urlscan.io logo urlscan.io
SecurityTrails logo

docs.google.com Open in urlscan Pro
2a00:1450:4001:801::200e  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
Effective URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Submission: On December 15 via manual from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 14 IPs in 2 countries across 10 domains to perform 29 HTTP transactions. The main IP is 2a00:1450:4001:801::200e, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is docs.google.com.
TLS certificate: Issued by GTS CA 1O1 on November 10th 2020. Valid for: 3 months.
This is the only time docs.google.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    99.86.242.128 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-242-128.vie50.r.cloudfront.net
rd.cluez.biz
2    99.84.89.116 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-89-116.muc50.r.cloudfront.net
static.cluez.biz
1    65.9.73.6 (Seattle, United States)

ASN16509 (AMAZON-02, US)
cdn.treasuredata.com
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    99.84.89.23 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-89-23.muc50.r.cloudfront.net
static.aperza.jp
1    54.196.204.244 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-196-204-244.compute-1.amazonaws.com
in.treasuredata.com
2    151.101.1.195 (United States)

ASN54113 (FASTLY, US)
forms.gle
8    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
1    2a00:1450:4001:802::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
firebasehostingproxy.page.link
2    2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
docs.google.com
3    2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
lh5.googleusercontent.com
1    2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.gstatic.com
3    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Domain Requested by
8 www.gstatic.com forms.gle
www.gstatic.com
docs.google.com
4 fonts.gstatic.com fonts.googleapis.com
3 fonts.googleapis.com docs.google.com
2 docs.google.com www.gstatic.com
2 forms.gle forms.gle
2 static.aperza.jp www.googletagmanager.com
static.aperza.jp
2 static.cluez.biz rd.cluez.biz
1 ssl.gstatic.com www.gstatic.com
1 lh5.googleusercontent.com docs.google.com
1 firebasehostingproxy.page.link 1 redirects
1 in.treasuredata.com cdn.treasuredata.com
1 www.googletagmanager.com rd.cluez.biz
1 cdn.treasuredata.com rd.cluez.biz
1 rd.cluez.biz
29 14

This site contains links to these domains. Also see Links.

Domain
www.google.com
Subject Issuer Validity Valid
cluez.biz
Amazon		 2020-07-17 -
2021-08-17		 a year crt.sh
*.treasuredata.com
Amazon		 2020-10-16 -
2021-11-15		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
aperza.jp
Amazon		 2020-03-03 -
2021-04-03		 a year crt.sh
forms.gle
Let's Encrypt Authority X3		 2020-11-16 -
2021-02-14		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
*.google.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh
*.googleusercontent.com
GTS CA 1O1		 2020-11-10 -
2021-02-02		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Frame ID: 4D4B46CD0AC3028B618359443D61410A
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036 Page URL
  2. https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_20... Page URL
  3. https://firebasehostingproxy.page.link/198886819888/forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_so... HTTP 302
    https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • headers via /\(CloudFront\)$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

29
Requests

100 %
HTTPS

60 %
IPv6

10
Domains

14
Subdomains

14
IPs

2
Countries

1042 kB
Transfer

2383 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036 Page URL
  2. https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm Page URL
  3. https://firebasehostingproxy.page.link/198886819888/forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm&_imcp=1 HTTP 302
    https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
rd.cluez.biz/tmc/ 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.242.128 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-242-128.vie50.r.cloudfront.net
Software
nginx /
Resource Hash
e7c2ab8b30402d203fbda40f263460a6290f06d4d78609e68d8e55bc9cb57fb8

