ip170.ip-51-89-105.eu Open in urlscan Pro
51.89.105.170 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ip170.ip-51-89-105.eu/
Submission: On November 21 via automatic, source openphish (November 21st 2023, 3:15:05 am UTC) — Scanned from GB

Summary HTTP 50 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 21 IPs in 5 countries across 14 domains to perform 50 HTTP transactions. The main IP is 51.89.105.170, located in London, United Kingdom and belongs to OVH, FR. The main domain is ip170.ip-51-89-105.eu.

This is the only time ip170.ip-51-89-105.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Libero (Online)

Domain & IP information

	IP Address	AS Autonomous System
5	51.89.105.170 51.89.105.170	16276 (OVH) (OVH)
4	13.32.99.92 13.32.99.92	16509 (AMAZON-02) (AMAZON-02)
3	213.209.30.161 213.209.30.161	8660 (MATRIX-AS) (MATRIX-AS)
1 2	108.138.1.25 108.138.1.25	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
1	185.54.150.20 185.54.150.20	60164 (WEBTREKK-AS) (WEBTREKK-AS)
1 2	18.245.60.76 18.245.60.76	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	35.157.51.73 35.157.51.73	16509 (AMAZON-02) (AMAZON-02)
1 7	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1 2	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
2	34.248.37.96 34.248.37.96	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:223... 2600:9000:223f:7e00:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2600:1f18:1ac... 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b	14618 (AMAZON-AES) (AMAZON-AES)
50	21

5 51.89.105.170 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip170.ip-51-89-105.eu

ip170.ip-51-89-105.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.99.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-92.fra60.r.cloudfront.net

i1.plug.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i.plug.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i3.plug.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 213.209.30.161 (Assago, Italy)

ASN8660 (MATRIX-AS, IT)

www.iolam.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.138.1.25 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-138-1-25.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.54.150.20 (Germany)

ASN60164 (WEBTREKK-AS, DE)

italiaonline01.wt-eu02.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.245.60.76 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-245-60-76.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.157.51.73 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-51-73.eu-central-1.compute.amazonaws.com

italiaonline.profiles.tagger.opecloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.134 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.248.37.96 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-37-96.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:223f:7e00:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 149	321 KB
9	doubleclick.net 2 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 ad.doubleclick.net — Cisco Umbrella Rank: 154	182 KB
8	adsafeprotected.com pixel.adsafeprotected.com — Cisco Umbrella Rank: 736 static.adsafeprotected.com — Cisco Umbrella Rank: 587 dt.adsafeprotected.com — Cisco Umbrella Rank: 570	104 KB
5	ip-51-89-105.eu ip170.ip-51-89-105.eu	87 KB
4	plug.it i1.plug.it — Cisco Umbrella Rank: 344750 i.plug.it — Cisco Umbrella Rank: 273675 i3.plug.it — Cisco Umbrella Rank: 625510	8 KB
3	iolam.it www.iolam.it — Cisco Umbrella Rank: 293470	182 KB
2	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 1359 www.google.com — Cisco Umbrella Rank: 2	11 KB
2	gstatic.com fonts.gstatic.com	32 KB
2	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 172	739 B
2	amazon-adsystem.com 1 redirects c.amazon-adsystem.com — Cisco Umbrella Rank: 306	65 KB
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 212	64 KB
1	opecloud.com italiaonline.profiles.tagger.opecloud.com — Cisco Umbrella Rank: 294980
1	wt-eu02.net italiaonline01.wt-eu02.net — Cisco Umbrella Rank: 265757	901 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
50	14

	Domain	Requested by
7	securepubads.g.doubleclick.net	1 redirects ip170.ip-51-89-105.eu securepubads.g.doubleclick.net www.googletagservices.com
5	ip170.ip-51-89-105.eu	ip170.ip-51-89-105.eu
4	dt.adsafeprotected.com
4	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
3	www.iolam.it	ip170.ip-51-89-105.eu
2	static.adsafeprotected.com	pixel.adsafeprotected.com ip170.ip-51-89-105.eu
2	pixel.adsafeprotected.com	ip170.ip-51-89-105.eu
2	ad.doubleclick.net	1 redirects ip170.ip-51-89-105.eu
2	fonts.gstatic.com	fonts.googleapis.com
2	sb.scorecardresearch.com	1 redirects ip170.ip-51-89-105.eu
2	c.amazon-adsystem.com	1 redirects ip170.ip-51-89-105.eu
2	i1.plug.it	ip170.ip-51-89-105.eu i1.plug.it
1	www.google.com	tpc.googlesyndication.com
1	i3.plug.it
1	www.googletagservices.com	securepubads.g.doubleclick.net
1	2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	fundingchoicesmessages.google.com	www.iolam.it
1	italiaonline.profiles.tagger.opecloud.com	www.iolam.it
1	i.plug.it	ip170.ip-51-89-105.eu
1	italiaonline01.wt-eu02.net	ip170.ip-51-89-105.eu
1	fonts.googleapis.com	i1.plug.it
50	22

This site contains links to these domains. Also see Links.

Domain
adclick.g.doubleclick.net
www.libero.it
aiuto.libero.it
registrazione.libero.it
siviaggia.it
www.italiaonline.it
info.libero.it
privacy.italiaonline.it

Subject Issuer	Validity	Valid
*.plug.it Sectigo RSA Domain Validation Secure Server CA	`2022-12-05` - `2024-01-05`	a year	crt.sh
www.iolam.it Sectigo RSA Domain Validation Secure Server CA	`2023-01-09` - `2024-02-03`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.wt-eu02.net Sectigo RSA Domain Validation Secure Server CA	`2023-01-13` - `2024-02-13`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 8 frames:

Primary Page: http://ip170.ip-51-89-105.eu/
Frame ID: 8C519D9FADB0F87C5D2D4AFBB3DAD251
Requests: 35 HTTP requests in this frame

Frame: http://i.plug.it/iplug/js/lib/iol/analytics/ads/banners/_adv.js?_t=1700536500684
Frame ID: 27EA261F5FCCAB28B4D0355949D09D38
Requests: 1 HTTP requests in this frame

