www.419scam.org Open in urlscan Pro
176.9.54.44 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.419scam.org/419-bl-j.htm
Submission: On July 04 via manual (July 4th 2022, 7:41:11 pm UTC) from US — Scanned from DE

Summary HTTP 70 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 20 IPs in 3 countries across 15 domains to perform 70 HTTP transactions. The main IP is 176.9.54.44, located in Weimar, Germany and belongs to HETZNER-AS, DE. The main domain is www.419scam.org.

This is the only time www.419scam.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	176.9.54.44 176.9.54.44	24940 (HETZNER-AS) (HETZNER-AS)
9	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:7eb1:3826:be7e:d981	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1 2	2600:9000:231... 2600:9000:2315:9c00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a02:2638::b 2a02:2638::b	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
18	2a02:2638::3 2a02:2638::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.0.160 178.250.0.160	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	178.250.0.139 178.250.0.139	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
70	20

4 176.9.54.44 (Weimar, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: mx1.joewein.net

www.419scam.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
joewein.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
jwspamspy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:7eb1:3826:be7e:d981 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

edge.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2315:9c00:6:44e3:f8c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::b (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a02:2638::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.160 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.0.139 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.par.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	criteo.net static.criteo.net — Cisco Umbrella Rank: 606 pix.eu.criteo.net — Cisco Umbrella Rank: 6881 csm.eu.criteo.net — Cisco Umbrella Rank: 7033	345 KB
16	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 120 tpc.googlesyndication.com — Cisco Umbrella Rank: 160	267 KB
6	criteo.com rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 10664 ads.eu.criteo.com — Cisco Umbrella Rank: 7052 cat.fr.eu.criteo.com — Cisco Umbrella Rank: 8758	105 KB
6	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 54	23 KB
3	quantserve.com 1 redirects edge.quantserve.com — Cisco Umbrella Rank: 14577 pixel.quantserve.com — Cisco Umbrella Rank: 443	11 KB
3	google.com www.google.com — Cisco Umbrella Rank: 8 adservice.google.com — Cisco Umbrella Rank: 92	3 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	10 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 179	85 KB
2	quantcount.com 1 redirects rules.quantcount.com — Cisco Umbrella Rank: 991	881 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 49	7 KB
2	joewein.net joewein.net	3 KB
1	google.de adservice.google.de — Cisco Umbrella Rank: 7751	792 B
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 867	646 B
1	jwspamspy.com jwspamspy.com	3 KB
1	419scam.org www.419scam.org	444 KB
70	15

	Domain	Requested by
18	static.criteo.net	ads.eu.criteo.com
9	pagead2.googlesyndication.com	www.419scam.org pagead2.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com
7	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
4	csm.eu.criteo.net	ads.eu.criteo.com
2	pix.eu.criteo.net	ads.eu.criteo.com
2	cdnjs.cloudflare.com	ads.eu.criteo.com
2	cat.fr.eu.criteo.com	ads.eu.criteo.com
2	ads.eu.criteo.com	googleads.g.doubleclick.net
2	rtb.nl.eu.criteo.com	googleads.g.doubleclick.net
2	www.googletagservices.com	googleads.g.doubleclick.net
2	pixel.quantserve.com	1 redirects www.419scam.org
2	rules.quantcount.com	1 redirects www.419scam.org
2	www.google-analytics.com	www.419scam.org
2	www.google.com	www.419scam.org tpc.googlesyndication.com
2	joewein.net	www.419scam.org
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	edge.quantserve.com	www.419scam.org
1	jwspamspy.com	www.419scam.org
1	www.419scam.org
70	22

This site contains links to these domains. Also see Links.

Domain
joewein.net
jwspamspy.com
www.google.com

Subject Issuer	Validity	Valid
*.g.doubleclick.net GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
joewein.net R3	`2022-06-11` - `2022-09-09`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
www.jwspamspy.com R3	`2022-06-11` - `2022-09-09`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-06-06` - `2022-08-29`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-22` - `2022-08-24`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-27` - `2022-08-25`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-06-21` - `2022-09-23`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-18` - `2022-08-13`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-06-12` - `2022-09-12`	3 months	crt.sh

This page contains 9 frames:

Primary Page: http://www.419scam.org/419-bl-j.htm
Frame ID: B0BB56206999E1BC9AEE991CA8CC2CAF
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220629/r20190131/zrt_lookup.html
Frame ID: C1DFBD5170DDCC5D606590E44A28DC77
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=600&adk=903252076&adf=417655153&w=160&lmt=1656947486&format=160x600_as&color_bg=ffffff&color_border=ffffff&color_link=0000ff&color_text=000000&color_url=336699&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666760&bpp=11&bdt=124&idt=242&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&correlator=2007524466836&frm=20&pv=2&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=29&ady=478&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=1&uci=a!1&fsb=1&xpc=BKqUWmzzSu&p=http%3A//www.419scam.org&dtd=256
Frame ID: C9D28A456AE0E9BA54F4136BEE394B41
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=250&slotname=5036826220&adk=354449457&adf=2233235524&pi=t.ma~as.5036826220&w=300&lmt=1656947486&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666773&bpp=2&bdt=136&idt=249&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&prev_fmts=160x600_as&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1278&ady=22&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cle%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=alyFX68KUT&p=http%3A//www.419scam.org&dtd=252
Frame ID: F772DDFFA659C222A40955B2C780E946
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&adk=1812271804&adf=3025194257&lmt=1656947486&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&ea=0&pra=5&wgl=1&dt=1656963666871&bpp=1&bdt=235&idt=200&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&prev_fmts=160x600_as&prev_slotnames=5036826220&nras=1&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=3&uci=a!3&fsb=1&dtd=208
Frame ID: 66088EFBB12B63F780BC3B9C373C17F6
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YsNCUwADBOkKGKAPAAJpHcNevESL4q_SmyPUew&u=%7CLQJZLY5OTQIvGCEPKUr14Ezq8JRZRI7x3rLy0c4XhKw%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4JdLNIKaOnb5OzEWkIpq6r1BJdkqejnNl5wdET7w9Lynnsa4K0oztSUuiNb7ea8x9_qSlMDLBTeqC1tfKz5nTWXtY2r7s3FkT8mvSwAMi3aAbJL2mnQTP_ycGjUklDBOkfIXo2wengCQj6rpvetfDncuq1r-1OKPwO3EEq2w_87TPo6fWvhE9aGkZ4CuSzeCqTAotFEsOgkQwozvU8tn4TYBOjfymVZnEFG6ZB4ZaTH_R5YYba0PDSVazPmqwnrMZiMud4tZ-XH5Dk1h4cfi1Jz_rFwXn7wlUKXlB6ou_iymqjrBLHUyCSYioKVOOe0OFSM8jrVJeF-yGh1knFz6GA4yWppVFqrshyzAyeA3NvYP0MUPfkY5gYgWTAvHC3J6PWMRCBvYXm79KFUfYfMo_Red1uyVYtXiYLGtBjeupeUmIONmCF6im3gCoPJYyXlTb8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9cEZU0LDYumJDI_AYp3SiYAKyZ7SsVzVnZH3cMCNtwEQASAAYJWCgICYB4IBF2NhLXB1Yi01OTMyNjAzNTUxMDU3NzcwoAHVttLqA8gBCakCiT4d55Z-sT6oAwGqBL0BT9Bsl6sBLdVNRfTBtoFEqE3Auk0v0oMmn0kjoFT1zEmCG4zp-NH_0XstyYcmK0o6iPo9AKMFr0jNffo1OB2a3sWXe_Gu3bSvnxrsARfaJJorm94rotm5lQDEMZccNxJgNqrdC-rARKjbZxjnvwdY-HdesVzFgIhTeYicGCThVgrfTK4dySvoo1YeGww139YJ0ztYMbZxyEzxy14zKC4sC4VKfER7cYCS35hh1U8-sjZeL_IoLeVTxLfjZHxZgAbvnYGk15WtmxugBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_33TFdprg5eUPv-mHk9KaykdZ9jzg%26client%3Dca-pub-5932603551057770%26adurl%3D
Frame ID: 0C316C4E83B2B6D26C938F4D7A432B11
Requests: 15 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=YsNCUwACvvoIEdNsAAr0dZRqODBixPsKbkNlnA&u=%7CLQJZLY5OTQJiG1L7uPKW034aTWXXKwWRJAjyuORszfo%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4LyNiDdWbBE0KFZFDzc8wcwoBBdNKDMeYb-ySpOQSbyTzQGi8hxNw27zWHWvmfjv5S-oXAAaowW5gE9kFbSIi3bSJ8PYEPNepf_2-3h60u10nJ_--IyXpzlQyyOnQkRLvCr8VrkaUtA_ojqT4BBRXE6vekrIqC3HjhZ0Su0eujMDjCz2QhPFFq7SQ7s5e_SKhDkie-LyB5uqQ6JEGKvyuCuKAih3AqYhwpuPc5gXbyS7IecxLOTYE10gvrlHi12dzN9UOOs103o2yta1Kky7Q5SaVps93huHaRQSMFZ1FdcTTwJmHgyV1iicn3ffnwj9qksqs0ukmaKfn4qzJ1icIjJNP64zt0R2Ko-0xGVeA8VeodxWtfsaBzA9MrPJVexRalHHpVQpTdBSifxWehlo4o2SkEYFHzlbQWoS6N-l1RHU4hjARUjj0OioW4Y4I7FCCM&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwrWWU0LDYvr9Cuymx_AP9eiruA3JntKxXNWdkfdwwI23ARABIABglYKAgJgHggEXY2EtcHViLTU5MzI2MDM1NTEwNTc3NzCgAdW20uoDyAEJqQI6ynDYp32xPqgDAaoEugFP0K7FyOO6tHhZfSfB58Vh9TRLy_YZo8RZnYVi6UQY_wnKOOQyw01B4sGon7yEthwJqvXtGbgmHeRT-XC0IbePf4J04AE1GIdoJWXfGXA8qiYW3KWrajKfmMstC47tCAqUx4fmWaoeGl-EQR916dZcwITKs6FcseC8iMXcywMb4BVLlbxgWa9eU8d7g99L0hdwnE6WyvfP6bkETVNmORXJC6ZP-xBkAd3VRlu-dEOdDzhWTW-zMVB-hGuABu-dgaTXla2bG6AGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2jNXL-hhgCrauYHyz2YOONIGMHKw%26client%3Dca-pub-5932603551057770%26adurl%3D
Frame ID: 0D3EB17A0427180575F338E0477F869F
Requests: 15 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E56F9C8EE682399D8CE149C9F1B70ABB
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 80CCCA6931266D80985D9295BD24D3BC
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