Request headers

:method
GET
:authority
rd.cluez.biz
:scheme
https
:path
/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
content-length
1442
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding
gzip
date
Tue, 15 Dec 2020 06:44:37 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
nginx
set-cookie
cluez_biz=8701r5hsp583c4rl3kcv81nsi5; path=/; domain=.cluez.biz; secure; HttpOnly cluez_biz=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.cluez.biz cluez_biz=c22a9e1e7bb1774ea47bf8677875742d83309a13139272a6b748e37ae77723d68d2794fb; path=/; domain=.cluez.biz; secure; httponly _ubid=3521947b-bf4f-4a7b-98ed-bf9fe5161f94; expires=Fri, 13-Dec-2030 06:44:36 GMT; Max-Age=315360000; path=/; domain=.cluez.biz; secure atkn=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=cluez.biz __ubid=6d9df95a-ec6e-495e-b5f3-87661f19c89c; expires=Fri, 13-Dec-2030 06:44:37 GMT; Max-Age=315360000; path=/; domain=.cluez.biz
x-cache
Miss from cloudfront
via
1.1 2a3d03f915cb6d29f35b8f9edd3b1956.cloudfront.net (CloudFront)
x-amz-cf-pop
VIE50-C1
x-amz-cf-id
CYyuL3WCyenA9lCPiY_FL0Zvrxna59OrbFxiy2gNvcohW0ybXXhaOg==
jquery.min.js
static.cluez.biz/common/js/ 		94 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cluez.biz/common/js/jquery.min.js?1604465046
Requested by
Host: rd.cluez.biz
URL: https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.89.116 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-89-116.muc50.r.cloudfront.net
Software
nginx /
Resource Hash
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 22:47:44 GMT
content-encoding
gzip
age
201413
x-cache
Hit from cloudfront
content-length
38821
access-control-allow-origin
*
last-modified
Wed, 04 Nov 2020 04:44:06 GMT
server
nginx
etag
W/"5fa23196-1762a"
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/javascript
via
1.1 14930ca61b5acb472c19a8d7b170ad11.cloudfront.net (CloudFront)
cache-control
max-age=864000, no-cache="set-cookie"
access-control-allow-credentials
true
x-amz-cf-pop
MUC50-C1
access-control-allow-headers
Origin, Authorization, Accept
x-amz-cf-id
k4MxVhq6g4yHUq2V_ZEserbWtS3jAPtJ5RrlQ_SEjHoiD7Qws5CZJg==
expires
Tue, 22 Dec 2020 22:47:44 GMT
treasuredata.js
static.cluez.biz/common/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cluez.biz/common/js/treasuredata.js
Requested by
Host: rd.cluez.biz
URL: https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.89.116 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-89-116.muc50.r.cloudfront.net
Software
nginx /
Resource Hash
287b475db97319bbed1b9e454999aae03a375a9d951a93b3f90cfb33adc5f78f

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Dec 2020 01:19:49 GMT
content-encoding
gzip
age
19488
x-cache
Hit from cloudfront
content-length
1009
access-control-allow-origin
*
last-modified
Wed, 04 Nov 2020 04:44:06 GMT
server
nginx
etag
W/"5fa23196-d02"
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/javascript
via
1.1 14930ca61b5acb472c19a8d7b170ad11.cloudfront.net (CloudFront)
cache-control
max-age=864000, no-cache="set-cookie"
access-control-allow-credentials
true
x-amz-cf-pop
MUC50-C1
access-control-allow-headers
Origin, Authorization, Accept
x-amz-cf-id
uO4u9jFaKwxId9HCyMFJsRgILO8CnwyBXx44M-UZES6-LO7b5SnbOg==
expires
Fri, 25 Dec 2020 01:19:49 GMT
td.min.js
cdn.treasuredata.com/sdk/1.7.1/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.treasuredata.com/sdk/1.7.1/td.min.js
Requested by
Host: rd.cluez.biz
URL: https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.9.73.6 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
78b03e47087081f6ccd71fab017481364db4fd73ac848ca50499232adfda4103

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 17 Nov 2020 04:50:00 GMT
Content-Encoding
gzip
Connection
keep-alive
Last-Modified
Tue, 01 Nov 2016 20:28:47 GMT
Server
AmazonS3
Age
2426077
ETag
W/"508c35ae4b5f183394f9cf4750dd8068"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 f5046bb9ebd1a8f25b2025d7d9a283f3.cloudfront.net (CloudFront)
Cache-Control
public, max-age=315360000
Transfer-Encoding
chunked
X-Amz-Cf-Pop
AMS1-C1
X-Amz-Cf-Id
V_vjc73vI5bxaWS_iAnpI8MFllv_lq81ig0jHV4LTZaHamPopxQxFw==
gtm.js
www.googletagmanager.com/ 		141 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T3FXPP
Requested by
Host: rd.cluez.biz
URL: https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
64e9564168ac980c42dd722ec2efc5bee1829a8b169a9fcb1392694a597ae1ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Dec 2020 06:44:37 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43407
x-xss-protection
0
last-modified
Tue, 15 Dec 2020 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 15 Dec 2020 06:44:37 GMT
treasure-2.0.js
static.aperza.jp/treasure/ 		32 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.aperza.jp/treasure/treasure-2.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T3FXPP
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
99.84.89.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-89-23.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
76cdb5228dc73d3c342fc95758650fbfd41397c0d5d8e25c29863ef031542bd5