Frame: https://2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 469CDFDD3EE2AAE515117D60E1D1BF24
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvcgRa56yBmWsntveMg8Lw9U5K4TYY6jNkztaGnVje4K-XvD5JaxOCBApFQUojUJ6CLz0IQJA8WzYKLX0kE0MaYiuKMp1j4WkrHxdebE3dsFa9ijNUY_s76u0LayHW3oBjJL9V09zM0SyKoLWwJ5h9VW-ECZKHfLqIR1B15IWRIOBJOLMqSNX2LbXWF8W-kaI-4FX3FWCIH1gZywyNKhM9AH4UMLbiczWZsyhjHS5tOwZKn8GHk8WZ93Lgn-kkmqZSDMWwaqtEg95yozZypOCkzm4Nb_rD9cRcL8jRYRKjsEFS4QJF_Hb-ptBxmgw1ZCeMe-bBgM_BDx1M24-e4St8xyDpxaePOUOgFljhpnmKKxQYIZ4RPaQintuiNv58uOSoWagxEcA7qkE4AdlNCjUk&sai=AMfl-YTZoBKrul8tG2wRwCR0oS-AMVdr42DxVM12-Pq-EaAEBsz6zAxrIRVRbYnt_Bw3MoNJjUnT1iCmZaj3bOa4-Tnc_37vZN2n0_ua7uzwDLmbbyFcpo8Gn_2E9pvnsgAQRJ_1BMlS36S27y-UCkjTN3Q&sig=Cg0ArKJSzJZ5qFI7-qUwEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: B58BCA3D1AEA0C2E49E7011B5E7797DA
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 16C470A28A062C2766FE40407FBDC1D0
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F3F1833C3CD4DE714BF6FAB9F96FAEC4
Requests: 2 HTTP requests in this frame

Frame: http://pixel.adsafeprotected.com/jload?anId=926174&campId=1540x1024&pubId=14788727&chanId=21721897975&placementId=6411640681&pubCreative=138454077481&pubOrder=3269559519&cb=975430749&impId=&ias_adpath=%23adv_click
Frame ID: F62F058336DF247A2AA1936672D4B43A
Requests: 2 HTTP requests in this frame

Frame: http://static.adsafeprotected.com/sca.17.6.2.js
Frame ID: B18AEBEED0173EB105CBB818DF5A6FD4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Libero Mail - login

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

/prebid\.js

Page Statistics

50
Requests

50 %
HTTPS

55 %
IPv6

14
Domains

22
Subdomains

21
IPs

5
Countries

1057 kB
Transfer

2539 kB
Size

8
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://adclick.g.doubleclick.net/pcs/click?xai=AKAOjss6Yi21y9IqC2TETHbXx7XxFtqPsq-996cZ21VQkRGy2WReE5v2C1vY0XZmMI8A2udLiwcWP06TYztdGWO_HPCoewBPedtwyQ7SYSFPc1Aqskqt-I0JTRq0wC8Dx3ajyC70agoEcPpZ36WYjPlR_VuLmxlijo_0Q8g6bAG6tvaMCukwwwrtEUCM5UCqFuehSl-5EA1SPm3QD--rD9CUGt3HUjr3PcryHIRyY6zSRxtrEQvm-E_ZpIpwdhNSw8ccTd0v4LHpzsx6zvSMSnzx7305iRTeO8s47CbLEYD6ToV6tUIfeaj9_dJu4xQwc0OIG4bOMxKny2ywDQs-8iOuHqTM4s1C_tg3YB5F3OAyXaM3XXMkMKIINkvuAE2c&sai=AMfl-YSHk09u8gWZK_Jn6YBpP2gvRLsm8zKd9juvvwOtvWuzi5EBIfJt1YNgRY7k5QX2HC4NATgeWRGdVUtB9Ue4XE_EKBFSNF30hwhRVRzsw4fPFf8DZ2rJC6AR9xsCcQNXFCkmazdbAJhFdGY_jeV0plE&sig=Cg0ArKJSzExsiYYUTTD1EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=https://ad.doubleclick.net/ddm/trackclk/N439808.1781359ITALIAONLINE.IT/B31009887.380930859%3Bdc_trk_aid%3D571500821%3Bdc_trk_cid%3D204948630%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bltd%3D%3Bdc_tdv%3D1

Search URL Search Domain Scan URL

URL: http://www.libero.it/

Search URL Search Domain Scan URL

URL: https://aiuto.libero.it/
Title: AIUTO

Search URL Search Domain Scan URL

URL: https://registrazione.libero.it/?service_id=email&redirect_uri=http%3A%2F%2Fwebmail.libero.it%2Fcp%2Fdefault.jsp
Title: Registrati ora

Search URL Search Domain Scan URL

URL: https://siviaggia.it/

Search URL Search Domain Scan URL

URL: https://www.libero.it/

Search URL Search Domain Scan URL

URL: https://www.italiaonline.it/corporate/chi-siamo/
Title: Chi siamo

Search URL Search Domain Scan URL

URL: https://info.libero.it/note-legali/
Title: Note Legali

Search URL Search Domain Scan URL

URL: https://privacy.italiaonline.it/privacy_libero.html
Title: Privacy

Search URL Search Domain Scan URL

URL: https://privacy.italiaonline.it/common/cookie/privacy_detail.php?ref=libero
Title: Cookie Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://c.amazon-adsystem.com/aax2/apstag.js HTTP 301
https://c.amazon-adsystem.com/aax2/apstag.js

Request Chain 11

https://sb.scorecardresearch.com/b?c1=2&c2=33012141&cs_ucfr=0&ns__t=1700536500674&ns_c=UTF-8&c7=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&c8=Libero%20Mail%20-%20login HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=33012141&cs_ucfr=0&ns__t=1700536500674&ns_c=UTF-8&c7=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&c8=Libero%20Mail%20-%20login

Request Chain 17

http://securepubads.g.doubleclick.net/tag/js/gpt.js HTTP 302
https://securepubads.g.doubleclick.net/tag/js/gpt.js

Request Chain 29

https://ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/B31009887.380930859;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1 HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/B31009887.380930859;dc_pre=CKjn5pGQ1IIDFYKZ_QcdmHQINA;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1

50 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ip170.ip-51-89-105.eu/ 29 KB
29 KB 83ms
41ms Document
text/html 51.89.105.170
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://ip170.ip-51-89-105.eu/
Protocol: HTTP/1.1
Server: 51.89.105.170 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ip170.ip-51-89-105.eu
Software: Apache /
Resource Hash: 21d7579b5b7d351e245b32baa71866d1a494f0da53c81c45e6e2c70fd4a7c357

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 21 Nov 2023 03:15:00 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

GET
H2 200 style.css
i1.plug.it/mail/login/2020/libero/css/ 26 KB
5 KB 218ms
44ms Stylesheet
text/css 13.32.99.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://i1.plug.it/mail/login/2020/libero/css/style.css?01022022
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-92.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: eb97f750d5607e2544524de92d09cf088fee2d4484d14eeb16184448100df690

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:14:33 GMT
content-encoding: br
via: 1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA60-P3
age: 27
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: public, max-age=86400
x-amz-cf-id: 9hoca1TZNihsk5__8uzrx_GFm8w6c_KErgrCoThpcS8GDIIXVmrukA==