"419" sender addresses "J" (blacklisted by jwSpamSpy)

Detected technologies

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Page Statistics

70
Requests

93 %
HTTPS

74 %
IPv6

15
Domains

22
Subdomains

20
IPs

3
Countries

1308 kB
Transfer

2271 kB
Size

8
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://joewein.net/

Search URL Search Domain Scan URL

URL: https://joewein.net/index.htm
Title: Home

Search URL Search Domain Scan URL

URL: https://joewein.net/blog/
Title: Blog

Search URL Search Domain Scan URL

URL: https://joewein.net/company/index.htm
Title: About us

Search URL Search Domain Scan URL

URL: https://joewein.net/spam/index.htm
Title: Spam

Search URL Search Domain Scan URL

URL: https://joewein.net/fraud/index.htm
Title: Online fraud

Search URL Search Domain Scan URL

URL: https://jwspamspy.com/
Title: jwSpamSpy

Search URL Search Domain Scan URL

URL: https://www.google.com/

Search URL Search Domain Scan URL

URL: https://joewein.net/info/guestbook.htm

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

http://rules.quantcount.com/rules-p-1cMclStPZwi1M.js HTTP 301
https://rules.quantcount.com/rules-p-1cMclStPZwi1M.js

Request Chain 11

http://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=542221393&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=%22419%22%20sender%20addresses%20%22J%22%20(blacklisted%20by%20jwSpamSpy)&utmhn=www.419scam.org&utmhid=768329883&utmr=-&utmp=/419-bl-j.htm&utmac=UA-6104455-2&utmcc=__utma%3D94131288.542221393.1656963667.1656963667.1656963667.1%3B%2B__utmz%3D94131288.1656963667.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)%3B%2B HTTP 307
https://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=542221393&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=%22419%22%20sender%20addresses%20%22J%22%20(blacklisted%20by%20jwSpamSpy)&utmhn=www.419scam.org&utmhid=768329883&utmr=-&utmp=/419-bl-j.htm&utmac=UA-6104455-2&utmcc=__utma%3D94131288.542221393.1656963667.1656963667.1656963667.1%3B%2B__utmz%3D94131288.1656963667.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)%3B%2B

Request Chain 18

http://pixel.quantserve.com/pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-20220628170050;cm=;gdpr=0;ref=;d=419scam.org;dst=0;et=1656963667193;tzo=0;ogl= HTTP 301
https://pixel.quantserve.com/pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-20220628170050;cm=;gdpr=0;ref=;d=419scam.org;dst=0;et=1656963667193;tzo=0;ogl=

70 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 419-bl-j.htm Show response
www.419scam.org/ 443 KB
444 KB 122ms
11ms Document
text/html 176.9.54.44
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.419scam.org/419-bl-j.htm
Protocol: HTTP/1.1
Server: 176.9.54.44 Weimar, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: mx1.joewein.net
Software: Apache /
Resource Hash: 42080d47a0cc58fca77bbd2598153bbc1cd9be4e3e0ddb42c7653a21eefab5ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 453971
Content-Type: text/html; charset=UTF-8
Date: Mon, 04 Jul 2022 19:41:06 GMT
ETag: "6ed53-5e2fc26512649"
Keep-Alive: timeout=5, max=100
Last-Modified: Mon, 04 Jul 2022 15:11:26 GMT
Server: Apache

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 161 KB
55 KB 116ms
63ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eea68618f20dd447286814d4a8184cf320e7e1eb32fa9559bf8f878df2e45ff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56301
x-xss-protection: 0
server: cafe
etag: 6612674807348043715
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Jul 2022 19:41:06 GMT

GET
H/1.1 200
OK jwde-80x50.gif
joewein.net/img/ 1 KB
2 KB 58ms
11ms Image
image/gif 176.9.54.44
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joewein.net/img/jwde-80x50.gif
Requested by: Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.9.54.44 Weimar, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: mx1.joewein.net
Software: Apache /
Resource Hash: b75c57c03ca26ab9f26972e8835dcbc7607b47c156aeebdfb2f3683c72048a61

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 04 Jul 2022 19:41:06 GMT
Last-Modified: Wed, 06 Oct 2021 09:17:47 GMT
Server: Apache
ETag: "563-5cdab9e9478ce"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1379

GET
H/1.1 200
OK banner.gif
joewein.net/img/ 2 KB
2 KB 38ms
11ms Image
image/gif 176.9.54.44
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://joewein.net/img/banner.gif
Requested by: Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.9.54.44 Weimar, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: mx1.joewein.net
Software: Apache /
Resource Hash: e4b2b4513bbc0e868fe8aa38355cafd1e09f3e9790ae4cc324511207e2b8ac81

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 04 Jul 2022 19:41:06 GMT
Last-Modified: Sun, 04 Apr 2004 08:00:45 GMT
Server: Apache
ETag: "650-3d73935bfc540"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1616

GET
H2 200 Logo_25wht.gif
www.google.com/logos/ 2 KB
2 KB 59ms
22ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/logos/Logo_25wht.gif