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Dec 2020 17:21:25 GMT
Content-Encoding
gzip
Last-Modified
Mon, 17 Dec 2018 10:01:03 GMT
Server
AmazonS3
Age
48192
ETag
W/"b860552d9334b6342c9170489b41f8d0"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/javascript
Via
1.1 a7322dae74179db004d6fbdc1e7dc03e.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
MUC50-C1
X-Amz-Cf-Id
kaIHAQqIO_5RQEcAU9W6qri8JhcLbwkNPjRB-DJQXELoLCUOms6AGg==
cluez_data
in.treasuredata.com/js/v3/event/biz/ 		89 B
272 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.treasuredata.com/js/v3/event/biz/cluez_data?api_key=6090%2F46967b7d631fed017bff903190f8a5db1f3971b5&modified=1608014677741&data=eyJwYWdldmlldyI6MSwic2l0ZV9jb2RlIjoicmQiLCJsYW5nX2NvZGUiOiJqYSIsInViaWQiOiIzNTIxOTQ3Yi1iZjRmLTRhN2ItOThlZC1iZjlmZTUxNjFmOTQiLCJpZF9zZXNzaW9uIjoiODcwMXI1aHNwNTgzYzRybDNrY3Y4MW5zaTUiLCJpZF9tZW1iZXIiOiIyNjMzMDgiLCJpZF9tZW1iZXJfY291bnRyeV9jb2RlIjoiIiwiaWRfbWVtYmVyX2J1c2luZXNzX2Zvcm1fY29kZSI6IiIsImlkX21lbWJlcl9hcmVhX2lkIjoiIiwiaWRfbWVtYmVyX3Bvc3RfY29kZSI6IiIsImlkX21lbWJlcl9idXNpbmVzc19pZCI6IiIsImlkX21lbWJlcl9qb2JfY2F0ZWdvcnlfaWQiOiIiLCJpZF9tZW1iZXJfbWVtYmVyX3Byb2R1Y3RfY2xhc3NfdG9wIjoiIiwiaWRfbWVtYmVyX3N0YXR1c19jb2RlIjoiMiIsInJkX2RlbGl2ZXJ5X2lkIjoiMjAzNiIsInJkX3RvX2lkIjoiMjMxNzAzNTU5IiwicmRfdXJsX2lkIjoiMTA2MzY1NCIsInJkX21haWxfYWRkcmVzcyI6IjM4NTA4OUBwbmV0LmVuZXJnaWEuY28uanAiLCJyZF9zZXNfbWVzc2FnZV9pZCI6IjAxMDAwMTc2NjRjNWMwM2UtN2Q5ODU2Y2YtMTRhNi00M2YxLWE1MTktMWNiMWY2MmFhOTI3LTAwMDAwMCIsInJkX2FjdGlvbl90eXBlX2NsaWNrX3RleHQiOiIxIiwidGRfdmVyc2lvbiI6IjEuNy4xIiwidGRfY2xpZW50X2lkIjoiYWRiNTBjNzEtMDJlMS00MDA5LTg2NzItM2FlNzJhODE3NmVmIiwidGRfY2hhcnNldCI6InV0Zi04IiwidGRfbGFuZ3VhZ2UiOiJlbi11cyIsInRkX2NvbG9yIjoiMjQtYml0IiwidGRfc2NyZWVuIjoiMTYwMHgxMjAwIiwidGRfdmlld3BvcnQiOiIxNjAweDEyMDAiLCJ0ZF90aXRsZSI6IiIsInRkX3VybCI6Imh0dHBzOi8vcmQuY2x1ZXouYml6L3RtYy9FeFNPZi1maW5zYURlT0loX21qXzUwQzYxTURBYXYtZy0yMzE3MDM1NTktMjAzNiIsInRkX3VzZXJfYWdlbnQiOiJNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNF81KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODMuMC40MTAzLjYxIFNhZmFyaS81MzcuMzYiLCJ0ZF9wbGF0Zm9ybSI6IkxpbnV4IHg4Nl82NCIsInRkX2hvc3QiOiJyZC5jbHVlei5iaXoiLCJ0ZF9wYXRoIjoiL3RtYy9FeFNPZi1maW5zYURlT0loX21qXzUwQzYxTURBYXYtZy0yMzE3MDM1NTktMjAzNiIsInRkX3JlZmVycmVyIjoiIiwidGRfaXAiOiJ0ZF9pcCIsInRkX2Jyb3dzZXIiOiJ0ZF9icm93c2VyIiwidGRfYnJvd3Nlcl92ZXJzaW9uIjoidGRfYnJvd3Nlcl92ZXJzaW9uIiwidGRfb3MiOiJ0ZF9vcyIsInRkX29zX3ZlcnNpb24iOiJ0ZF9vc192ZXJzaW9uIn0%3D&callback=TreasureJSONPCallback0
Requested by
Host: cdn.treasuredata.com
URL: https://cdn.treasuredata.com/sdk/1.7.1/td.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.196.204.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-196-204-244.compute-1.amazonaws.com
Software
/
Resource Hash
3aa9f235c06f8205b4b91091c02bbb8c8a23b12fafa257f68aecc4be22e8b7c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 15 Dec 2020 06:44:38 GMT
Connection
keep-alive
Content-Length
89
Strict-Transport-Security
max-age=31536000
Content-Type
application/javascript
jquery.inview.min.js
static.aperza.jp/treasure/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.aperza.jp/treasure/jquery.inview.min.js
Requested by
Host: static.aperza.jp
URL: https://static.aperza.jp/treasure/treasure-2.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
99.84.89.23 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-89-23.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5a3535bf9c68a69732cec8f625abb8a79db09a0466d0793f491a9193710aff92