GET
H/1.1 404
Not Found iam2.0.js
www.iolam.it/js/ 0
0 112ms
56ms Script
text/html 213.209.30.161
MATRIX-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/
Protocol: HTTP/1.1
Server: 213.209.30.161 Assago, Italy, ASN8660 (MATRIX-AS, IT),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H/1.1 200
OK prebid.js Show response
www.iolam.it/js/ 467 KB
150 KB 128ms
71ms Script
application/javascript 213.209.30.161
MATRIX-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.iolam.it/js/prebid.js
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/
Protocol: HTTP/1.1
Server: 213.209.30.161 Assago, Italy, ASN8660 (MATRIX-AS, IT),
Reverse DNS
Software: Apache /
Resource Hash: bf04cc3daa882029d0bec76c3444dda192ce1779eb69642ca66440c72c5cc31f

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Transfer-Encoding: chunked
Upgrade: h2,h2c
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Expires: Wed, 22 Nov 2023 03:15:00 GMT

GET
H2

200

apstag.js Show response
c.amazon-adsystem.com/aax2/
Redirect Chain

http://c.amazon-adsystem.com/aax2/apstag.js
https://c.amazon-adsystem.com/aax2/apstag.js

267 KB
65 KB

130ms
47ms

Script
application/javascript

108.138.1.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: H2
Server: 108.138.1.25 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-1-25.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c8fe936e012d2d229577704c34c41a451d7a98aa5c2566ea5c3930aa7e3f40f

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 02:48:05 GMT
content-encoding: gzip
via: 1.1 cb0a9b0d01a1b0cc9278d9875ce23c92.cloudfront.net (CloudFront), 1.1 f13110b40e6214ad566c753a838f49f4.cloudfront.net (CloudFront)
last-modified: Mon, 13 Nov 2023 20:18:45 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P6
age: 1616
x-amz-server-side-encryption: AES256
etag: W/"2d08dd94de483579c1dc3f3783c06f6e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: gu_ipvNSKv7wRn_K3EJky1jGxEA46-E-Pll3LG4XuyQFuAltGYanqA==

Redirect headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Via: 1.1 c0c6d7afa25d841027d75444425d2010.cloudfront.net (CloudFront)
Server: CloudFront
X-Amz-Cf-Pop: FRA56-P6
X-Cache: Redirect from cloudfront
Content-Type: text/html
Location: https://c.amazon-adsystem.com/aax2/apstag.js
Connection: keep-alive
Content-Length: 167
X-Amz-Cf-Id: rV69rSk1UxTDzgC_z5kVIZ2CTgEvthAhAqWlnvX_SXFdqMeu2spp-g==

GET
H2 200 iam2.0.js Show response
www.iolam.it/js/ 138 KB
31 KB 173ms
62ms Script
application/javascript 213.209.30.161
MATRIX-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1

Requested by

Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.209.30.161 Assago, Italy, ASN8660 (MATRIX-AS, IT),

Reverse DNS

Software

Apache /

Resource Hash

bab579eb63de66ef6e1da663a09365752e647b34edbaf15a65ef8477817b55a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:00 GMT
strict-transport-security: max-age=63072000;
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 31766
expires: Wed, 22 Nov 2023 03:15:00 GMT

GET
H/1.1 200
OK 1WVfw4Yw8xor.png
ip170.ip-51-89-105.eu/images/ 1 KB
1 KB 41ms
41ms Image
image/png 51.89.105.170
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ip170.ip-51-89-105.eu/images/1WVfw4Yw8xor.png
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Server: 51.89.105.170 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ip170.ip-51-89-105.eu
Software: Apache /
Resource Hash: 8239d985179b5598a3b76db41bbd8842530e4e37e82665dc6449ed97b20c6227

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Last-Modified: Mon, 14 Nov 2022 10:52:19 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1154

GET
H/1.1 200
OK wpJ0jqagdDSx.svg
ip170.ip-51-89-105.eu/fonts/ 5 KB
5 KB 82ms
41ms Image
image/svg+xml 51.89.105.170
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ip170.ip-51-89-105.eu/fonts/wpJ0jqagdDSx.svg
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Server: 51.89.105.170 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ip170.ip-51-89-105.eu
Software: Apache /
Resource Hash: 54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Last-Modified: Mon, 14 Nov 2022 10:52:18 GMT
Server: Apache
Content-Type: image/svg+xml
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4827

GET
H/1.1 200
OK zlIY73HV9ZcD.js Show response
ip170.ip-51-89-105.eu/js/ 6 KB
6 KB 41ms
41ms Script
application/javascript 51.89.105.170
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://ip170.ip-51-89-105.eu/js/zlIY73HV9ZcD.js
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Server: 51.89.105.170 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ip170.ip-51-89-105.eu
Software: Apache /
Resource Hash: ba622f81f692dd7f4b54e5379346086874eff141a501881982c5a5b3b2370df8

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Last-Modified: Mon, 14 Nov 2022 10:52:22 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5930

GET
H/1.1 200
OK 0sBN1QtxZSRY.js Show response
ip170.ip-51-89-105.eu/js/ 45 KB
45 KB 42ms
42ms Script
application/javascript 51.89.105.170
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://ip170.ip-51-89-105.eu/js/0sBN1QtxZSRY.js
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Server: 51.89.105.170 London, United Kingdom, ASN16276 (OVH, FR),
Reverse DNS: ip170.ip-51-89-105.eu
Software: Apache /
Resource Hash: 17e49df09dd14c40d50c5e4693c448e99cfee8ee79aa5a9c5bd2be5be3105562

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Last-Modified: Mon, 14 Nov 2022 10:52:19 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 46107

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 139ms
49ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap

Requested by

Host: i1.plug.it
URL: https://i1.plug.it/mail/login/2020/libero/css/style.css?01022022

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2170f04df3b7e03e3439440b22f30247a1ee0606d4a0253e159c8a725372ac8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://i1.plug.it/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 03:15:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/bcfae741e379a885f2ab2cf83ebe6d32/mr
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 01:40:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 03:15:00 GMT