Requested by

Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4488333adcd7deb7572caaa680e1a4d9df638ed0738f20b064408fd67fac9428

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:06 GMT
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 12:00:00 GMT
server: sffe
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/gif
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1607
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 04 Jul 2022 19:41:06 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 114 KB
39 KB 68ms
46ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

156c27b55aa9ddc38f7b8065234b3a2fbe50f1f469cfd529e38a444bd749bc7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39725
x-xss-protection: 0
server: cafe
etag: 2322283136287984502
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 04 Jul 2022 19:41:06 GMT

GET
H/1.1 200
OK tray.gif
jwspamspy.com/img/ 3 KB
3 KB 145ms
11ms Image
image/gif 176.9.54.44
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jwspamspy.com/img/tray.gif
Requested by: Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 176.9.54.44 Weimar, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: mx1.joewein.net
Software: Apache /
Resource Hash: f547c4dd88bd36a62fb778f5838558cb1181a7cd53680b837b81192f29b17fd8

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 04 Jul 2022 19:41:06 GMT
Last-Modified: Mon, 16 Feb 2004 06:34:46 GMT
Server: Apache
ETag: "ac7-3d37269ddad80"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2759

GET
H/1.1 200
OK quant.js Show response
edge.quantserve.com/ 24 KB
10 KB 23ms
8ms Script
application/javascript 2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://edge.quantserve.com/quant.js
Requested by: Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm
Protocol: HTTP/1.1
Server: 2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 67315acd47fca91a767aa68f94f8666c7ca01eebf6012326da7edb7e97106502

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 04 Jul 2022 19:41:06 GMT
Content-Encoding: gzip
Etag: "Sy8yk7L2ihxjBP+YyKUKJg=="
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: private, max-age=604800
Transfer-Encoding: chunked
Connection: keep-alive
Accept-Ranges: bytes
Expires: Mon, 11 Jul 2022 19:41:06 GMT

GET
H2 200 urchin.js Show response
www.google-analytics.com/ 22 KB
7 KB 43ms
14ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/urchin.js

Requested by

Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

65b488811bd504ecd9037c0aee94c56a7bcd0870c2ae8818f6cf60cb3ba51621

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 09:41:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 35995
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=1209600
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6847
expires: Mon, 18 Jul 2022 09:41:11 GMT

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/ 339 KB
120 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/show_ads_impl_with_ama_fy2019.js?client=pub-5932603551057770&plah=www.419scam.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63ccc34c56ddde9859e5fabe9fe08fc891b8045aa804d5909a57dbc5dadc6f10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122217
x-xss-protection: 0
server: cafe
etag: 3758514223028115795
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 04 Jul 2022 19:41:06 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220629/r20190131/ Frame C1DF 10 KB
5 KB 50ms
13ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220629/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.419scam.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 10399
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 16:47:47 GMT
etag: 10429905676100781186
expires: Mon, 18 Jul 2022 16:47:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

rules-p-1cMclStPZwi1M.js Show response
rules.quantcount.com/
Redirect Chain

http://rules.quantcount.com/rules-p-1cMclStPZwi1M.js
https://rules.quantcount.com/rules-p-1cMclStPZwi1M.js

3 B
454 B

50ms
23ms

Script
application/javascript

2600:9000:2315:9c00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-1cMclStPZwi1M.js
Requested by: Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm
Protocol: H2
Server: 2600:9000:2315:9c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
via: 1.1 271c2e1e305f31b0f14837cad3c843b0.cloudfront.net (CloudFront)
age: 2493
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:44:49 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
x-amz-cf-id: 7E13rCXhF7j2W12GD56BsAyws5Odj6Uj9VcqbpDDzEDmExhgrFEuoA==

Redirect headers

Date: Mon, 04 Jul 2022 19:41:06 GMT
Via: 1.1 021d8c03b9a9a9281489f9b9055209cc.cloudfront.net (CloudFront)
Server: CloudFront
X-Amz-Cf-Pop: DUS51-P2
X-Cache: Redirect from cloudfront
Content-Type: text/html
Location: https://rules.quantcount.com/rules-p-1cMclStPZwi1M.js
Connection: keep-alive
Content-Length: 183
X-Amz-Cf-Id: bF4Ym4X7YySX-EJBBNQlsw4r7C2ZKhFFhf42IiiQz88-9xlExXC1TQ==

GET
H3

200

__utm.gif
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=542221393&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=%22419%22%20sender%20addresses%20%22J%22%20(bla...
https://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=542221393&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=%22419%22%20sender%20addresses%20%22J%22%20(bl...

35 B
55 B

43ms
14ms

Image
image/gif

2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=542221393&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=%22419%22%20sender%20addresses%20%22J%22%20(blacklisted%20by%20jwSpamSpy)&utmhn=www.419scam.org&utmhid=768329883&utmr=-&utmp=/419-bl-j.htm&utmac=UA-6104455-2&utmcc=__utma%3D94131288.542221393.1656963667.1656963667.1656963667.1%3B%2B__utmz%3D94131288.1656963667.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)%3B%2B

Requested by

Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm

Protocol

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Jul 2022 09:42:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 35892
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://www.google-analytics.com/__utm.gif?utmwv=1.4&utmn=542221393&utmcs=UTF-8&utmsr=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmcn=1&utmdt=%22419%22%20sender%20addresses%20%22J%22%20(blacklisted%20by%20jwSpamSpy)&utmhn=www.419scam.org&utmhid=768329883&utmr=-&utmp=/419-bl-j.htm&utmac=UA-6104455-2&utmcc=__utma%3D94131288.542221393.1656963667.1656963667.1656963667.1%3B%2B__utmz%3D94131288.1656963667.1.1.utmccn%3D(direct)%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)%3B%2B
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 215 B
646 B 147ms
22ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.419scam.org&callback=_gfp_s_&client=ca-pub-5932603551057770

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202206280101/show_ads_impl_with_ama_fy2019.js?client=pub-5932603551057770&plah=www.419scam.org

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

5ca13d3f4ebba899768f7715eac1973e9b8233941f4c7fdb273ccd4558aab71a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 158ms
34ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.419scam.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 175ms
53ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.419scam.org

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C9D2 22 KB
9 KB 231ms
203ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=600&adk=903252076&adf=417655153&w=160&lmt=1656947486&format=160x600_as&color_bg=ffffff&color_border=ffffff&color_link=0000ff&color_text=000000&color_url=336699&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666760&bpp=11&bdt=124&idt=242&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&correlator=2007524466836&frm=20&pv=2&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=29&ady=478&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=1&uci=a!1&fsb=1&xpc=BKqUWmzzSu&p=http%3A//www.419scam.org&dtd=256

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccf249e9a41cb390abd80cc9299faf5883ee442c206c504580e920d0a1041df7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.419scam.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9474
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 19:41:07 GMT
expires: Mon, 04 Jul 2022 19:41:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame F772 22 KB
9 KB 229ms
201ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=250&slotname=5036826220&adk=354449457&adf=2233235524&pi=t.ma~as.5036826220&w=300&lmt=1656947486&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666773&bpp=2&bdt=136&idt=249&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&prev_fmts=160x600_as&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1278&ady=22&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cle%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=alyFX68KUT&p=http%3A//www.419scam.org&dtd=252

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f070a8bdccb53efc33eca3c58be787ecbc3a4bfa9d94d58e45b3f20ec6b28450

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.419scam.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9479
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 19:41:07 GMT
expires: Mon, 04 Jul 2022 19:41:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6608 0
19 B 101ms
74ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&adk=1812271804&adf=3025194257&lmt=1656947486&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&ea=0&pra=5&wgl=1&dt=1656963666871&bpp=1&bdt=235&idt=200&shv=r20220629&mjsv=m202206280101&ptt=9&saldr=aa&abxe=1&prev_fmts=160x600_as&prev_slotnames=5036826220&nras=1&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=3&uci=a!3&fsb=1&dtd=208

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.419scam.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 19:41:07 GMT
expires: Mon, 04 Jul 2022 19:41:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-20220628170050;cm=;gdpr=0;ref=;d...
pixel.quantserve.com/
Redirect Chain

http://pixel.quantserve.com/pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-2022...
https://pixel.quantserve.com/pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-202...