Request headers

Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 14 Dec 2020 19:59:07 GMT
Content-Encoding
gzip
Last-Modified
Tue, 24 May 2016 12:24:32 GMT
Server
AmazonS3
Age
38731
ETag
W/"dedd7031b98a1b0cacec057657f4ef52"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 a7322dae74179db004d6fbdc1e7dc03e.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
MUC50-C1
X-Amz-Cf-Id
NyZeFidA-pk-CD68Va9uj0vh8IwUe5_ddxFSTRCAsr51my-51gXpVQ==
vZD5jGfNi3mgnw3C8
forms.gle/ 		34 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
ESF /
Resource Hash
55b340242276205e1f73c749ae503eb68cb55be3add402108f213fd9dcca822c
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-oEmNQ6774cTjv9rbxCa17w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'nonce-oEmNQ6774cTjv9rbxCa17w' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

:method
GET
:authority
forms.gle
:scheme
https
:path
/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://rd.cluez.biz/tmc/ExSOf-finsaDeOIh_mj_50C61MDAav-g-231703559-2036

Response headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-oEmNQ6774cTjv9rbxCa17w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'nonce-oEmNQ6774cTjv9rbxCa17w' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport
content-type
text/html; charset=utf-8
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
ESF
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-ua-compatible
IE=edge
x-xss-protection
0
accept-ranges
bytes
date
Tue, 15 Dec 2020 06:44:38 GMT
x-served-by
cache-hhn4073-HHN
x-cache
MISS
x-cache-hits
0
x-timer
S1608014678.401798,VS0,VE310
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site, x-fh-requested-host, accept-encoding
m=_b,_tp
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/ 		146 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/m=_b,_tp
Requested by
Host: forms.gle
URL: https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
071a0c56d11ec9c86ee055e5aa4f44c2bb55d425c4d6a6da9f3f1c48c678ee54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://forms.gle/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 18:45:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
215930
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52690
x-xss-protection
0
last-modified
Tue, 08 Dec 2020 02:31:29 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
expires
Sun, 12 Dec 2021 18:45:48 GMT
cspreport
forms.gle/_/DurableDeepLinkUi/ 		2 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://forms.gle/_/DurableDeepLinkUi/cspreport
Requested by
Host: forms.gle
URL: https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.195 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-5lMw9iG4ct7yAhVnnFQQzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'nonce-5lMw9iG4ct7yAhVnnFQQzA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/csp-report

Response headers

content-security-policy
script-src 'report-sample' 'nonce-5lMw9iG4ct7yAhVnnFQQzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self',script-src 'nonce-5lMw9iG4ct7yAhVnnFQQzA' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport
content-encoding
gzip
x-content-type-options
nosniff
x-cache
MISS
x-cache-hits
0
x-xss-protection
0
x-served-by
cache-hhn4073-HHN
pragma
no-cache
allow
HEAD, GET
server
ESF
x-timer
S1608014679.789251,VS0,VE278
date
Tue, 15 Dec 2020 06:44:39 GMT
vary
x-fh-requested-host, accept-encoding
content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
accept-ranges
bytes
expires
Mon, 01 Jan 1990 00:00:00 GMT
m=byfTOb,lsjVmc,LEikZe
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/ck=boq-devplatform.DurableDeepLinkUi.c2RriRA2czk.L.B1.O/am=BA/d=1/exm=_b,_tp/excm=_b,_tp,viewd... 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/ck=boq-devplatform.DurableDeepLinkUi.c2RriRA2czk.L.B1.O/am=BA/d=1/exm=_b,_tp/excm=_b,_tp,viewddl/ed=1/wt=2/ct=zgms/rs=ADpVLP6aqAsAn4iz3g7ZNek6f1olGUt4qA/m=byfTOb,lsjVmc,LEikZe
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/m=_b,_tp
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
993982cace7f555cad0619d8bd0e9fd59d950e0b23f9c3d14baad8c5aa5cd5c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://forms.gle/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 11 Dec 2020 23:15:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
286131
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12965
x-xss-protection
0
last-modified
Fri, 04 Dec 2020 06:29:41 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
expires
Sat, 11 Dec 2021 23:15:47 GMT
m=KjEEgd
www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/ck=boq-devplatform.DurableDeepLinkUi.c2RriRA2czk.L.B1.O/am=BA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsj... 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/ck=boq-devplatform.DurableDeepLinkUi.c2RriRA2czk.L.B1.O/am=BA/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,viewddl/ed=1/wt=2/ct=zgms/rs=ADpVLP6aqAsAn4iz3g7ZNek6f1olGUt4qA/m=KjEEgd
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/m=_b,_tp
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
611db601125e0054880aa6b7d2fd74070b49f31dfdf67f30ebcde7d027376e73
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://forms.gle/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Dec 2020 01:32:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
18725
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5813
x-xss-protection
0
last-modified
Fri, 04 Dec 2020 06:29:41 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
expires
Wed, 15 Dec 2021 01:32:33 GMT
Primary Request viewform
docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/
Redirect Chain
  • https://firebasehostingproxy.page.link/198886819888/forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm&_imcp=1
  • https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
115 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/m=_b,_tp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
d245aa56679674c5b96e92c5c81896f410ecfd1bff910fa5486eface89f82dfa
Security Headers
Name Value
Content-Security-Policy base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-apxQB268Oibw+U7uLPkEIg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
docs.google.com
:scheme
https
:path
/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://forms.gle/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://forms.gle/vZD5jGfNi3mgnw3C8?utm_campaign=survey_20201215&utm_source=survey_20201215_2036&utm_medium=edm