GET
H/1.1 200 wt
italiaonline01.wt-eu02.net/215973748390194/ 43 B
901 B 207ms
47ms Image
image/gif 185.54.150.20
WEBTREKK-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://italiaonline01.wt-eu02.net/215973748390194/wt?p=433,libero.web.messaging.smart.login.step1,1,1600x1200,24,1,1700536500673,0,1600x1200,0&pu=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&la=en&tz=0&cg1=libero&cg2=web&cg3=messaging&cg4=smart&cg5=login&cg6=step1&cg7=libero.web.messaging.smart.login.step1&cp1=no-referrer&cp2=no-referrer&cp4=no-refresh&cp7=utf-8&cp9=1.4.04&cp10=20220927140300&cp11=Libero%20Mail%20-%20login&cp12=web&cp24=email&cp25=http%3A&cp26=ip170.ip-51-89-105.eu&cp47=&cp103=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.54.150.20 , Germany, ASN60164 (WEBTREKK-AS, DE),
Reverse DNS
Software: 8f14e45f /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:00 GMT
Last-Modified: Tue, 21 Nov 2023 03:15:00 GMT
Server: 8f14e45f
P3P: policyref="https://q3.webtrekk.net/w3c/p3p.xml", CP="NOI DSP IND COM NAV INT"
Content-Type: image/gif;charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, private, post-check=0, pre-check=0
Connection: keep-alive
X-Robots-Tag: noindex, nofollow, noarchive
Keep-Alive: timeout=30
Content-Length: 43
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

204

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=33012141&cs_ucfr=0&ns__t=1700536500674&ns_c=UTF-8&c7=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwe...
https://sb.scorecardresearch.com/b2?c1=2&c2=33012141&cs_ucfr=0&ns__t=1700536500674&ns_c=UTF-8&c7=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fw...

0
225 B

41ms
41ms

Image
text/plain

18.245.60.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=33012141&cs_ucfr=0&ns__t=1700536500674&ns_c=UTF-8&c7=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&c8=Libero%20Mail%20-%20login
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: H2
Server: 18.245.60.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-60-76.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:00 GMT
via: 1.1 76f18545659f3cecc2213d8e93d15fb2.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P5
x-amz-cf-id: L_5SNhqDp0BKz2p9fe5aw82HVZVZXodE4pG8JigdOJTw8D1EwgPNwQ==
x-cache: Miss from cloudfront

Redirect headers

date: Tue, 21 Nov 2023 03:15:00 GMT
via: 1.1 76f18545659f3cecc2213d8e93d15fb2.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P5
x-cache: Miss from cloudfront
location: /b2?c1=2&c2=33012141&cs_ucfr=0&ns__t=1700536500674&ns_c=UTF-8&c7=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&c8=Libero%20Mail%20-%20login
content-length: 0
x-amz-cf-id: eLBQWF5Xk5Y3lAEzC3rc_Rg32JeEe7X-6slGRDY1Vq_zNeeflfi7uQ==

GET
H2 200 logo.svg
i1.plug.it/mail/login/2020/libero/img/ 5 KB
1 KB 40ms
40ms Image
image/svg+xml 13.32.99.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i1.plug.it/mail/login/2020/libero/img/logo.svg
Requested by: Host: i1.plug.it
URL: https://i1.plug.it/mail/login/2020/libero/css/style.css?01022022
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-92.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://i1.plug.it/mail/login/2020/libero/css/style.css?01022022
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:12:00 GMT
content-encoding: gzip
via: 1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
last-modified: Mon, 28 Jun 2021 12:10:08 GMT
server: nginx
x-amz-cf-pop: FRA60-P3
age: 75783
etag: W/"60d9bc20-12db"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=86400
x-amz-cf-id: JsFfcDB-Kz5KBbmzXw1mG222DCk7XCk2X9cbpiFlQNNgnu-rhXPmcQ==

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 129ms
40ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://ip170.ip-51-89-105.eu
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:25:42 GMT
x-content-type-options: nosniff
age: 280158
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 21:25:42 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 138ms
50ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://ip170.ip-51-89-105.eu
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 23:58:11 GMT
x-content-type-options: nosniff
age: 271009
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 23:58:11 GMT

GET
H/1.1 200
OK _adv.js Show response
i.plug.it/iplug/js/lib/iol/analytics/ads/banners/ Frame 27EA 25 B
586 B 113ms
73ms Script
application/javascript 13.32.99.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://i.plug.it/iplug/js/lib/iol/analytics/ads/banners/_adv.js?_t=1700536500684
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/js/0sBN1QtxZSRY.js
Protocol: HTTP/1.1
Server: 13.32.99.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-92.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 0718476f9aeec1cbd746c569d6768a28c021163de52ceb5c7d89005484f16b8e

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
Content-Encoding: gzip
Via: 1.1 a54cda8ccda3480314f451558e4dd062.cloudfront.net (CloudFront)
Server: nginx
X-Amz-Cf-Pop: FRA60-P3
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, HEAD, OPTIONS
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-Cache: Miss from cloudfront
Cache-Control: public, max-age=1200
Vary: Accept-Encoding
Connection: keep-alive
X-Amz-Cf-Id: M5YaQ7yHJ5txqmCuyoZ18wtJfa8LXjvL6Li6NQZ8ZPWlgr_6xuh1qw==

OPTIONS
H/1.1 400
Bad Request targeting
italiaonline.profiles.tagger.opecloud.com/v1/ Frame 0
0 111ms
43ms Preflight
text/plain 35.157.51.73
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&gdpr_applies=0
Protocol: HTTP/1.1
Server: 35.157.51.73 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-51-73.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: referrer-policy
Access-Control-Request-Method: GET
Origin: http://ip170.ip-51-89-105.eu
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/plain; charset=UTF-8
Date: Tue, 21 Nov 2023 03:15:00 GMT
Transfer-Encoding: chunked

GET
H2

200

gpt.js Show response
securepubads.g.doubleclick.net/tag/js/
Redirect Chain

http://securepubads.g.doubleclick.net/tag/js/gpt.js
https://securepubads.g.doubleclick.net/tag/js/gpt.js

100 KB
31 KB

164ms
72ms

Script
text/javascript

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504

Protocol

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66682da9acf44b3a8ffca22fe2bdf9ce95b9f0fbe2bad3d24d7e81dc4c11032

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31369
x-xss-protection: 0
server: cafe
etag: 935 / 19682 / m202311090101 / config-hash: 16204867678510254442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 03:15:01 GMT

Redirect headers

Date: Tue, 21 Nov 2023 03:15:00 GMT
X-Content-Type-Options: nosniff
Server: cafe
Vary: Accept-Encoding
P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Content-Type: text/html; charset=UTF-8
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Cross-Origin-Resource-Policy: cross-origin
Timing-Allow-Origin: *
Content-Length: 0
X-XSS-Protection: 0
Expires: Tue, 21 Nov 2023 03:15:00 GMT

GET targeting
italiaonline.profiles.tagger.opecloud.com/v1/ 0
0

GET
H2 200 pub-2033535132705533 Show response
fundingchoicesmessages.google.com/i/ 22 KB
10 KB 162ms
69ms Script
application/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/pub-2033535132705533?ers=1

Requested by

Host: www.iolam.it
URL: https://www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3c4c65c0c6c57bc982205df9f5d5f2959e6049396d5f0cd90f19a2f9ddb74013