35 B
372 B

29ms
12ms

Image
image/gif

2620:116:800d:21:7eb1:3826:be7e:d981
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-20220628170050;cm=;gdpr=0;ref=;d=419scam.org;dst=0;et=1656963667193;tzo=0;ogl=

Requested by

Host: www.419scam.org
URL: http://www.419scam.org/419-bl-j.htm

Protocol

Server

2620:116:800d:21:7eb1:3826:be7e:d981 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Jul 2022 19:41:07 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Redirect headers

Date: Mon, 04 Jul 2022 19:41:07 GMT
Access-Control-Allow-Origin: *
Location: https://pixel.quantserve.com/pixel;r=77242938;rf=0;a=p-1cMclStPZwi1M;url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm;uht=2;fpan=1;fpa=P0-414304692-1656963667193;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-20220628170050;cm=;gdpr=0;ref=;d=419scam.org;dst=0;et=1656963667193;tzo=0;ogl=
Cache-Control: private, no-transform, max-age=86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Tue, 05 Jul 2022 19:41:07 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame F772 3 KB
1 KB 60ms
18ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=250&slotname=5036826220&adk=354449457&adf=2233235524&pi=t.ma~as.5036826220&w=300&lmt=1656947486&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666773&bpp=2&bdt=136&idt=249&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&prev_fmts=160x600_as&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1278&ady=22&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cle%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=alyFX68KUT&p=http%3A//www.419scam.org&dtd=252

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 946
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Jul 2022 19:25:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F772 138 KB
42 KB 801ms
759ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Jul 2022 19:41:08 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame F772 17 KB
8 KB 56ms
15ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:29:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 669
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Jul 2022 19:29:58 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame C9D2 3 KB
1 KB 59ms
19ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=600&adk=903252076&adf=417655153&w=160&lmt=1656947486&format=160x600_as&color_bg=ffffff&color_border=ffffff&color_link=0000ff&color_text=000000&color_url=336699&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666760&bpp=11&bdt=124&idt=242&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&correlator=2007524466836&frm=20&pv=2&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=29&ady=478&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=1&uci=a!1&fsb=1&xpc=BKqUWmzzSu&p=http%3A//www.419scam.org&dtd=256

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 946
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Jul 2022 19:25:21 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C9D2 138 KB
43 KB 797ms
757ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43256
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1656329918998510"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Jul 2022 19:41:08 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/ Frame C9D2 17 KB
7 KB 57ms
17ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220629/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:29:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 669
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7309
x-xss-protection: 0
server: cafe
etag: 16921397534319471551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Jul 2022 19:29:58 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame F772 0
0 55ms
55ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CdPuiU0LDYumJDI_AYp3SiYAKyZ7SsVzVnZH3cMCNtwEQASAAYJWCgICYB4IBF2NhLXB1Yi01OTMyNjAzNTUxMDU3NzcwoAHVttLqA8gBCakCiT4d55Z-sT6oAwGqBLoBT9Bsl6sBLdVNRfTBtoFEqE3Auk0v0oMmn0kjoFT1zEmCG4zp-NH_0XstyYcmK0o6iPo9AKMFr0jNffo1OB2a3sWXe_Gu3bSvnxrsARfaJJorm94rotm5lQDEMZccNxJgNqrdC-rARKjbZxjnvwdY-HdesVzFgIhTeYicGCThVgrfTK4dySvoo1YeGww139YJ0ztYMfRz6d52RMIgl7I4qFV32rxyZYok1bZ5V_v2j5CskOwENWD5QKRcgAbvnYGk15WtmxugBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBAgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTU5MzI2MDM1NTEwNTc3NzAYAA&sigh=t98rAuUgAho&uach_m=[UACH]&cid=CAQSGwCNIrLMWQXJ3FT8_6KjI7LVGn7AjA890-z1vxgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=250&slotname=5036826220&adk=354449457&adf=2233235524&pi=t.ma~as.5036826220&w=300&lmt=1656947486&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666773&bpp=2&bdt=136&idt=249&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&prev_fmts=160x600_as&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1278&ady=22&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cle%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=alyFX68KUT&p=http%3A//www.419scam.org&dtd=252
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Jul 2022 19:41:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Jul 2022 19:41:07 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame F772 0
0 771ms
13ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kvi0Ed2BMKwC-gGdg2ICAgAAAJvdTK7YWvvwav6yuxBTQsNiJHSpunOu82eNcHEAEgAA&wp=YsNCUwADBOkKGKAPAAJpHcNevESL4q_SmyPUew

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:05 GMT
server: Kestrel
server-processing-duration-in-ticks: 213318
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 0C31 169 KB
53 KB 163ms
131ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YsNCUwADBOkKGKAPAAJpHcNevESL4q_SmyPUew&u=%7CLQJZLY5OTQIvGCEPKUr14Ezq8JRZRI7x3rLy0c4XhKw%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4JdLNIKaOnb5OzEWkIpq6r1BJdkqejnNl5wdET7w9Lynnsa4K0oztSUuiNb7ea8x9_qSlMDLBTeqC1tfKz5nTWXtY2r7s3FkT8mvSwAMi3aAbJL2mnQTP_ycGjUklDBOkfIXo2wengCQj6rpvetfDncuq1r-1OKPwO3EEq2w_87TPo6fWvhE9aGkZ4CuSzeCqTAotFEsOgkQwozvU8tn4TYBOjfymVZnEFG6ZB4ZaTH_R5YYba0PDSVazPmqwnrMZiMud4tZ-XH5Dk1h4cfi1Jz_rFwXn7wlUKXlB6ou_iymqjrBLHUyCSYioKVOOe0OFSM8jrVJeF-yGh1knFz6GA4yWppVFqrshyzAyeA3NvYP0MUPfkY5gYgWTAvHC3J6PWMRCBvYXm79KFUfYfMo_Red1uyVYtXiYLGtBjeupeUmIONmCF6im3gCoPJYyXlTb8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9cEZU0LDYumJDI_AYp3SiYAKyZ7SsVzVnZH3cMCNtwEQASAAYJWCgICYB4IBF2NhLXB1Yi01OTMyNjAzNTUxMDU3NzcwoAHVttLqA8gBCakCiT4d55Z-sT6oAwGqBL0BT9Bsl6sBLdVNRfTBtoFEqE3Auk0v0oMmn0kjoFT1zEmCG4zp-NH_0XstyYcmK0o6iPo9AKMFr0jNffo1OB2a3sWXe_Gu3bSvnxrsARfaJJorm94rotm5lQDEMZccNxJgNqrdC-rARKjbZxjnvwdY-HdesVzFgIhTeYicGCThVgrfTK4dySvoo1YeGww139YJ0ztYMbZxyEzxy14zKC4sC4VKfER7cYCS35hh1U8-sjZeL_IoLeVTxLfjZHxZgAbvnYGk15WtmxugBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_33TFdprg5eUPv-mHk9KaykdZ9jzg%26client%3Dca-pub-5932603551057770%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b1016428791fa571bba7cb478efb249daa2ab22c32c808d9576a4c4513916022

