urlscan.io logo urlscan.io
SecurityTrails logo

www.amisenvoyage.fr Open in urlscan Pro
185.49.20.101  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Submission Tags: https://phish.report @phish_report Search All
Submission: On June 21 via api from FI — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 12 IPs in 3 countries across 9 domains to perform 42 HTTP transactions. The main IP is 185.49.20.101, located in France and belongs to INEONET-AS, FR. The main domain is www.amisenvoyage.fr.
TLS certificate: Issued by R3 on April 20th 2022. Valid for: 3 months.
This is the only time www.amisenvoyage.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Raiffeisen Bank (Banking)

Domain & IP information

4    185.49.20.101 (France)

ASN197492 (INEONET-AS, FR)
PTR: http01.yulpa.io
www.amisenvoyage.fr
8    194.48.206.22 (Bulgaria)

ASN44396 (RBB-, BG)
PTR: online.rbb.bg
online.rbb.bg
9    2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
2    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:831::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
static.doubleclick.net
4    2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
jnn-pa.googleapis.com
1    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
yt3.ggpht.com
1    2a00:1450:4001:808::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
i.ytimg.com
2    2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
Apex Domain
Subdomains		 Transfer
9 youtube.com
www.youtube.com — Cisco Umbrella Rank: 100
750 KB
8 rbb.bg
online.rbb.bg
284 KB
4 googleapis.com
jnn-pa.googleapis.com — Cisco Umbrella Rank: 324
30 KB
4 gstatic.com
fonts.gstatic.com
www.gstatic.com
43 KB
4 amisenvoyage.fr
www.amisenvoyage.fr
8 KB
3 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 55
static.doubleclick.net — Cisco Umbrella Rank: 411
1 KB
1 ytimg.com
i.ytimg.com — Cisco Umbrella Rank: 122
33 KB
1 ggpht.com
yt3.ggpht.com — Cisco Umbrella Rank: 236
4 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 9
36 KB
42 9
Domain Requested by
9 www.youtube.com www.amisenvoyage.fr
www.youtube.com
8 online.rbb.bg www.amisenvoyage.fr
online.rbb.bg
4 jnn-pa.googleapis.com www.youtube.com
4 www.amisenvoyage.fr www.amisenvoyage.fr
2 www.gstatic.com www.youtube.com
www.gstatic.com
2 googleads.g.doubleclick.net 1 redirects www.youtube.com
2 fonts.gstatic.com www.youtube.com
1 i.ytimg.com www.youtube.com
1 yt3.ggpht.com www.youtube.com
1 www.google.com www.youtube.com
1 static.doubleclick.net www.youtube.com
42 11
Subject Issuer Validity Valid
amisenvoyage.fr
R3		 2022-04-20 -
2022-07-19		 3 months crt.sh
online.rbb.bg
DigiCert SHA2 Extended Validation Server CA		 2022-04-12 -
2023-04-15		 a year crt.sh
*.google.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2022-06-06 -
2022-08-29		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh
edgestatic.com
GTS CA 1C3		 2022-05-30 -
2022-08-22		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Frame ID: 94507003C6AA59026D12347D88E03CFE
Requests: 20 HTTP requests in this frame

Frame: https://www.youtube.com/embed/1Wh2xI03Tgs
Frame ID: 385A559E932A096E5044D247431EF6CF
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Интернет банкиране - Райфайзен ОНЛАЙН - Райфайзенбанк

Detected technologies

Overall confidence: 100%
Detected patterns
  • <(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com/(?:v|embed)
Overall confidence: 100%
Detected patterns
  • require.*\.js

Page Statistics

42
Requests

79 %
HTTPS

82 %
IPv6

9
Domains

11
Subdomains

12
IPs

3
Countries

1188 kB
Transfer

3798 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25
  • https://googleads.g.doubleclick.net/pagead/id HTTP 302
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

42 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/ 		38 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.49.20.101 , France, ASN197492 (INEONET-AS, FR),
Reverse DNS
http01.yulpa.io
Software
Apache /
Resource Hash
c217104d220cdeac917eef80147241d82791bb9bf2a45580f23c7f9b6b535ff6

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

accept-ranges
bytes
cache-control
public
content-encoding
gzip
content-length
7570
content-type
text/html
date
Tue, 21 Jun 2022 11:54:05 GMT
last-modified
Sun, 12 Jun 2022 11:36:52 GMT
server
Apache
server-id
apache01n
vary
Accept-Encoding,User-Agent
smartbanner.min.css
online.rbb.bg/Content/css/smartbanner/ 		12 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://online.rbb.bg/Content/css/smartbanner/smartbanner.min.css
Requested by
Host: www.amisenvoyage.fr
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
1af1054fde4c9fa4ab8cd305fb5d88dda8124e214556b1338bfbb0a5b762cb75
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.amisenvoyage.fr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:04 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
3900
style.min.css
online.rbb.bg/Content/css/ 		573 KB
69 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://online.rbb.bg/Content/css/style.min.css
Requested by
Host: www.amisenvoyage.fr
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
a2c4542824c1da51e8c8e798240f38c518138628f621534603c13ff8dc378dbd
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.amisenvoyage.fr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 31 May 2022 09:02:40 GMT
ETag
"078382ecd74d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:04 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
69075
require.js
www.amisenvoyage.fr/Scripts/libs/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.amisenvoyage.fr/Scripts/libs/require.js
Requested by
Host: www.amisenvoyage.fr
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.49.20.101 , France, ASN197492 (INEONET-AS, FR),
Reverse DNS
http01.yulpa.io
Software
Apache /
Resource Hash