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5fMdDgt3SaIgphKRDCOLLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:01 GMT
content-security-policy: script-src 'report-sample' 'nonce-5fMdDgt3SaIgphKRDCOLLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/ 429 KB
135 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: http://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b04dfae5d49297b8b6a514bd8bf1c7bea7ebe622232401a5abed5a92809a2b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 11:19:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57355
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137535
x-xss-protection: 0
server: cafe
etag: 18342593356503948095
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 19 Nov 2024 11:19:06 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 54 B
73 B 165ms
77ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=ip170.ip-51-89-105.eu

Requested by

Host: securepubads.g.doubleclick.net
URL: http://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d68d55b626acbd0666339d40895960e69a1933e81724434fa49a4baea92f40e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49
x-xss-protection: 0
expires: Tue, 21 Nov 2023 03:15:01 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 39 KB
15 KB 283ms
282ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1657613416320725&correlator=2771310949249019&eid=31079674%2C31079233%2C31079525&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&npa=1&tfcd=0&iu_parts=5180%2Clibero%2Cwebmail%2Clogin%2Cstep1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=1540x1024%7C300x600&ifi=1&sfv=1-0-40&eri=1&sc=0&cookie_enabled=1&abxe=1&dt=1700536503171&lmt=1700536503&adxs=576&adys=50&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&bc=23&nvt=1&url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&vis=1&psz=980x0&msz=1540x0&fws=0&ohw=0&ga_vid=327840175.1700536503&ga_sid=1700536503&ga_hid=697893836&ga_fc=false&dlt=1700536500306&idt=1040&cust_params=oe%3DUTF-8%26optout%3D1%26adv_infocus%3Dyes%26inventory_type%3Dbrowsable%26adv_referrer%3Dother%26adv_sgt%3D4%26is_native%3Dno%26xdid_user_ui%3Dfalse%26adv_sso1%3D0%26adv_sso2%3D0%26adv_sso3%3D0%26us_ua%3Dfalse%26siz_hostname%3Dip170.ip-51-89-105.eu%26siz_devicetype%3Ddesktop%26downlink%3D9.8&adks=1573533839&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f161338e242c81c12c475dbef174ec5893be6579c9b55cad123073a22c925d32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15622
x-xss-protection: 0
google-lineitem-id: 6411640681
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138454077481
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://ip170.ip-51-89-105.eu
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 149ms
57ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202311090101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63521c5d9136172741d7224d5d326fb4a3abdacefe3a5a579ea432ba06c698ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12416
x-xss-protection: 0

GET
H2 200 container.html Show response
2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 469C 6 KB
3 KB 177ms
50ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://ip170.ip-51-89-105.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 03:15:03 GMT
expires: Wed, 20 Nov 2024 03:15:03 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 157ms
62ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 21 Nov 2023 03:15:03 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B58B 0
0 80ms
79ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvcgRa56yBmWsntveMg8Lw9U5K4TYY6jNkztaGnVje4K-XvD5JaxOCBApFQUojUJ6CLz0IQJA8WzYKLX0kE0MaYiuKMp1j4WkrHxdebE3dsFa9ijNUY_s76u0LayHW3oBjJL9V09zM0SyKoLWwJ5h9VW-ECZKHfLqIR1B15IWRIOBJOLMqSNX2LbXWF8W-kaI-4FX3FWCIH1gZywyNKhM9AH4UMLbiczWZsyhjHS5tOwZKn8GHk8WZ93Lgn-kkmqZSDMWwaqtEg95yozZypOCkzm4Nb_rD9cRcL8jRYRKjsEFS4QJF_Hb-ptBxmgw1ZCeMe-bBgM_BDx1M24-e4St8xyDpxaePOUOgFljhpnmKKxQYIZ4RPaQintuiNv58uOSoWagxEcA7qkE4AdlNCjUk&sai=AMfl-YTZoBKrul8tG2wRwCR0oS-AMVdr42DxVM12-Pq-EaAEBsz6zAxrIRVRbYnt_Bw3MoNJjUnT1iCmZaj3bOa4-Tnc_37vZN2n0_ua7uzwDLmbbyFcpo8Gn_2E9pvnsgAQRJ_1BMlS36S27y-UCkjTN3Q&sig=Cg0ArKJSzJZ5qFI7-qUwEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 21 Nov 2023 03:15:03 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame B58B 202 KB
64 KB 149ms
52ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 03:15:03 GMT

GET
H2 200 AdvContent20x20.png
i3.plug.it/banners/img/ 537 B
905 B 65ms
40ms Image
image/png 13.32.99.92
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i3.plug.it/banners/img/AdvContent20x20.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-92.fra60.r.cloudfront.net
Software: nginx /
Resource Hash: 68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 06:00:33 GMT
via: 1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
last-modified: Tue, 09 Jun 2020 08:23:45 GMT
server: nginx
x-amz-cf-pop: FRA60-P3
age: 76470
etag: "5edf4711-219"
x-cache: Hit from cloudfront
content-type: image/png
cache-control: max-age=1200, public
accept-ranges: bytes
content-length: 537
x-amz-cf-id: vAnhF8wp7R-pIaZeoDo9XfpkIX2zMVSW5KZGs1TTlCnfgdbt7kscZw==
expires: Mon, 20 Nov 2023 06:20:33 GMT

GET
H2

200

B31009887.380930859;dc_pre=CKjn5pGQ1IIDFYKZ_QcdmHQINA;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_t...
ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/ Frame B58B
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/B31009887.380930859;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid=;tag_for_child_directed_treatment...
https://ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/B31009887.380930859;dc_pre=CKjn5pGQ1IIDFYKZ_QcdmHQINA;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid...

42 B
246 B

59ms
59ms

Image
image/gif

172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/B31009887.380930859;dc_pre=CKjn5pGQ1IIDFYKZ_QcdmHQINA;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?