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 19:41:06 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=uA5nCCnQ6Ig_u_8PAEqlGXpYoLHphzHx5p1Xubh5MHs9-bOtf7r5Y9DlMubpE7p9BZFs577bRtKQnHoN-HATh2V4LadxUVvqSg8aaGLpamsAU3E90qp-2_qidj_E-RvOnWkFSDDN3aMU9UhqlHHA0ylrFxd7M5W08jTq_wLRWDnanwva678unR8Co9Yqx-CtLX1H0qnvbh6GYgHgYlOt8gd_Xt2Q_I-yLlJi5398P4TVuXjE4snyKiNNnbNrwWx9xyaUlQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 92500595
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C9D2 0
0 56ms
56ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cr9JlU0LDYvr9Cuymx_AP9eiruA3JntKxXNWdkfdwwI23ARABIABglYKAgJgHggEXY2EtcHViLTU5MzI2MDM1NTEwNTc3NzCgAdW20uoDyAEJqQI6ynDYp32xPqgDAaoEtwFP0K7FyOO6tHhZfSfB58Vh9TRLy_YZo8RZnYVi6UQY_wnKOOQyw01B4sGon7yEthwJqvXtGbgmHeRT-XC0IbePf4J04AE1GIdoJWXfGXA8qiYW3KWrajKfmMstC47tCAqUx4fmWaoeGl-EQR916dZcwITKs6FcseC8iMXcywMb4BVLlbxgWa9eU8d7g99L0hdw3ky3WHBAdaq70UfF6Shv869b8aZuL8VX8pOD0rEiERROyMU3Iu-ABu-dgaTXla2bG6AGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItNTkzMjYwMzU1MTA1Nzc3MBgA&sigh=ztD_GlMNj30&uach_m=[UACH]&cid=CAQSGwCNIrLMRJqcp6FcuQHIBBU2zEqSERjzkG7M4BgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=600&adk=903252076&adf=417655153&w=160&lmt=1656947486&format=160x600_as&color_bg=ffffff&color_border=ffffff&color_link=0000ff&color_text=000000&color_url=336699&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666760&bpp=11&bdt=124&idt=242&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&correlator=2007524466836&frm=20&pv=2&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=29&ady=478&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=d%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=1&uci=a!1&fsb=1&xpc=BKqUWmzzSu&p=http%3A//www.419scam.org&dtd=256
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 04 Jul 2022 19:41:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 04 Jul 2022 19:41:07 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame C9D2 0
0 768ms
14ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kvi0EdyBMKAB2ASdg2ICAgAAAOXtFIV3mmoyav6yuxBSQsNiDUnbhqV_vaeD3T8AEgAA&wp=YsNCUwACvvoIEdNsAAr0dZRqODBixPsKbkNlnA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
server: Kestrel
server-processing-duration-in-ticks: 300819
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 0D3E 161 KB
52 KB 128ms
100ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YsNCUwACvvoIEdNsAAr0dZRqODBixPsKbkNlnA&u=%7CLQJZLY5OTQJiG1L7uPKW034aTWXXKwWRJAjyuORszfo%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4LyNiDdWbBE0KFZFDzc8wcwoBBdNKDMeYb-ySpOQSbyTzQGi8hxNw27zWHWvmfjv5S-oXAAaowW5gE9kFbSIi3bSJ8PYEPNepf_2-3h60u10nJ_--IyXpzlQyyOnQkRLvCr8VrkaUtA_ojqT4BBRXE6vekrIqC3HjhZ0Su0eujMDjCz2QhPFFq7SQ7s5e_SKhDkie-LyB5uqQ6JEGKvyuCuKAih3AqYhwpuPc5gXbyS7IecxLOTYE10gvrlHi12dzN9UOOs103o2yta1Kky7Q5SaVps93huHaRQSMFZ1FdcTTwJmHgyV1iicn3ffnwj9qksqs0ukmaKfn4qzJ1icIjJNP64zt0R2Ko-0xGVeA8VeodxWtfsaBzA9MrPJVexRalHHpVQpTdBSifxWehlo4o2SkEYFHzlbQWoS6N-l1RHU4hjARUjj0OioW4Y4I7FCCM&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwrWWU0LDYvr9Cuymx_AP9eiruA3JntKxXNWdkfdwwI23ARABIABglYKAgJgHggEXY2EtcHViLTU5MzI2MDM1NTEwNTc3NzCgAdW20uoDyAEJqQI6ynDYp32xPqgDAaoEugFP0K7FyOO6tHhZfSfB58Vh9TRLy_YZo8RZnYVi6UQY_wnKOOQyw01B4sGon7yEthwJqvXtGbgmHeRT-XC0IbePf4J04AE1GIdoJWXfGXA8qiYW3KWrajKfmMstC47tCAqUx4fmWaoeGl-EQR916dZcwITKs6FcseC8iMXcywMb4BVLlbxgWa9eU8d7g99L0hdwnE6WyvfP6bkETVNmORXJC6ZP-xBkAd3VRlu-dEOdDzhWTW-zMVB-hGuABu-dgaTXla2bG6AGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2jNXL-hhgCrauYHyz2YOONIGMHKw%26client%3Dca-pub-5932603551057770%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a3170280deede0d5f07775e3b9fca6d691842a1022acc4202fb0d27148ed299a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 19:41:06 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=78aXASnQ6Ig_u_8PK9AQ6CRXFz0t5fZ2ffHuS4yjOrMYcawauAdv1a5z0WMXJDjg2XsIumVimStVSgOOUKhVLdupXR97ujRWl9rxSbHXmlnESKCSEBS-q799PMXTkGLmyaqF96EhUi3SpWEOPYOAY_6Ss_cYgqog4s3ox57dRUQtJWBikNxzKDGF7sXz76kGOetbDlEtAPydkVNoGo7M0j0pl2tHdfj3nnKS_2eMSE8ILVTHaqVlZhalJ6A"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 84488271
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 0D3E 2 KB
1 KB 51ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YsNCUwACvvoIEdNsAAr0dZRqODBixPsKbkNlnA&u=%7CLQJZLY5OTQJiG1L7uPKW034aTWXXKwWRJAjyuORszfo%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4LyNiDdWbBE0KFZFDzc8wcwoBBdNKDMeYb-ySpOQSbyTzQGi8hxNw27zWHWvmfjv5S-oXAAaowW5gE9kFbSIi3bSJ8PYEPNepf_2-3h60u10nJ_--IyXpzlQyyOnQkRLvCr8VrkaUtA_ojqT4BBRXE6vekrIqC3HjhZ0Su0eujMDjCz2QhPFFq7SQ7s5e_SKhDkie-LyB5uqQ6JEGKvyuCuKAih3AqYhwpuPc5gXbyS7IecxLOTYE10gvrlHi12dzN9UOOs103o2yta1Kky7Q5SaVps93huHaRQSMFZ1FdcTTwJmHgyV1iicn3ffnwj9qksqs0ukmaKfn4qzJ1icIjJNP64zt0R2Ko-0xGVeA8VeodxWtfsaBzA9MrPJVexRalHHpVQpTdBSifxWehlo4o2SkEYFHzlbQWoS6N-l1RHU4hjARUjj0OioW4Y4I7FCCM&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCwrWWU0LDYvr9Cuymx_AP9eiruA3JntKxXNWdkfdwwI23ARABIABglYKAgJgHggEXY2EtcHViLTU5MzI2MDM1NTEwNTc3NzCgAdW20uoDyAEJqQI6ynDYp32xPqgDAaoEugFP0K7FyOO6tHhZfSfB58Vh9TRLy_YZo8RZnYVi6UQY_wnKOOQyw01B4sGon7yEthwJqvXtGbgmHeRT-XC0IbePf4J04AE1GIdoJWXfGXA8qiYW3KWrajKfmMstC47tCAqUx4fmWaoeGl-EQR916dZcwITKs6FcseC8iMXcywMb4BVLlbxgWa9eU8d7g99L0hdwnE6WyvfP6bkETVNmORXJC6ZP-xBkAd3VRlu-dEOdDzhWTW-zMVB-hGuABu-dgaTXla2bG6AGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2jNXL-hhgCrauYHyz2YOONIGMHKw%26client%3Dca-pub-5932603551057770%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 0D3E 2 KB
1 KB 51ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 0D3E 308 B
637 B 49ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 0D3E 293 B
621 B 50ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 0D3E 43 B
348 B 57ms
19ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=b0BdONcLyw55WLtKhWOmAKHBgLeTjzucNKRG9i4n3C5qnY6qc5DjuspAWyTpVbBodYGh5U-rq1tfKqewttfw34YntJQv_i-_VlQZbibhJv39hAVLJB5qWovqJOez_poDY1HJ6lCks1xjVP4lUCrTeVNPPQUN8qU1gPdlu8xTbLkTG0juPqzlPADxWz7yKuLACGveMuXPTi9b6owfvoZXrsq0HyePPX_SAvHTc8EgGAl8S_swYa-vrhbj0bisitq_H8VYzGpJRHgQsgqy6gf0cNEEirQUpoEpQTbIpzw09Oa6Q-eG4b_JfHscgMerf3vIE5x85zhEnMgxHiXwRL1qZC8ykWK0wshiJTaZQR1LyZTV3LuhLnUvMcz_NqRu2RprAIemKdKG0lSwhODlv58VkK7MsOQffpkf1KRkFtOW5YKnaih4bQc7W5P4nMNb-tAbAFt5HQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Jul 2022 19:41:05 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2961292
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 0D3E 12 KB
5 KB 39ms
15ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2849757
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tkCbFMVU564SMxYiI%2FV%2B7U7Va%2BN7FLPPPeR%2FVM5RQFBgbb24ViG9zOe0XvlqVaRSlrdZ0AoDjDgX9O3HkH6%2Fd7aHYjM2VKxjPMgzX50tTux5pFs86xIRG5m8cQvISvjpxD7pA883g2xwfPb1ZhiZeN7B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 725a562a3ac19baa-FRA
expires: Sat, 24 Jun 2023 19:41:07 GMT