Response headers

content-type
text/html; charset=utf-8
x-robots-tag
noindex, nofollow, nosnippet
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Tue, 15 Dec 2020 06:44:39 GMT
content-encoding
gzip
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-security-policy
base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-apxQB268Oibw+U7uLPkEIg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
x-xss-protection
1; mode=block
server
GSE
set-cookie
NID=204=FQs6-Xb8eNwcbHyMrrTWXvgaHmcwRmK6l50UKM3k6l2X5_d5afW0KFwd2E908ZAUHuypWJ_K731EFo6v2pZB5svWy44z1JOBoJgzQV1zKphR15HpP91icIoBV3NP2bG6RjXXvOEEkXTUC76ixHyX6hwdKOGfnF8oToLnbdokSZ8; expires=Wed, 16-Jun-2021 06:44:39 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none S=spreadsheet_forms=hme4RNAil8udoM4cEe3IET7u3c1UOAyI3hF8o-7A-IU; Domain=.docs.google.com; Expires=Tue, 15-Dec-2020 07:44:39 GMT; Path=/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg; Secure; HttpOnly; Priority=LOW; SameSite=none
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

content-type
application/binary
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Tue, 15 Dec 2020 06:44:38 GMT
location
https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
content-security-policy
script-src 'report-sample' 'nonce-bh5UlDpbpRBuOd2KSkN8RQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DurableDeepLinkUi/cspreport;worker-src 'self' script-src 'nonce-bh5UlDpbpRBuOd2KSkN8RQ' 'self' 'unsafe-eval' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/DurableDeepLinkUi/cspreport
server
ESF
content-length
0
x-xss-protection
0
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
icon
fonts.googleapis.com/ 		621 B
491 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/icon?family=Material+Icons+Extended
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b002b2a62ff73eb5ca3997681ba5d09655f265604957b61804168b63709e0a60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 15 Dec 2020 06:44:39 GMT
server
ESF
date
Tue, 15 Dec 2020 06:44:39 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 15 Dec 2020 06:44:39 GMT
rs=AMjVe6j4y3c149q3TUJRzEwNikCf-UR4bQ
www.gstatic.com/_/freebird/_/ss/k=freebird.v.18924sdejeinp.L.W.O/d=1/ct=zgms/ 		411 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/freebird/_/ss/k=freebird.v.18924sdejeinp.L.W.O/d=1/ct=zgms/rs=AMjVe6j4y3c149q3TUJRzEwNikCf-UR4bQ
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1f972a4b0586006fd42ddf12e5e13a75e5cc4dabe04aa4f82e3494ce425af8ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 05:49:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 13 Dec 2020 04:00:04 GMT
server
sffe
age
176107
vary
Accept-Encoding, Origin
content-type
text/css; charset=UTF-8
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51146
x-xss-protection
0
expires
Mon, 13 Dec 2021 05:49:32 GMT
css
fonts.googleapis.com/ 		13 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
2d7a378b028c2244ae5710e8ae226002f81cd0bbf93cb4e021b0a13fcddd8039
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 15 Dec 2020 05:16:25 GMT
server
ESF
date
Tue, 15 Dec 2020 06:44:39 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 15 Dec 2020 06:44:39 GMT
css
fonts.googleapis.com/ 		1 KB
541 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Product+Sans&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
bb2c0dfb197e55d15c46cbdd25edf0b3d4bb51a5fb1f154cd3a0f5e8cb215b8b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 15 Dec 2020 04:52:21 GMT
server
ESF
date
Tue, 15 Dec 2020 06:44:39 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 15 Dec 2020 06:44:39 GMT
googlelogo_dark_clr_74x24px.svg
www.gstatic.com/images/branding/googlelogo/svg/ 		1 KB
805 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_dark_clr_74x24px.svg
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f4af84efe90891185d9b29a841181ca9d26d7560864ea47b6cd709d3b964aee3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 11 Dec 2020 22:33:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
age
288649
vary
Accept-Encoding, Origin
content-type
image/svg+xml
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
689
x-xss-protection
0
expires
Sat, 11 Dec 2021 22:33:50 GMT