Requested by

Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504

Protocol

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 03:15:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 03:15:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N439808.1781359ITALIAONLINE.IT/B31009887.380930859;dc_pre=CKjn5pGQ1IIDFYKZ_QcdmHQINA;dc_trk_aid=571500821;dc_trk_cid=204948630;ord=2097881672;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=;dc_tdv=1?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 14480509914411944628
tpc.googlesyndication.com/simgad/ 278 KB
279 KB 45ms
45ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14480509914411944628?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0ebf84c478bd0ee64147ba07aa4a7ea0f99aa668246052c93335488eda58bfd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:45:04 GMT
x-content-type-options: nosniff
age: 358199
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 284996
x-xss-protection: 0
last-modified: Thu, 09 Nov 2023 12:52:37 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 15 Nov 2024 23:45:04 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 16C4 13 KB
5 KB 181ms
178ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://ip170.ip-51-89-105.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

accept-ranges: bytes
age: 18663
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 22:04:00 GMT
expires: Tue, 19 Nov 2024 22:04:00 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F3F1 829 B
1 KB 142ms
52ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4a4d8863a44dd92e5057fb71a77f66c46ae4159a436767b93af23e921975cc23

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dJEcMJf8fvSGeD8mJAbr3g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ip170.ip-51-89-105.eu/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-dJEcMJf8fvSGeD8mJAbr3g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 03:15:03 GMT
expires: Tue, 21 Nov 2023 03:15:03 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F3F1 0
0 158ms
75ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202311090101&jk=1657613416320725&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 16C4 39 KB
15 KB 84ms
41ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 22:04:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18663
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 19 Nov 2024 22:04:00 GMT

GET
DATA 200
OK truncated
/ Frame B58B 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 39478dbab0a4847a768952d34fd7908a437428859d8ea7ed40156b2c5add6c79

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK jload Show response
pixel.adsafeprotected.com/ Frame F62F 48 KB
13 KB 141ms
46ms Script
application/javascript 34.248.37.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://pixel.adsafeprotected.com/jload?anId=926174&campId=1540x1024&pubId=14788727&chanId=21721897975&placementId=6411640681&pubCreative=138454077481&pubOrder=3269559519&cb=975430749&impId=&ias_adpath=%23adv_click
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Server: 34.248.37.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-37-96.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 704596dba048d70bf8f75b88b6aea86d74bf096a2d81ac5d76590a5941ef7e5e

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:03 GMT
content-encoding: gzip
Transfer-Encoding: chunked
vary: accept-encoding
Content-Type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B58B 0
0 104ms
104ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsudqWEC4yuZzmkyIf5v1Lh88anM6WayE4WC0X9q5KgduzpD0Z5_OX9yEZ4S39O0OpjmOANHD_5GrJ1fNDR-lnQABkvk_9__Q3d6IMyfJThhSq3tZyiL9zVJDVTNOHsud9eV8lkyPfSqepMDmtFyh3xKHJkwhKdj-55wvRMwM5R6YnxSjsUdJP8AGyVRnrDDjau4ss-k-OJlYAWECBKS2LrPI_go9xycF3l8crHfHa4B27btiQzM637-AqLRdslrfZH2aF7wrOem-2nHW8isy2aAju8WImEx4FBYmvuxLL2-tXH18QgZb6M9vcZeRLdDJSA7w_b5y9swmiTs5lkyv-wyy0GyhP9vIV6WLTdZZpDJ2aOScsuXvlZxujVjcWpQTey_n90&sai=AMfl-YR9FNa9-cTbEBra2zpgFoP4DPXEHx4uX7qsSw3RU7xwUB46ThiNK79UKvrUWcPxzvF-dHIY-S6WJNG3TYig7cILHzelV0ADvcj2RHB4vqX1L8NOHATu1EaEBh5uRZ2x6WYtTJl3-dUVAuir4qxvSVI&sig=Cg0ArKJSzGEHLAy3xFoQEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 21 Nov 2023 03:15:03 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 16C4 0
10 B 43ms
42ms Image
text/plain 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?UkCktg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 03:15:03 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK main.19.8.461.js Show response
static.adsafeprotected.com/ Frame F62F 213 KB
66 KB 111ms
39ms Script
application/javascript 2600:9000:223f:7e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://static.adsafeprotected.com/main.19.8.461.js
Requested by: Host: pixel.adsafeprotected.com
URL: http://pixel.adsafeprotected.com/jload?anId=926174&campId=1540x1024&pubId=14788727&chanId=21721897975&placementId=6411640681&pubCreative=138454077481&pubOrder=3269559519&cb=975430749&impId=&ias_adpath=%23adv_click
Protocol: HTTP/1.1
Server: 2600:9000:223f:7e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5d60c053b0001fc62bddd8d273be2d45bd62085f6179c57e1d2ae8fc6be54819

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 20 Nov 2023 18:34:47 GMT
x-amz-version-id: .6VoU8ePthXw6skHxgqC708Qq8L6CC89
Content-Encoding: gzip
Via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P5
Age: 31218
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Last-Modified: Mon, 20 Nov 2023 16:46:58 GMT
Server: AmazonS3
ETag: W/"315b08a0e21410ecc940dd381f9a8dd0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
X-Amz-Cf-Id: 0HnxTqZMZ8PkDjx5d5WObq1fPhO8KgHq6LF50G2Lv0MhSPeKBjbPVQ==

GET
H/1.1 200
OK sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame B18A 91 KB
23 KB 40ms
40ms Script
application/javascript 2600:9000:223f:7e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: ip170.ip-51-89-105.eu
URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504
Protocol: HTTP/1.1
Server: 2600:9000:223f:7e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Thu, 21 Sep 2023 00:09:11 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
Content-Encoding: gzip
Via: 1.1 0162e02b2d0212054988a68716227daa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P5
Age: 5281554
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Last-Modified: Tue, 20 Sep 2022 19:21:34 GMT
Server: AmazonS3
ETag: W/"1f3488247c90bb5de253d3d0cb3b7458"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=315360000
X-Amz-Cf-Id: TvxslJBN2oWuL46nL8JSL-3IdVXDYWXd9pm9dEgrDu3ZCBHquzJWFQ==

