urlscan.io logo urlscan.io
SecurityTrails logo

billformride.gq Open in urlscan Pro
2606:4700:3032::ac43:88ca  Public Scan

Go To Rescan Add Verdict Report
URL: https://billformride.gq/
Submission: On November 20 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 4 countries across 8 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3032::ac43:88ca, located in United States and belongs to CLOUDFLARENET, US. The main domain is billformride.gq.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 20th 2021. Valid for: a year.
This is the only time billformride.gq was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 151.101.2.227 54113 (FASTLY)
1 13.236.218.88 16509 (AMAZON-02)
1 103.145.192.123 16509 (AMAZON-02)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
5 2a00:1450:400... 15169 (GOOGLE)
3 142.250.184.227 15169 (GOOGLE)
14 8
1    2606:4700:3032::ac43:88ca (United States)

ASN13335 (CLOUDFLARENET, US)
billformride.gq
1    2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    151.101.2.227 (United States)

ASN54113 (FASTLY, US)
resources.stuff.co.nz
1    13.236.218.88 (Sydney, Australia)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-236-218-88.ap-southeast-2.compute.amazonaws.com
westcoast.recollect.co.nz
1    103.145.192.123 (New Zealand)

ASN16509 (AMAZON-02, US)
PTR: mail1-1.zeald.com
www.bargainrentalcars.co.nz
1    2a02:26f0:6c00:2b7::1ef0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
www.newzealand.com
5    2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
3    142.250.184.227 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f3.1e100.net
fonts.gstatic.com
Domain Requested by
5 www.youtube.com billformride.gq
www.youtube.com
3 fonts.gstatic.com www.youtube.com
fonts.googleapis.com
1 www.newzealand.com billformride.gq
1 www.bargainrentalcars.co.nz billformride.gq
1 westcoast.recollect.co.nz billformride.gq
1 resources.stuff.co.nz billformride.gq
1 fonts.googleapis.com billformride.gq
1 billformride.gq
14 8

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-11-20 -
2022-11-19		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
www.stuff.co.nz
GlobalSign Atlas R3 OV TLS CA H2 2021		 2021-09-02 -
2022-10-04		 a year crt.sh
recollect.co.nz
Amazon		 2021-04-06 -
2022-05-05		 a year crt.sh
www.bargainrentalcars.co.nz
Sectigo RSA Domain Validation Secure Server CA		 2021-07-15 -
2022-08-15		 a year crt.sh
newzealand.com
DigiCert SHA2 Secure Server CA		 2021-08-31 -
2022-03-10		 6 months crt.sh
*.google.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-11-01 -
2022-01-24		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://billformride.gq/
Frame ID: 3E3EC0558BCF9A6AA0A3E8A9314430F0
Requests: 8 HTTP requests in this frame

Frame: https://www.youtube.com/embed/2uwFVah3ssk
Frame ID: 48C1BD852FBA053DACA3AEAE3F763CA2
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

New Zealand's Largest Flower Marketing Entity

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

8
IPs

4
Countries

852 kB
Transfer

2125 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
billformride.gq/ 		61 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://billformride.gq/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:88ca , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77d648db7a4252d1152437ba89f9081822bf7a289cd650a1e14f2e783315fa37