m=viewer_base
www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=1/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/ 		347 KB
113 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=1/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/m=viewer_base
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e4c3f7f1f28ddcdacfc591f9f34011dc1c8a7fbeb6c9951f4ed8d1fb1c3021b3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 07:25:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 13 Dec 2020 04:00:04 GMT
server
sffe
age
170337
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
115543
x-xss-protection
0
expires
Mon, 13 Dec 2021 07:25:42 GMT
BIMp52Urnd4MtuTkPxUxO5g7q3HT7pYZuE4nUzG1VFMa1mLvgDd94zTR4Fma0T0JbpKqzCGedOOAP2U5YjEXcIfgYcIfGl1OT2hm0C18a6GvF4685oq-F-xhi85DRg=w1999
lh5.googleusercontent.com/ 		486 KB
486 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh5.googleusercontent.com/BIMp52Urnd4MtuTkPxUxO5g7q3HT7pYZuE4nUzG1VFMa1mLvgDd94zTR4Fma0T0JbpKqzCGedOOAP2U5YjEXcIfgYcIfGl1OT2hm0C18a6GvF4685oq-F-xhi85DRg=w1999
Requested by
Host: docs.google.com
URL: https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform?usp=send_form
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
90c97cc21970495bfca8ca5875f9d6c7bb248189aeb8ec68cc94fbc0727f2b75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 15 Dec 2020 05:43:27 GMT
x-content-type-options
nosniff
age
3672
content-disposition
inline;filename="AF1QipMmLy_vJLMvmDoeStbj5ce80pW-6h6CREb8VcV2=w1999-h500.png"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
497346
x-xss-protection
0
server
fife
etag
"v1"
vary
Origin
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Wed, 16 Dec 2020 05:43:27 GMT
qp_sprite136.svg
ssl.gstatic.com/docs/forms/ 		104 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.gstatic.com/docs/forms/qp_sprite136.svg
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/freebird/_/ss/k=freebird.v.18924sdejeinp.L.W.O/d=1/ct=zgms/rs=AMjVe6j4y3c149q3TUJRzEwNikCf-UR4bQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
73b1a3a4653a6699f1669b4e0d279f7b7f730a77e191c31ff8d2e42d3c42af8f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.gstatic.com/_/freebird/_/ss/k=freebird.v.18924sdejeinp.L.W.O/d=1/ct=zgms/rs=AMjVe6j4y3c149q3TUJRzEwNikCf-UR4bQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 10 Dec 2020 17:36:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 16 Nov 2020 19:15:00 GMT
server
sffe
age
392860
vary
Accept-Encoding, Origin
content-type
image/svg+xml
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14203
x-xss-protection
0
expires
Fri, 10 Dec 2021 17:36:59 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 08 Dec 2020 17:20:25 GMT
x-content-type-options
nosniff
last-modified
Wed, 24 Jul 2019 01:18:50 GMT
server
sffe
age
566654
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11016
x-xss-protection
0
expires
Wed, 08 Dec 2021 17:20:25 GMT
4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
fonts.gstatic.com/s/googlesans/v27/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UabrENHsxJlGDuGo1OIlLU94YtzCwZsPF4o.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1daab0f66666bc3a1d05d70de979a80680d985cc924e233fab61eef2d03bafe2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 18:36:57 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Nov 2020 20:26:17 GMT
server
sffe
age
216462
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14816
x-xss-protection
0
expires
Sun, 12 Dec 2021 18:36:57 GMT
pxiDypQkot1TnFhsFMOfGShVF9eOYktMqg.woff2
fonts.gstatic.com/s/productsans/v12/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/productsans/v12/pxiDypQkot1TnFhsFMOfGShVF9eOYktMqg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Product+Sans&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
253fad4d1c1855b84bf1e0f88e01314f1edcaea1ee474dc1d65f7155db9bb6ba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/css?family=Product+Sans&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 16:51:54 GMT
x-content-type-options
nosniff
last-modified
Thu, 20 Feb 2020 02:39:22 GMT
server
sffe
age
222765
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14140