GET
H2 200 3753f6ac31b748bf945ad731cbf52c0b_skyscannerrelative-book.woff
static.criteo.net/design/dt/ Frame 0D3E 68 KB
68 KB 83ms
51ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/3753f6ac31b748bf945ad731cbf52c0b_skyscannerrelative-book.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

b40ed885c6eabc68309c7e3377008ec3aaba2add66e43fcf6fc2851cdc6a2f98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Thu, 29 Jul 2021 10:27:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61028283-10ec0"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 e228b6a4e90947dcaf6c5ad0025ee925_skyscannerrelative-bold.woff
static.criteo.net/design/dt/ Frame 0D3E 68 KB
68 KB 49ms
18ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/e228b6a4e90947dcaf6c5ad0025ee925_skyscannerrelative-bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

9cb93fc023cca355260310e41056be397ecad26f94a578c5b147762b40fc6d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Thu, 29 Jul 2021 10:27:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61028283-10f14"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 0D3E 12 KB
6 KB 16ms
16ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0D3E 24 KB
24 KB 590ms
34ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=7450&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F7450%2F211022%2Fe47551705bde4240a673c74cf1908518_img_vertical_1.png&v=3&w=1200&s=sSCl_wz20me2O8QAzdPYk4CH

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

a13ff34f1f6805135cb084e3cb1044861ca7037ddeaff9e8359bec5cf4010ef4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=28745688
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 24096
expires: Fri, 02 Jun 2023 12:35:56 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 0D3E 0
128 B 56ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=78aXASnQ6Ig_u_8PK9AQ6CRXFz0t5fZ2ffHuS4yjOrMYcawauAdv1a5z0WMXJDjg2XsIumVimStVSgOOUKhVLdupXR97ujRWl9rxSbHXmlnESKCSEBS-q799PMXTkGLmyaqF96EhUi3SpWEOPYOAY_6Ss_cYgqog4s3ox57dRUQtJWBikNxzKDGF7sXz76kGOetbDlEtAPydkVNoGo7M0j0pl2tHdfj3nnKS_2eMSE8ILVTHaqVlZhalJ6A&sds=2&rev=81891&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Jul 2022 19:41:07 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 0D3E 2 KB
1 KB 18ms
18ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 0D3E 2 KB
1 KB 18ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 0C31 2 KB
1 KB 34ms
33ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YsNCUwADBOkKGKAPAAJpHcNevESL4q_SmyPUew&u=%7CLQJZLY5OTQIvGCEPKUr14Ezq8JRZRI7x3rLy0c4XhKw%3D%7C&c1=0n2XosTo5cmJbNb7DNNVBd09feAUrRU5KgFh9XNQv4JdLNIKaOnb5OzEWkIpq6r1BJdkqejnNl5wdET7w9Lynnsa4K0oztSUuiNb7ea8x9_qSlMDLBTeqC1tfKz5nTWXtY2r7s3FkT8mvSwAMi3aAbJL2mnQTP_ycGjUklDBOkfIXo2wengCQj6rpvetfDncuq1r-1OKPwO3EEq2w_87TPo6fWvhE9aGkZ4CuSzeCqTAotFEsOgkQwozvU8tn4TYBOjfymVZnEFG6ZB4ZaTH_R5YYba0PDSVazPmqwnrMZiMud4tZ-XH5Dk1h4cfi1Jz_rFwXn7wlUKXlB6ou_iymqjrBLHUyCSYioKVOOe0OFSM8jrVJeF-yGh1knFz6GA4yWppVFqrshyzAyeA3NvYP0MUPfkY5gYgWTAvHC3J6PWMRCBvYXm79KFUfYfMo_Red1uyVYtXiYLGtBjeupeUmIONmCF6im3gCoPJYyXlTb8&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC9cEZU0LDYumJDI_AYp3SiYAKyZ7SsVzVnZH3cMCNtwEQASAAYJWCgICYB4IBF2NhLXB1Yi01OTMyNjAzNTUxMDU3NzcwoAHVttLqA8gBCakCiT4d55Z-sT6oAwGqBL0BT9Bsl6sBLdVNRfTBtoFEqE3Auk0v0oMmn0kjoFT1zEmCG4zp-NH_0XstyYcmK0o6iPo9AKMFr0jNffo1OB2a3sWXe_Gu3bSvnxrsARfaJJorm94rotm5lQDEMZccNxJgNqrdC-rARKjbZxjnvwdY-HdesVzFgIhTeYicGCThVgrfTK4dySvoo1YeGww139YJ0ztYMbZxyEzxy14zKC4sC4VKfER7cYCS35hh1U8-sjZeL_IoLeVTxLfjZHxZgAbvnYGk15WtmxugBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_33TFdprg5eUPv-mHk9KaykdZ9jzg%26client%3Dca-pub-5932603551057770%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 0C31 2 KB
1 KB 16ms
16ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 0C31 308 B
636 B 20ms
19ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 0C31 293 B
621 B 21ms
20ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 0C31 43 B
347 B 20ms
19ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=IYGrb2WL95q6EZFlJLoyJiL0J0w3xxiD0DqcauJq85og5yDgriCCmSA0pQk5rLwDHhE_1hL-drNV1XDFy07zr9I4GdtYYyPXoSiRI9zUhhATKcu4dRmTOM0rWFHoBYPYpsX179Yn1ZPKudHTok9NqNZGPQTrXpsx-v1Swe5ni-bUGxzgxSyMi1Yn7pOgGstNDiHOm4BYp_RRsPkTpslyr7i8dkvOXeIf9IHHjlP10TOAK3N4Q41i0TdyhdMRG6wRzUNDVfos8zK_SwTQgWeoiz8xeZhTDNEPn1-ggzrm0046MJMxD4OV9IBzWWnwiuIJuhYFAq7NtuORDqijqGN8JSnth0VDzTQycmj-yfvHLpYkucV48WuR7wIBfeZxGbriNkqr4q_L7UJ46xbSaXx_1gsQPbgz_QLofCtJi831Jb9zyeUV_5QeiZh3QPi8axl6gHlR8rJb--BB0V5HxS3UfOy2TY0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Jul 2022 19:41:06 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3235402
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 0C31 12 KB
5 KB 314ms
12ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2849757
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pQgiXf4rsplOvrn660DVm%2Bbjd3mPkjy43L%2FqpI%2FsyOLxi0mN%2FJ%2F31WWHMuuoWooyHZbpBe8cv8OOudIZhB65qyz98%2B8L9QFboH0uajKJZ2%2F4YWt0Zaj%2Btna7k7AtTfxuaGrVZzPsttXG%2BgsM%2FHxFwHzn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 725a562c8eab9baa-FRA
expires: Sat, 24 Jun 2023 19:41:07 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 0C31 12 KB
6 KB 24ms
24ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 3753f6ac31b748bf945ad731cbf52c0b_skyscannerrelative-book.woff
static.criteo.net/design/dt/ Frame 0C31 68 KB
68 KB 17ms
16ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/3753f6ac31b748bf945ad731cbf52c0b_skyscannerrelative-book.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