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Sat, 20 Nov 2021 02:12:12 GMT
content-type
text/html; charset=UTF-8
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S6g5ReLlS1AJ7ftZhoRjWbEr1rM7growaV7O4lYzWXl3s9rVbT%2F7sVbCaS%2B5MSRSMG4ZaTnAhQ0JlIgk412h9gIyXqIGVu3KRJo%2FT%2FUY9oyU7emTwevz%2F7c1aWfhw%2FuHVLp3ShsUzFSZmRmAPrE%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6b0e26e9defb05fd-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
css
fonts.googleapis.com/ 		8 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Libre+Franklin%3A300%2C300i%2C400%2C400i%2C600%2C600i%2C800%2C800i&subset=latin%2Clatin-ext
Requested by
Host: billformride.gq
URL: https://billformride.gq/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
db65b6dc8f89c8b766feed64ee54961c71e3cf90bb653c8a2a09efa356a92d43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://billformride.gq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 20 Nov 2021 00:21:07 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sat, 20 Nov 2021 02:12:15 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 20 Nov 2021 02:12:15 GMT
1546905154855.jpg
resources.stuff.co.nz/content/dam/images/1/t/d/7/3/r/image.related.StuffLandscapeSixteenByNine.1420x800.1td6ct.png/ 		256 KB
257 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://resources.stuff.co.nz/content/dam/images/1/t/d/7/3/r/image.related.StuffLandscapeSixteenByNine.1420x800.1td6ct.png/1546905154855.jpg
Requested by
Host: billformride.gq
URL: https://billformride.gq/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.227 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
NZCMS /
Resource Hash
542e34b03e88d2175cb4c7809df9c9ae6b7f53ec7245f60643c98b7a761b0f4b
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://billformride.gq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 20 Nov 2021 02:12:14 GMT
via
1.1 varnish-v4, 1.1 varnish, 1.1 varnish
age
1131549
x-cache
HIT, MISS
fastly-io-info
ifsz=262383 idim=1417x800 ifmt=jpeg ofsz=262383 odim=1417x800 ofmt=jpeg
fastly-stats
io=1
content-length
262383
fastly-io-warning
Failed to shrink image
x-served-by
cache-akl10329-AKL, cache-hhn4037-HHN
x-esi-enable
0
server
NZCMS
x-timer
S1637374333.669609,VS0,VE1760
x-cache-origin
MISS:Varnish
etag
"I4rjdo3Bxn6kIRQhYjvqQdb+52TKzCqiZLEMXwdurnA"
strict-transport-security
max-age=300
content-type
image/jpeg
cache-control
public, max-age=31536000
referer
accept-ranges
bytes
x-cache-hits
1, 0
80527-max
westcoast.recollect.co.nz/assets/display/ 		163 KB
165 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://westcoast.recollect.co.nz/assets/display/80527-max
Requested by
Host: billformride.gq
URL: https://billformride.gq/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.236.218.88 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-236-218-88.ap-southeast-2.compute.amazonaws.com
Software
Apache /
Resource Hash
cc58855a2076d4fdefbdce6d62f879ec14289ae48dc3e129d6f6ab8f7c8689a4
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://billformride.gq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 20 Nov 2021 02:12:13 GMT
x-content-type-options
nosniff
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-disposition
inline
pragma
public
x-recollect
Layout:Asset As:JPG
referrer-policy
no-referrer, strict-origin-when-cross-origin
last-modified
Wed, 01 Jul 2020 11:19:43 +1200
server
Apache
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
image/jpeg
cache-control
maxage=7200
feature-policy
accelerometer none; ambient-light-sensor none; geolocation none; camera none; autoplay none; battery none; display-capture none; document-domain none; encrypted-media none; execution-while-not-rendered none; execution-while-out-of-viewport none; gamepad none; gyroscope none; layout-animations none; legacy-image-formats none; magnetometer none; microphone none; midi none; navigation-override none; oversized-images none; payment none; picture-in-picture none; publickey-credentials-get none; sync-xhr none; unoptimized-images none; unsized-media none; usb none; vibrate none; vr none; screen-wake-lock none; web-share none; xr-spatial-tracking none
permissions-policy
accelerometer none; ambient-light-sensor none; geolocation none; camera none; autoplay none; battery none; display-capture none; document-domain none; encrypted-media none; execution-while-not-rendered none; execution-while-out-of-viewport none; gamepad none; gyroscope none; layout-animations none; legacy-image-formats none; magnetometer none; microphone none; midi none; navigation-override none; oversized-images none; payment none; picture-in-picture none; publickey-credentials-get none; sync-xhr none; unoptimized-images none; unsized-media none; usb none; vibrate none; vr none; screen-wake-lock none; web-share none; xr-spatial-tracking none
expires
Sat, 20 Nov 2021 04:12:13 GMT
pancake-rocks-nz-west-coast-brc.jpg
www.bargainrentalcars.co.nz/site/hireace/images/Blog%20Images/ 		157 KB
158 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bargainrentalcars.co.nz/site/hireace/images/Blog%20Images/pancake-rocks-nz-west-coast-brc.jpg
Requested by
Host: billformride.gq
URL: https://billformride.gq/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.145.192.123 , New Zealand, ASN16509 (AMAZON-02, US),
Reverse DNS
mail1-1.zeald.com
Software
Apache /
Resource Hash
83b7378dca89d4e153059ae5b7419a8a3448ceb3e526018cd07ec6cdf7bfebf9
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://billformride.gq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 20 Nov 2021 02:12:14 GMT
x-content-type-options
nosniff
last-modified
Thu, 21 Jun 2018 03:19:26 GMT
server
Apache
vary
X-Forwarded-Proto,Host
content-type
image/jpeg
access-control-allow-origin
*
accept-ranges
bytes
access-control-allow-headers
Authorization, Origin, X-Requested-With, Content-Type, Accept
content-length
160453
img-1536913234-6903-30082-4034659798_bbf71a68b7_o__aWxvdmVrZWxseQo_FocalPointCropWzQ0MCwxMjgwLDU4LDg0LDc1LCJqcGciLDY1LDIuNV0.jpg
www.newzealand.com/assets/Tourism-NZ/Taranaki/6e850cb91e/ 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.newzealand.com/assets/Tourism-NZ/Taranaki/6e850cb91e/img-1536913234-6903-30082-4034659798_bbf71a68b7_o__aWxvdmVrZWxseQo_FocalPointCropWzQ0MCwxMjgwLDU4LDg0LDc1LCJqcGciLDY1LDIuNV0.jpg
Requested by
Host: billformride.gq