x-xss-protection
0
expires
Sun, 12 Dec 2021 16:51:54 GMT
4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
fonts.gstatic.com/s/googlesans/v27/ 		14 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/googlesans/v27/4UaGrENHsxJlGDuGo1OIlL3Owp5eKQtG.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f199a20f1fee7dec152b3591272f9715b536ed88b4c36194488fd5a734caf707
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/css?family=Google+Sans:400,500|Roboto:300,400,400i,500,700&subset=latin,vietnamese,latin-ext,cyrillic,greek,cyrillic-ext,greek-ext
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 12 Dec 2020 17:02:59 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Nov 2020 20:26:06 GMT
server
sffe
age
222100
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14608
x-xss-protection
0
expires
Sun, 12 Dec 2021 17:02:59 GMT
m=NpD4ec,ws9Tlc,sy0,sy10,sy11,sy1,sy12,sy47,sy29,sy4a,V3dDOb,sy1n,gkf10d,j2YlP,sy6,sy7,syc,sy8,sy9,sy23,sy25,OShpD,De38hd,sy1d,Sk9apb,J8mJTc,UUJqVe,syy,sy1u,O6y8ed,sy3j,sy3e,sy3k,syd,sy3f,sy3l,sy2,...
www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=0/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/ 		290 KB
91 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=0/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/m=NpD4ec,ws9Tlc,sy0,sy10,sy11,sy1,sy12,sy47,sy29,sy4a,V3dDOb,sy1n,gkf10d,j2YlP,sy6,sy7,syc,sy8,sy9,sy23,sy25,OShpD,De38hd,sy1d,Sk9apb,J8mJTc,UUJqVe,syy,sy1u,O6y8ed,sy3j,sy3e,sy3k,syd,sy3f,sy3l,sy2,Xhpexc,Q91hve,sya,syb,sy1y,sy3,sy1z,sy21,sy22,mRfQQ,sy3a,sy39,CFa0o,syn,sye,sy1i,MpJwZc,Y9atKf,s39S4,syv,sy27,sy44,L1AAkb,sy4w,KUM7Z,QvB8bb,bCfhJc,sy38,syj,u9ZRK,pItcJd,yZuGp,aW3pY,YLQSd,sy28,sy2c,sy4c,I6YDgd,syl,sy2q,sy2i,sy2r,sy2j,sy4x,sy2t,sy2u,sy34,uiNkee,sy2p,sy35,sy36,sy37,sy48,sy4b,sy59,sy5a,fgj8Rb,sy4z,sy50,xQtZb,IvDHfc,p2tbsc,d8PXFf,atgb9d,sy15,sy16,sy17,sy18,sy19,LxALBf,rHjpXd,sy4y,SM1lmd,QwQO1b,WdhPgc,JCrucd,ok0nye,sy2n,sy2a,sy2k,sy2l,sy2o,sy2s,sy2b,sy2f,sy20,sy3g,sy3h,sy1w,sy2y,sy3b,sy3i,sy3o,sy13,sy2d,sy2e,sy2g,sy2h,sy2m,sy3n,OqIWSb,sbHRWb,RGrRJf,OkF2xb,sy2w,sy3m,sy3s,TOfxwf,sy3w,lSvzH,xajb8d,bjxBRd,zdweue,oZECf,yUS4Lc
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=1/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/m=viewer_base
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fae1483b4da2b6f404f37d751e3c093e224f316442b9e1e79141d93d68998424
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 07:25:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
170337
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
92450
x-xss-protection
0
last-modified
Sun, 13 Dec 2020 04:00:04 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://docs.google.com
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 13 Dec 2021 07:25:42 GMT
m=A4UTCb,sy32,cNHZjb,sy46,VXdfxd,KFVhZe
www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=0/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/ 		19 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=0/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/m=A4UTCb,sy32,cNHZjb,sy46,VXdfxd,KFVhZe
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=1/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/m=viewer_base
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eef545c9d46e556044c931f6c6f25c37176cebff25be6886ef03479820a7eea0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sun, 13 Dec 2020 07:25:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
170337
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7055
x-xss-protection
0
last-modified
Sun, 13 Dec 2020 04:00:04 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://docs.google.com
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 13 Dec 2021 07:25:42 GMT
logImpressions
docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/ 		0
429 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/logImpressions
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/_/freebird/_/js/k=freebird.v.de.qgG4ZSGWP2w.O/d=1/ct=zgms/rs=AMjVe6gDTdjc-DoqNfz34y8xPav9o4lSiQ/m=viewer_base
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-m5KuWDbErIctSYuvij6BjQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'