b40ed885c6eabc68309c7e3377008ec3aaba2add66e43fcf6fc2851cdc6a2f98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Thu, 29 Jul 2021 10:27:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61028283-10ec0"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 e228b6a4e90947dcaf6c5ad0025ee925_skyscannerrelative-bold.woff
static.criteo.net/design/dt/ Frame 0C31 68 KB
68 KB 21ms
21ms Font
application/octet-stream 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/e228b6a4e90947dcaf6c5ad0025ee925_skyscannerrelative-bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

9cb93fc023cca355260310e41056be397ecad26f94a578c5b147762b40fc6d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Thu, 29 Jul 2021 10:27:15 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"61028283-10f14"
strict-transport-security: max-age=31536000; preload;
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0C31 24 KB
24 KB 504ms
28ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=7450&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F7450%2F211022%2F45f963b9b4db4061b7e96b7b9b33fb3d_img_horizontal_1.png&v=3&w=1200&s=aIsSsacyWVs96MWgv5ZIoipd

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e861d3c3bf074c8b832c72921647e53513a1493a855cbfe43820933cbeb35dca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30740769
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 24138
expires: Sun, 25 Jun 2023 14:47:17 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 0C31 0
127 B 18ms
18ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=uA5nCCnQ6Ig_u_8PAEqlGXpYoLHphzHx5p1Xubh5MHs9-bOtf7r5Y9DlMubpE7p9BZFs577bRtKQnHoN-HATh2V4LadxUVvqSg8aaGLpamsAU3E90qp-2_qidj_E-RvOnWkFSDDN3aMU9UhqlHHA0ylrFxd7M5W08jTq_wLRWDnanwva678unR8Co9Yqx-CtLX1H0qnvbh6GYgHgYlOt8gd_Xt2Q_I-yLlJi5398P4TVuXjE4snyKiNNnbNrwWx9xyaUlQ&sds=2&rev=81891&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Jul 2022 19:41:07 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 0C31 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 0C31 2 KB
1 KB 17ms
17ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:07 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 29 Jun 2023 19:41:07 GMT

GET
DATA 200
OK truncated
/ Frame C9D2 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c318752c54521f66a5b1186ccef2cc4b882febf81c60b957a980c652361389cf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame F772 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 27fe5405f45548d34493197523a699f5e906b0de5ceb66e06871bba2a419a359

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 61ms
32ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220629&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b49edcc8d12f4b575e4fd4f3e20431803944bf375d7bafe2291247f97cb399db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 04 Jul 2022 19:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10655
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 57ms
27ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 04 Jul 2022 19:41:08 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E56F 13 KB
5 KB 13ms
13ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://www.419scam.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3183
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 18:48:05 GMT
expires: Tue, 04 Jul 2023 18:48:05 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 80CC 783 B
536 B 85ms
34ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

65c9f12d89b03cb7b1f076ab35b48aa9ecdca2b6dc059f3af2b3f6b5286a10bb

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-73Xpc61uQ9BajKhDhZiW6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.419scam.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-73Xpc61uQ9BajKhDhZiW6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 04 Jul 2022 19:41:08 GMT
expires: Mon, 04 Jul 2022 19:41:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js Show response
pagead2.googlesyndication.com/bg/ Frame E56F 36 KB
14 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/aHhPXGVii6m1UdQEw4dl9bTaUK-_iBumPQ-RERU6U4M.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 12:31:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25768
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13869
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Jul 2023 12:31:40 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E56F 0
9 B 13ms
12ms Image
text/plain 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?hLkE7w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 04 Jul 2022 19:41:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 80CC 0
0 55ms
55ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220629&jk=2280594257040615&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

POST
H2 200 all
csm.eu.criteo.net/ Frame 0D3E 0
127 B 17ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Jul 2022 19:41:08 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

POST
H2 200 all
csm.eu.criteo.net/ Frame 0C31 0
127 B 17ms
17ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 04 Jul 2022 19:41:08 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 58ms
58ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220629&jk=2280594257040615&bg=!UVKlUhbNAAaLlKKnq5Q7ACkAdvg8Wv9Lt9DH6xm6Oj5UFcSDEtVKfh4fa3FKty1Lcsn4E4l-ryfd7AIAAABLUgAAAAJoAQcKANEO-JkCeOrxke6Q6y5jxXsujY4f95oy41cuhc2z3iBgF_bUXBzP9joyxD5O_klsVA2OGPMm-qY7y1h7cZkhrtOprmD1Pm1N3EIN_Rw9PujJkIFKLS_VYRiiqu-WStOYzZmeNp6XkbuQrvv0V3RMiJw2BtUfG-_kylnUXIR0H4Ii0e2LjzZKGMeL8ePtPgpCLLxcdHrr1JsN-DKiyr5X3RZDpXxthcHse08jfvWEeU_-13_q8ydIWqV2J4gqFURsRVH6sxfwoOCOpMbdJILzoOtGlpkCjtH72eZwyGwLA63--EL4DLZmgi7pJ4Jcl5-OrUcTnKz7SdnVfBUVLYDT7e6JJK0UHy5eIK85BzmiZmL2pdZdjgQNDYdYYWj3fAZJQWDxosuiC6i3iKdKvr8mjVzIWfG1xYsw9z9aLRT_-mCCB9Qw4e6YCazvo18pTtdkMcmuymz7q2ofNAmzjlB0rSI-Nqn_9eG3yLiNZ6nDt6andLpOYHqVmVDRQnqvWbfIfeTA4CYsOEvqY4tdFuO3U_Vmt08s0L8x1dqdWSwDm96i4fYk-5M4Ah58xUIGVfpoYbEyFMexYS080AtszRQl3zb-1Zb4qntMdYLt8xCxSVzmiWaldUmcEDNRtdZvXfvi-4QZvvMZOSCptprzQNQRoSTyg0Z-0UqfD_7wLotkI74wlXkipS1jgn_uI-oHDzFt-3QOwYlMxUea3GIFUe5046rtTKx9ztdR4cSKfCatmVoFYwq7VEg5UrvrfsqL4vfC5LVFVenugjBUxsLHgmiLnn3WQQZSC3zb8na4DyYbd1GA8WYJ92iL2aDYV70mYLI3CwbWdl0aTLI0aEWXiBQ7AXAVWO3KOJONA_IcIKow85UIm-lIWR6ohsPMjTTj-IwPi4Nae8yyILBJ5TSQiMArAmgUSZf3pZa8E7MGYHZFDRF2hIIemLWijRqlnbDedjphPBDK_HNeXc4p7phF6NoN4lNlFfAZUMLX2o0GudN9lGrnKg1WDOMs4HvCeH4vaA0kbUHN8WlPIc7Pe3kJPfanxxgP6rP3kbIQcB_4rOjovQzoGaoQtuQPwIwHenTb1pAE-BmO2udHrcnPXmgU86TIlpqhUmNMTConC1fzVi1vciA3NXoydl44Mz3lDvWSYJR5MIiDBg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.419scam.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F772 42 B
64 B 46ms
46ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss8LTtgeAND6ra-pievqRG1kRWjKxgKTSsLrAl0Sals9ScJrIjd2hUAnHoDeHxPdx7N_1fda-o8kDkZJq11u4nRPWk&sig=Cg0ArKJSzLwPcz_F3CbUEAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220627&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=354449457&rs=2&la=0&cr=0&vs=4&r=v&rst=1656963667026&rpt=1208&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Jul 2022 19:41:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C9D2 42 B
64 B 47ms
47ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssiN8ZmF6mn5BRc_c7lZEh9srleK4j23TlbV5JJy4q_DDovwx3QQAvY4Hact0KJr-azBtSECa2sGWUvtEQU3jVeBc8&sig=Cg0ArKJSzEyy8dlxKf1MEAE&id=lidar2&mcvt=1002&p=0,0,600,160&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220627&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=903252076&rs=2&la=0&cr=0&vs=4&r=v&rst=1656963667017&rpt=1203&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 04 Jul 2022 19:41:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