URL: https://billformride.gq/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2b7::1ef0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
9b950f87c1ec1f7636f694fdda5639f9720d0e36c167cb9bead0f534cfce85b1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options sameorigin
X-Xss-Protection 1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://billformride.gq/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 20 Nov 2021 02:12:13 GMT
last-modified
Thu, 16 Apr 2020 02:34:30 GMT
server
nginx
x-frame-options
sameorigin
etag
"5e97c436-13e31"
strict-transport-security
max-age=31536000
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, no-transform, max-age=2234900
server-timing
cdn-cache; desc=HIT, edge; dur=80
accept-ranges
bytes
content-length
81457
x-xss-protection
1
expires
Wed, 15 Dec 2021 23:00:33 GMT
2uwFVah3ssk
www.youtube.com/embed/ Frame 48C1 		59 KB
25 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/2uwFVah3ssk
Requested by
Host: billformride.gq
URL: https://billformride.gq/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
82970b1a0a1f0e575da821309730272dedb89fd3168ad46252d26806510fd666
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://billformride.gq/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Sat, 20 Nov 2021 02:12:14 GMT
strict-transport-security
max-age=31536000
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
report-to
{"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]}
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding
br
server
ESF
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
www-player-webp.css
www.youtube.com/s/player/ad2aeb77/ Frame 48C1 		198 KB
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/ad2aeb77/www-player-webp.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/2uwFVah3ssk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/2uwFVah3ssk
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Sat, 20 Nov 2021 00:03:34 GMT
content-encoding
br
x-content-type-options
nosniff
age
7720
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47193
x-xss-protection
0
last-modified
Thu, 18 Nov 2021 01:17:46 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Sun, 20 Nov 2022 00:03:34 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 48C1 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/2uwFVah3ssk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 17:06:41 GMT
x-content-type-options
nosniff
age
291933
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 16 Nov 2022 17:06:41 GMT
www-embed-player.js
www.youtube.com/s/player/ad2aeb77/www-embed-player.vflset/ Frame 48C1 		214 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/ad2aeb77/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/2uwFVah3ssk
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d59215215ab74c1db96fd8ab0ab80ca05ebbbae6afc8ba156c5ae53b83fd652a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/2uwFVah3ssk
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 15:36:31 GMT
content-encoding
br
x-content-type-options
nosniff
age
124544
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
71869
x-xss-protection
0
last-modified
Thu, 18 Nov 2021 01:17:46 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 18 Nov 2022 15:36:31 GMT
base.js
www.youtube.com/s/player/ad2aeb77/player_ias.vflset/de_DE/ Frame 48C1 		850 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/ad2aeb77/player_ias.vflset/de_DE/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/2uwFVah3ssk
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/2uwFVah3ssk
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 15:36:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
124565
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
534562
x-xss-protection
0
last-modified
Thu, 18 Nov 2021 01:17:46 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 18 Nov 2022 15:36:10 GMT
fetch-polyfill.js
www.youtube.com/s/player/ad2aeb77/fetch-polyfill.vflset/ Frame 48C1 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/ad2aeb77/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/2uwFVah3ssk
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/2uwFVah3ssk
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 15:36:31 GMT
content-encoding
br
x-content-type-options
nosniff
age
124544
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2830
x-xss-protection
0
last-modified
Thu, 18 Nov 2021 01:17:46 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 18 Nov 2022 15:36:31 GMT
jizDREVItHgc8qDIbSTKq4XkRiUf2zc.woff2
fonts.gstatic.com/s/librefranklin/v7/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/librefranklin/v7/jizDREVItHgc8qDIbSTKq4XkRiUf2zc.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Franklin%3A300%2C300i%2C400%2C400i%2C600%2C600i%2C800%2C800i&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
sffe /
Resource Hash
fedcdc389419bfa88ed3f2c226b9d043fa6d6ea927cadd49c833cbfcf0de3efb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://billformride.gq
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 19 Nov 2021 13:21:57 GMT
x-content-type-options
nosniff
age
46219
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
27240
x-xss-protection
0
last-modified
Thu, 28 Jan 2021 21:06:30 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 19 Nov 2022 13:21:57 GMT
jizBREVItHgc8qDIbSTKq4XkRiUa6zUTjg.woff2
fonts.gstatic.com/s/librefranklin/v7/ 		30 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/librefranklin/v7/jizBREVItHgc8qDIbSTKq4XkRiUa6zUTjg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Libre+Franklin%3A300%2C300i%2C400%2C400i%2C600%2C600i%2C800%2C800i&subset=latin%2Clatin-ext
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f3.1e100.net
Software
sffe /
Resource Hash
a1bfa93165e5e460e37883ea167cdf8b99b7c618f45019b43b00fa102474ab74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://billformride.gq
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 16 Nov 2021 14:08:15 GMT
x-content-type-options
nosniff
age
302641
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30536
x-xss-protection
0
last-modified
Thu, 28 Jan 2021 21:05:32 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 16 Nov 2022 14:08:15 GMT

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

3 Cookies

Domain/Path Name / Value
billformride.gq/ Name: ch1c
Value: b
.youtube.com/ Name: YSC
Value: wlKGFx_-HlA
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: 9inOq6JAAPg