Request headers

X-Same-Domain
1
Referer
https://docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg/viewform
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 15 Dec 2020 06:44:39 GMT
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-security-policy
base-uri 'self';object-src 'none';report-uri https://csp.withgoogle.com/csp/forms/prod;script-src 'report-sample' 'nonce-m5KuWDbErIctSYuvij6BjQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval'
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
GSE
expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| WIZ_global_data object| _docs_flag_initialData object| gbar_ object| gbar string| __PVT object| gapi object| ___jsl object| FB_PUBLIC_LOAD_DATA_ object| default_v function| _getTimingInstance function| _docsTiming string| H object| closure_lm_65638 object| fb_wizbind function| _F_getAverageFps object| help object| hgb object| userfeedback function| fpHtcb

2 Cookies

Domain/Path Name / Value
.google.com/ Name: NID
Value: 204=FQs6-Xb8eNwcbHyMrrTWXvgaHmcwRmK6l50UKM3k6l2X5_d5afW0KFwd2E908ZAUHuypWJ_K731EFo6v2pZB5svWy44z1JOBoJgzQV1zKphR15HpP91icIoBV3NP2bG6RjXXvOEEkXTUC76ixHyX6hwdKOGfnF8oToLnbdokSZ8
.docs.google.com/forms/d/e/1FAIpQLSf1s69ZYM3e8ePY_WdD_AW4Dfz4OBwR1aICsNStsRrhRi9usg Name: S
Value: spreadsheet_forms=hme4RNAil8udoM4cEe3IET7u3c1UOAyI3hF8o-7A-IU

2 Console Messages

Source Level URL
Text
console-api log URL: https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/m=_b,_tp(Line 423)
Message:
%c%s color: red; background: yellow; font-size: 24px; WARNING!
console-api log URL: https://www.gstatic.com/_/mss/boq-devplatform/_/js/k=boq-devplatform.DurableDeepLinkUi.en_US.g2p58IzPGio.es5.O/am=BA/d=1/excm=_b,_tp,viewddl/ed=1/dg=0/wt=2/ct=zgms/rs=ADpVLP4_P4AvYWD4K-98J8oUUf_iDnqLdA/m=_b,_tp(Line 423)
Message:
%c%s font-size: 18px; Using this console may allow attackers to impersonate you and steal your information using an attack called Self-XSS. Do not enter or paste code that you do not understand.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.treasuredata.com
docs.google.com
firebasehostingproxy.page.link
fonts.googleapis.com
fonts.gstatic.com
forms.gle
in.treasuredata.com
lh5.googleusercontent.com
rd.cluez.biz
ssl.gstatic.com
static.aperza.jp
static.cluez.biz
www.googletagmanager.com
www.gstatic.com
151.101.1.195
2a00:1450:4001:800::2003
2a00:1450:4001:801::200a
2a00:1450:4001:801::200e
2a00:1450:4001:802::2003
2a00:1450:4001:802::200e
2a00:1450:4001:803::2001
2a00:1450:4001:808::2008
2a00:1450:4001:809::2003
2a00:1450:4001:825::2003
54.196.204.244
65.9.73.6
99.84.89.116
99.84.89.23
99.86.242.128
071a0c56d11ec9c86ee055e5aa4f44c2bb55d425c4d6a6da9f3f1c48c678ee54
1daab0f66666bc3a1d05d70de979a80680d985cc924e233fab61eef2d03bafe2
1f972a4b0586006fd42ddf12e5e13a75e5cc4dabe04aa4f82e3494ce425af8ce
253fad4d1c1855b84bf1e0f88e01314f1edcaea1ee474dc1d65f7155db9bb6ba
287b475db97319bbed1b9e454999aae03a375a9d951a93b3f90cfb33adc5f78f
2d7a378b028c2244ae5710e8ae226002f81cd0bbf93cb4e021b0a13fcddd8039
3aa9f235c06f8205b4b91091c02bbb8c8a23b12fafa257f68aecc4be22e8b7c0
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
55b340242276205e1f73c749ae503eb68cb55be3add402108f213fd9dcca822c
5a3535bf9c68a69732cec8f625abb8a79db09a0466d0793f491a9193710aff92
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
611db601125e0054880aa6b7d2fd74070b49f31dfdf67f30ebcde7d027376e73
64e9564168ac980c42dd722ec2efc5bee1829a8b169a9fcb1392694a597ae1ac
73b1a3a4653a6699f1669b4e0d279f7b7f730a77e191c31ff8d2e42d3c42af8f
76cdb5228dc73d3c342fc95758650fbfd41397c0d5d8e25c29863ef031542bd5
78b03e47087081f6ccd71fab017481364db4fd73ac848ca50499232adfda4103
90c97cc21970495bfca8ca5875f9d6c7bb248189aeb8ec68cc94fbc0727f2b75
993982cace7f555cad0619d8bd0e9fd59d950e0b23f9c3d14baad8c5aa5cd5c5
b002b2a62ff73eb5ca3997681ba5d09655f265604957b61804168b63709e0a60
bb2c0dfb197e55d15c46cbdd25edf0b3d4bb51a5fb1f154cd3a0f5e8cb215b8b
d245aa56679674c5b96e92c5c81896f410ecfd1bff910fa5486eface89f82dfa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4c3f7f1f28ddcdacfc591f9f34011dc1c8a7fbeb6c9951f4ed8d1fb1c3021b3
e7c2ab8b30402d203fbda40f263460a6290f06d4d78609e68d8e55bc9cb57fb8
eef545c9d46e556044c931f6c6f25c37176cebff25be6886ef03479820a7eea0
f199a20f1fee7dec152b3591272f9715b536ed88b4c36194488fd5a734caf707
f4af84efe90891185d9b29a841181ca9d26d7560864ea47b6cd709d3b964aee3
fae1483b4da2b6f404f37d751e3c093e224f316442b9e1e79141d93d68998424