251 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.419scam.org/	1970-01-20 21:47:15	Name: __utma Value: 94131288.542221393.1656963667.1656963667.1656963667.1
.419scam.org/	1970-01-20 04:16:05	Name: __utmb Value: 94131288
.419scam.org/	1969-12-31 23:59:59	Name: __utmc Value: 94131288
.419scam.org/	1970-01-20 08:38:51	Name: __utmz Value: 94131288.1656963667.1.1.utmccn=(direct)\|utmcsr=(direct)\|utmcmd=(none)
.419scam.org/	1970-01-20 13:37:39	Name: __gads Value: ID=4c99efd735dfdf95-2295ba46c5cd001c:T=1656963667:RT=1656963667:S=ALNI_MZL69lGqJYj8Hqz8w62RsHNQMw3qA
.quantserve.com/	1970-01-20 13:46:18	Name: mc Value: 62c34253-4151f-51c6a-cadbd
.419scam.org/	1970-01-20 13:40:32	Name: __qca Value: P0-414304692-1656963667193
.doubleclick.net/	1970-01-20 13:37:39	Name: IDE Value: AHWqTUmNdMr1QyXg1ws5fFi6DmZpnxIukWpnjmYSF32I3MzP1gEt-ZoyDBpSWrkcniY

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5932603551057770&output=html&h=250&slotname=5036826220&adk=354449457&adf=2233235524&pi=t.ma~as.5036826220&w=300&lmt=1656947486&url=http%3A%2F%2Fwww.419scam.org%2F419-bl-j.htm&wgl=1&dt=1656963666773&bpp=2&bdt=136&idt=249&shv=r20220629&mjsv=m202206280101&ptt=5&saldr=sa&abxe=1&prev_fmts=160x600_as&correlator=2007524466836&frm=20&pv=1&ga_vid=542221393.1656963667&ga_sid=1656963667&ga_hid=768329883&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&adx=1278&ady=22&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44760911%2C31067983%2C31068196%2C42531608&oid=2&pvsid=2280594257040615&tmod=1330203407&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cle%7C&abl=CS&pfx=0&fu=0&bc=23&ifi=2&uci=a!2&fsb=1&xpc=alyFX68KUT&p=http%3A//www.419scam.org&dtd=252 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
adservice.google.com
adservice.google.de
cat.fr.eu.criteo.com
cdnjs.cloudflare.com
csm.eu.criteo.net
edge.quantserve.com
googleads.g.doubleclick.net
joewein.net
jwspamspy.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
pixel.quantserve.com
rtb.nl.eu.criteo.com
rules.quantcount.com
static.criteo.net
tpc.googlesyndication.com
www.419scam.org
www.google-analytics.com
www.google.com
www.googletagservices.com
142.250.181.226
176.9.54.44
178.250.0.139
178.250.0.160
178.250.0.162
2001:4860:4802:34::178
2600:9000:2315:9c00:6:44e3:f8c0:93a1
2606:4700::6811:190e
2620:116:800d:21:7eb1:3826:be7e:d981
2a00:1450:4001:80e::2002
2a00:1450:4001:827::2002
2a00:1450:4001:827::2004
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2001
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a02:2638:1::2
2a02:2638::3
2a02:2638::b
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
156c27b55aa9ddc38f7b8065234b3a2fbe50f1f469cfd529e38a444bd749bc7a
27fe5405f45548d34493197523a699f5e906b0de5ceb66e06871bba2a419a359
29a74bd48fa0b500b61194468e760e8acef2f465e782e0da3eb219850bcea8fb
42080d47a0cc58fca77bbd2598153bbc1cd9be4e3e0ddb42c7653a21eefab5ab
4488333adcd7deb7572caaa680e1a4d9df638ed0738f20b064408fd67fac9428
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5ca13d3f4ebba899768f7715eac1973e9b8233941f4c7fdb273ccd4558aab71a
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63ccc34c56ddde9859e5fabe9fe08fc891b8045aa804d5909a57dbc5dadc6f10
65b488811bd504ecd9037c0aee94c56a7bcd0870c2ae8818f6cf60cb3ba51621
65c9f12d89b03cb7b1f076ab35b48aa9ecdca2b6dc059f3af2b3f6b5286a10bb
67315acd47fca91a767aa68f94f8666c7ca01eebf6012326da7edb7e97106502
68784f5c65628ba9b551d404c38765f5b4da50afbf881ba63d0f9111153a5383
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
75a2067c9dff8e58ae83cdb8ee4fe896013966ac4e8f3f1d5e8a75f27c9a1ae2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84d1ee47df256fbcd1042850b8fd40df9ca9952a5b37608f019f2f438713fa30
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
9cb93fc023cca355260310e41056be397ecad26f94a578c5b147762b40fc6d3b
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a13ff34f1f6805135cb084e3cb1044861ca7037ddeaff9e8359bec5cf4010ef4
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a3170280deede0d5f07775e3b9fca6d691842a1022acc4202fb0d27148ed299a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
b1016428791fa571bba7cb478efb249daa2ab22c32c808d9576a4c4513916022
b40ed885c6eabc68309c7e3377008ec3aaba2add66e43fcf6fc2851cdc6a2f98
b49edcc8d12f4b575e4fd4f3e20431803944bf375d7bafe2291247f97cb399db
b75c57c03ca26ab9f26972e8835dcbc7607b47c156aeebdfb2f3683c72048a61
c318752c54521f66a5b1186ccef2cc4b882febf81c60b957a980c652361389cf
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ccf249e9a41cb390abd80cc9299faf5883ee442c206c504580e920d0a1041df7
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4b2b4513bbc0e868fe8aa38355cafd1e09f3e9790ae4cc324511207e2b8ac81
e861d3c3bf074c8b832c72921647e53513a1493a855cbfe43820933cbeb35dca
eea68618f20dd447286814d4a8184cf320e7e1eb32fa9559bf8f878df2e45ff6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f070a8bdccb53efc33eca3c58be787ecbc3a4bfa9d94d58e45b3f20ec6b28450
f547c4dd88bd36a62fb778f5838558cb1181a7cd53680b837b81192f29b17fd8
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

www.419scam.org Open in urlscan Pro 176.9.54.44 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

70 Requests

93 %HTTPS

74 %IPv6

15 Domains

22 Subdomains

20 IPs

3 Countries

1308 kBTransfer

2271 kBSize

8 Cookies

9 Outgoing links

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.419scam.org Open in urlscan Pro
176.9.54.44 Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

93 %
HTTPS

74 %
IPv6

15
Domains

22
Subdomains

20
IPs

3
Countries

1308 kB
Transfer

2271 kB
Size

8
Cookies

70 HTTP transactions
2 data transactions