GET
H/1.1 200
OK mon
pixel.adsafeprotected.com/ 43 B
305 B 61ms
61ms Image
image/gif 34.248.37.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://pixel.adsafeprotected.com/mon?anId=926174&campId=1540x1024&pubId=14788727&chanId=21721897975&placementId=6411640681&pubCreative=138454077481&pubOrder=3269559519&cb=975430749&impId=&ias_adpath=%23adv_click&adsafe_url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&adsafe_type=abcedq&adsafe_url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F&adsafe_type=f&adsafe_jsinfo=,id:4f392d4d-288e-07ed-75a6-7b98a29886eb,c:uzhoWf,sl:inView,em:true,fr:true,thd:1,mn:jsserver-primary-5545cd9c68-7fwsb,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,mu:10000,br:c,bru:c,an:n,oam:0,scm:publ1.grpm1.uJaQN1,mtim:187,mot:0,app:0,maw:0,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:212,oid:29eb91d3-881c-11ee-8478-cae5f42cb985,v:19.8.461,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: HTTP/1.1
Server: 34.248.37.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-37-96.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:04 GMT
Server: nginx
X-Server-Name: app07.ie.303net.net
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
304 B 228ms
104ms Image
image/gif 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhoWh,pingTime:-8,time:213,type:l,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:213,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:211,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B22~100%5D,as:%5B22~1600.1200%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:212%7D&br=c
Protocol: HTTP/1.1
Server: 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:04 GMT
Server: nginx
X-Server-Name: dt28.va.303net.net
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
304 B 226ms
104ms Image
image/gif 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhoWx,pingTime:0,time:229,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:1200,t:211%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:229,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:211,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B38~100%5D,as:%5B38~1600.1200%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:212%7D&br=c
Protocol: HTTP/1.1
Server: 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:04 GMT
Server: nginx
X-Server-Name: dt24.va.303net.net
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
304 B 224ms
105ms Image
image/gif 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhoWA,pingTime:-2,time:232,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:193,beZ:199,mfA:381,cmA:382,inA:382,inZ:386,prA:386,prZ:398,si:405,poA:406,poZ:419,cmZ:419,mfZ:419,loA:422,loZ:425,ltA:425,ltZ:425,mdA:201,mdZ:368%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:1200,t:211%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:232,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:211,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~100%5D,as:%5B42~1600.1200%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:212,slid:%5Bgoogle_ads_iframe_/5180/libero/webmail/login/step1_0,google_ads_iframe_/5180/libero/webmail/login/step1_0__container__,adsplash,wrapper-iol%5D,sinceFw:19,readyFired:true%7D&br=c
Protocol: HTTP/1.1
Server: 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:04 GMT
Server: nginx
X-Server-Name: dt10.va.303net.net
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 78ms
78ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202311090101&jk=1657613416320725&bg=!T0ylTAPNAAZxrfrxUa07ADQBe5WfOCJ1nxVjfiWf-pxHEcVNFea4yi4z1b1YMOHXvEdr1TgCGshPn7bKVTRYIAqeK2AyAgAAAEhSAAAAA2gBB5kCtutGSHXU6IhIpQ4wp3gr98Abldbi5wzpj-qdTWwaBVZW8MNYwEjPPRDW77zyjZembDnymUp7f-65XqNUkJi_sYSucd-qWxInMNugtwb06oiNCioMb6ro-dTXoxBaUjjF35D2FeOpAqAOkN7vS5OnzIjEIMfsxZTs1O715gndCWNIMQfDzfHXO5OIBuLLZyLYK3ClJ9ZUgPSuMJWmeNtHZ0GTgYX3GoBCuZjKRnta0JT0n9_kJz9zXwcg8XKLRAnwMxHwK48-eWEIs5yfEB1Tojn3XFG6Cn3vZw9BNvGv_LHwtNXxP9MCkUfpZzmLN4kStXJDh12xE1A_SLbNrtJBh8bxEmDTcrOtkyOliU6l54nYM07Mdpe18ABOQ-XKfEzD2Fe2hjs8WWXnX8RspXb738lIm5NU9xeGlQR_HWNt9dpnHdY0eXxvhsNjPhr1oUHSuzZKluuOuI_QKpWoHlIJlacld9zSPazk2hskDOQYOepB-M-N3gLMPcayB5kH2VW76UcylXGf2bT6gGB3BtDewB5CBSnjyGI6MJcP63eXM0EAiOBTQDU8CNDgTadRoHosgkP5_DC-WXTEMrrLEfAUZnaWanfD-A6CD_ik25uK0TwYaJJP4AtCnfao9iTfBhaAStDpjT8Hfc6wiJKfqIkJkcVlEW0StlyR82KkyDtjf6Y4oadvP84DnKdejt1rZ8l-Grli9FPnJyUZxo31HQ7oW4Ovf5CJQLOeVxjCH_ElB31Mk5dchfJ8xAegscR_oOlxDX2seRvzQcAJjXgJVqMm8rEVIlVDRpvtWYy65a_ybYiFXd0iO4lFq9_uRL-PeLVGA68kKSLpYSXOKEDO7VCh66-t1AlmRu8_584o8m_YaoEvoAksJCm4xBXGT_529Vagh2uxfIQSTEwF_AY2GLfzVx5NGwLSyDA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H/1.1 200
OK dt
dt.adsafeprotected.com/ 43 B
304 B 105ms
104ms Image
image/gif 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhp27,pingTime:-10,time:575,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE5LjAuNjA0NS4xNTkgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.6.2v222222220002022202222222000020222222202022222220222202000022000220222220000000202202002222202222222220222222220000020022022200022222220200000222200022020002022022022222202002220222022222022220000000200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022020000000020000000000000000000020220202220000022200202202220022000200222022200200022220222200202222020002200002222022222202222000002002002222222202220022202200022002220202202,asp:1700536504526%7C%7C18ce6e2cf3e5fd8c0f9901c2c73c048f%7C%7C1b7de7e82db1163ab7a1342e5def95a8%7C%7C6deab0d2d8e153e18b8f860f1daf8239%7C%7C00143e4bf504eabadb0e9d91b3188166%7C%7C12c289708f0c02e42b5cdfabce5ca2b3%7C%7Cb7d1eea3424925c1d8901a805a1f6cff%7C%7C6edfb97df2c7521415f3e43df05823b7%7C%7C1663701684%7D
Protocol: HTTP/1.1
Server: 2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-GB,en;q=0.9
Referer: http://ip170.ip-51-89-105.eu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 03:15:04 GMT
Server: nginx
X-Server-Name: dt24.va.303net.net
P3P: CP="COM NAV INT STA NID OUR IND NOI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43

GET dt
dt.adsafeprotected.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: italiaonline.profiles.tagger.opecloud.com
URL: http://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&gdpr_applies=0

Domain: dt.adsafeprotected.com
URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhpcG,pingTime:1,time:1230,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:1200,t:211%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1230,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:211,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1039~100%5D,as:%5B1039~1600.1200%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:108,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:212,sis:289%7D&br=c

Domain: dt.adsafeprotected.com
URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhpcG,pingTime:1,time:1230,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:1200,t:211%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1230,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:211,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1039~100%5D,as:%5B1039~1600.1200%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:108,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:212,sis:289,metricId:publ1,cmr:t%7D&br=c

Domain: dt.adsafeprotected.com
URL: http://dt.adsafeprotected.com/dt?anId=926174&asId=4f392d4d-288e-07ed-75a6-7b98a29886eb&tv=%7Bc:uzhpcG,pingTime:1,time:1230,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:1600,h:1200,t:211%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1230,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:211,wc:0.0.1600.1200,ac:0.0.1600.1200,am:sp,cc:0.0.1600.1200,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1039~100%5D,as:%5B1039~1600.1200%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:108,fm:tWd7RSg+11%7C12%7C13%7C14%7C15%7C16%7C17*.926174%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:212,sis:289,metricId:grpm1,cmr:t%7D&br=c

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Libero (Online)

