onxhf5ZNaXlJP-a00e9L9WbgcqcfzRt504MUqqcwUl3HgMdv3qwvXhb_Ai3s3dAIden9ZJBPeoXzb5R2Z2eUre6wRhCxrKmgOMnR4ZIzRFXyv6u7UJdSbD63FY_9to5H6g-WmNeVSoqbK9AeVrz4QxJ8RY2sULP7wJIS4sIeMssBZJ9VMIK72aqtRyQEIohQpy2YuZzNmGtqvfOmTjs-E3ZHDaFgJWKeVBYuEa4UgJhiFKx2XpTB3sYBG79jzu9JtSFrJj7eSE39xLdjL4egCufu7MGYoqQbXdLP3htq2I7sGk_v4_RqxDt_A07th2y-jzPiC1xDJEhArZVJP-_nHMkaXeJ6jqHb0vRHlyebaKYk8K4xsVhHYTkL52zAUF5_zwojF5IgfE5eLeCO9F-1XFYw6A7PDxQ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.98 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.take-the-money.website/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers

60 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| onbeforexrselect boolean| originAgentCluster object| AMP object| google_js_reporting_queue number| google_srt object| google_logging_queue object| google_ad_modifications object| ggeac boolean| google_measure_js_timing object| google_reactive_ads_global_state object| adsbygoogle boolean| _gfp_a_ object| google_sa_queue object| google_sl_win function| google_process_slots string| google_user_agent_client_hint object| _0x205f function| _0x53b8 function| prst function| google_spfd number| google_unique_id object| google_sv_map object| blogLabels function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter function| google_sa_impl object| google_persistent_state_async object| __google_ad_urls number| google_global_correlator number| __google_ad_urls_id object| googleToken object| googleIMState boolean| _gfp_p_ object| google_image_requests function| processGoogleToken object| google_prev_clients object| gaGlobal object| google_jobrunner object| ampInaboxIframes object| ampInaboxPendingMessages boolean| google_osd_loaded boolean| google_onload_fired function| $ function| jQuery string| ArrowIcon string| BlogID object| _0x1ec6 function| _0x33fe string| olderLink string| $my_menu string| $my_icon string| $my_tre function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| GoogleGcLKhOms

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.doubleclick.net/	1970-01-19 21:38:33	Name: test_cookie Value: CheckForPermission
			.take-the-money.website/	1970-01-20 07:00:08	Name: __gads Value: ID=af9809d79a2a69ae-2214c24f80c900c7:T=1633112312:RT=1633112312:S=ALNI_MbSnwbvDFXERqYO4bLdyKh9OJ8urA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6177682838724025&output=html&adk=1812271804&adf=3025194257&lmt=1628200779&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.take-the-money.website%2F&ea=0&flash=0&host=ca-host-pub-1556223355139109&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1633112312226&bpp=18&bdt=114&idt=62&shv=r20210928&mjsv=m202109290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=1996803772695&frm=20&pv=2&ga_vid=1295703510.1633112312&ga_sid=1633112312&ga_hid=626144053&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062987%2C31060033%2C31062919%2C44748553&oid=3&pvsid=2120176098425764&pem=436&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=74 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.bp.blogspot.com
3.bp.blogspot.com
adservice.google.com
ajax.googleapis.com
cdn.ampproject.org
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
www.take-the-money.website
142.250.185.138
142.250.185.196
142.250.185.243
142.250.185.66
142.250.185.97
142.250.185.98
142.250.186.33
142.250.74.193
142.250.74.194
216.58.212.162
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
0aa87e24e4b80f43ce3070008ec3e2c011daa63e129449516365d18cfbb00d51
1ce61584c48b817faacf3491a4eeb38ae091cda03db6aeebfa8310ee62b7202d
20e19f7125bc9bc0c9b6bffcd9281849b6d1646e3045af4011a85692f6e9548e
2dfb50fbcee087cba46eff0fd5d87aee1ed58dfae8f06eda467fd1eb1dee280e
38bcd66d54bde92dcbb590531ada10cc5d654ec50105392cbaa2a70bbfbdc426
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
64bb446fc45c39b0587b50b4f09f8cf8206c6105cb41cf8150e2272c84e19f1c
6a217480aa6975d5cca42e735655916610429fe4c60dc7f1a21c75badff47d33
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6
90949e963d6721cb2d9fe54d8095f9971d2ce60c83f24960a95e109f642da226
a185ae1855a2f74901a321c40cc68c3798193a654c9d35f55ba46c04501f021f
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
aa9c504df5909301c1072c4a639997b39b2735944a88bfc78082f92570ad3edc
c72976d3b4c427a85952b5cea1ad2efafcc4b2dc6fdd9ef5a505e5e582e62928
cc7b69dce7a199a83f41f4f0f14c3955c09788a452a9abc2aa5924ad984ee513
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fdc94d53d1796c028c474c2f2fa236f730b1f0869a42108d706c307422329e21