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
italiaonline01.wt-eu02.net/215973748390194	1970-01-20 20:41:28	Name: wteid_215973748390194 Value: 4170053650000611225
italiaonline01.wt-eu02.net/215973748390194	1969-12-31 23:59:59	Name: wtsid_215973748390194 Value: 1
.scorecardresearch.com/	1970-01-21 01:58:16	Name: UID Value: 181e5ba0f5185239ae7c3fc1700536500
italiaonline01.wt-eu02.net/	1969-12-31 23:59:59	Name: wt_nbg_Q3 Value: !Vb6N0R+4KGM6sg48AP7SORvNY+Kz1FhcNlDf+ijimB6Syu4HP35+fbm6iephvXOafDM+wc8b3II6Qw==
.ip-51-89-105.eu/	1970-01-21 01:43:52	Name: __gads Value: ID=7d7e8ee1d5b3603d:T=1700536503:RT=1700536503:S=ALNI_MZjQSx-r0I6qxchVcq3FOQ7XwKEBQ
.ip-51-89-105.eu/	1970-01-21 01:43:52	Name: __gpi Value: UID=00000cd667c2d50b:T=1700536503:RT=1700536503:S=ALNI_MaVOtvHDwNHubc-lYCUa08sO4JMtw
.doubleclick.net/	1970-01-21 01:43:52	Name: IDE Value: AHWqTUmGjH4gHIMQ7a7Ywae_Elpp1XZbVvmdYSVLeXGDO_mQRa-WAWxqUq72uCBQyY4
.doubleclick.net/	1970-01-20 20:41:28	Name: APC Value: AfxxVi5pmLUVtsoe_RPRRTpNHGo0yspVJZscNba9-QEBdlNAtdKrPg

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://www.iolam.it/js/iam2.0.js?ns=libero/web/webmail/login/1.1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	error	URL: http://ip170.ip-51-89-105.eu/?client_id=?service_id=email&ret_url=http://webmail.libero.lt/cp/default.jsp0.1015249434501504 Message: Access to XMLHttpRequest at 'http://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&gdpr_applies=0' from origin 'http://ip170.ip-51-89-105.eu' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: http://italiaonline.profiles.tagger.opecloud.com/v1/targeting?url=http%3A%2F%2Fip170.ip-51-89-105.eu%2F%3Fclient_id%3D%3Fservice_id%3Demail%26ret_url%3Dhttp%3A%2F%2Fwebmail.libero.lt%2Fcp%2Fdefault.jsp0.1015249434501504&gdpr_applies=0 Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2dce26a2133f43c981e6519eb0ccf923.safeframe.googlesyndication.com
ad.doubleclick.net
c.amazon-adsystem.com
dt.adsafeprotected.com
fonts.googleapis.com
fonts.gstatic.com
fundingchoicesmessages.google.com
i.plug.it
i1.plug.it
i3.plug.it
ip170.ip-51-89-105.eu
italiaonline.profiles.tagger.opecloud.com
italiaonline01.wt-eu02.net
pagead2.googlesyndication.com
pixel.adsafeprotected.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
static.adsafeprotected.com
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
www.iolam.it
dt.adsafeprotected.com
italiaonline.profiles.tagger.opecloud.com
108.138.1.25
13.32.99.92
172.217.16.134
18.245.60.76
185.54.150.20
213.209.30.161
2600:1f18:1aca:4280:6f6b:e6d5:1d43:368b
2600:9000:223f:7e00:8:48e:53c0:93a1
2a00:1450:4001:801::200e
2a00:1450:4001:808::2002
2a00:1450:4001:810::2001
2a00:1450:4001:827::2003
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::200a
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
34.248.37.96
35.157.51.73
51.89.105.170
01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd
0718476f9aeec1cbd746c569d6768a28c021163de52ceb5c7d89005484f16b8e
17e49df09dd14c40d50c5e4693c448e99cfee8ee79aa5a9c5bd2be5be3105562
18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf
2170f04df3b7e03e3439440b22f30247a1ee0606d4a0253e159c8a725372ac8f
21d7579b5b7d351e245b32baa71866d1a494f0da53c81c45e6e2c70fd4a7c357
39478dbab0a4847a768952d34fd7908a437428859d8ea7ed40156b2c5add6c79
3c4c65c0c6c57bc982205df9f5d5f2959e6049396d5f0cd90f19a2f9ddb74013
3d68d55b626acbd0666339d40895960e69a1933e81724434fa49a4baea92f40e
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4a4d8863a44dd92e5057fb71a77f66c46ae4159a436767b93af23e921975cc23
4c8fe936e012d2d229577704c34c41a451d7a98aa5c2566ea5c3930aa7e3f40f
54ea3b729d9ff4a499d3bf59b0497606ceb27b7100c60d74d28467224f3983f9
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5d60c053b0001fc62bddd8d273be2d45bd62085f6179c57e1d2ae8fc6be54819
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63521c5d9136172741d7224d5d326fb4a3abdacefe3a5a579ea432ba06c698ba
68cfa5d1e626ad1796c8c8db8276c8196f7235100b9ae6f7380a4f8920bd994c
704596dba048d70bf8f75b88b6aea86d74bf096a2d81ac5d76590a5941ef7e5e
8239d985179b5598a3b76db41bbd8842530e4e37e82665dc6449ed97b20c6227
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b04dfae5d49297b8b6a514bd8bf1c7bea7ebe622232401a5abed5a92809a2b66
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ba622f81f692dd7f4b54e5379346086874eff141a501881982c5a5b3b2370df8
bab579eb63de66ef6e1da663a09365752e647b34edbaf15a65ef8477817b55a2
bf04cc3daa882029d0bec76c3444dda192ce1779eb69642ca66440c72c5cc31f
c0ebf84c478bd0ee64147ba07aa4a7ea0f99aa668246052c93335488eda58bfd
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e66682da9acf44b3a8ffca22fe2bdf9ce95b9f0fbe2bad3d24d7e81dc4c11032
eb97f750d5607e2544524de92d09cf088fee2d4484d14eeb16184448100df690
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f161338e242c81c12c475dbef174ec5893be6579c9b55cad123073a22c925d32
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

ip170.ip-51-89-105.eu Open in urlscan Pro 51.89.105.170 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

50 Requests

50 %HTTPS

55 %IPv6

14 Domains

22 Subdomains

21 IPs

5 Countries

1057 kBTransfer

2539 kBSize

8 Cookies

10 Outgoing links

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ip170.ip-51-89-105.eu Open in urlscan Pro
51.89.105.170 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

50 %
HTTPS

55 %
IPv6

14
Domains

22
Subdomains

21
IPs

5
Countries

1057 kB
Transfer

2539 kB
Size

8
Cookies

50 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!