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:05 GMT
server
Apache
content-length
196
content-type
text/html; charset=iso-8859-1
promise.js
www.amisenvoyage.fr/Scripts/libs/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.amisenvoyage.fr/Scripts/libs/promise.js
Requested by
Host: www.amisenvoyage.fr
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.49.20.101 , France, ASN197492 (INEONET-AS, FR),
Reverse DNS
http01.yulpa.io
Software
Apache /
Resource Hash

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:05 GMT
server
Apache
content-length
196
content-type
text/html; charset=iso-8859-1
smartbanner.min.js
www.amisenvoyage.fr/Scripts/libs/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.amisenvoyage.fr/Scripts/libs/smartbanner.min.js
Requested by
Host: www.amisenvoyage.fr
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.49.20.101 , France, ASN197492 (INEONET-AS, FR),
Reverse DNS
http01.yulpa.io
Software
Apache /
Resource Hash

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:05 GMT
server
Apache
content-length
196
content-type
text/html; charset=iso-8859-1
bg-body.png
online.rbb.bg/Content/images/ 		33 KB
34 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.rbb.bg/Content/images/bg-body.png
Requested by
Host: online.rbb.bg
URL: https://online.rbb.bg/Content/css/style.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
975a67bfdded2b81ee5e32452eda5cdcb5d407fc20e8e484da8740220cd52b0c
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://online.rbb.bg/Content/css/style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:04 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="0", dtRpid;desc="697712413"
Accept-Ranges
bytes
Content-Length
33870
logo-rbb-white-bg.svg
online.rbb.bg/Content/svg/ 		10 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.rbb.bg/Content/svg/logo-rbb-white-bg.svg
Requested by
Host: online.rbb.bg
URL: https://online.rbb.bg/Content/css/style.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
89dff036ab45ec3efd6e551ab3679501670c50882bcb04e3aefbc787983773b0
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://online.rbb.bg/Content/css/style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/svg+xml
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:04 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Length
4191
RBB_1920x498_site_banner.jpg
online.rbb.bg/Content/images/ 		148 KB
150 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.rbb.bg/Content/images/RBB_1920x498_site_banner.jpg
Requested by
Host: online.rbb.bg
URL: https://online.rbb.bg/Content/css/style.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
6d80dfe07d24a3d6be3c36cf7b4f5b954ae99c49668e4c00e9c4c9598d98ad44
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://online.rbb.bg/Content/css/style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:04 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Content-Length
152034
326381_1_0.woff
online.rbb.bg/Content/fonts/webfonts/ 		0
0
FuturaPT-Medium.woff
online.rbb.bg/Content/fonts/webfonts/ 		0
0
326381_0_0.woff
online.rbb.bg/Content/fonts/webfonts/ 		0
0
iconset-rbb.ttf
online.rbb.bg/Content/fonts/iconset-rbb// 		0
0
1Wh2xI03Tgs
www.youtube.com/embed/ Frame 385A 		63 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/1Wh2xI03Tgs
Requested by
Host: www.amisenvoyage.fr
URL: https://www.amisenvoyage.fr/online/online.RBB.bg.sms/RaiffeisenBank.bg.online/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
37bd4d70610f8c7b47fbb2fe56e87c88d4384c68a1f3da56d72496e9b0217174
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.amisenvoyage.fr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
br
content-type
text/html; charset=utf-8
critical-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
date
Tue, 21 Jun 2022 11:54:06 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=fr for more info."
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma
no-cache
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server
ESF
strict-transport-security
max-age=31536000
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options
nosniff
x-xss-protection
0
mobileApp.png
online.rbb.bg/Content/images/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.rbb.bg/Content/images/mobileApp.png
Requested by
Host: online.rbb.bg
URL: https://online.rbb.bg/Content/css/style.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
b2b769bc93904f1ed851dd0c266c5a14ae9fca670ec9cc39fa00065286fb1ae4
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://online.rbb.bg/Content/css/style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:05 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Content-Length
9051
app-store-bg.png
online.rbb.bg/Content/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.rbb.bg/Content/images/app-store-bg.png
Requested by
Host: online.rbb.bg
URL: https://online.rbb.bg/Content/css/style.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
5c95c6c1193ef4afdf14770fe02d2f008be731d477b38ad44e3a497241984696
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://online.rbb.bg/Content/css/style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:05 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Content-Length
3127
google-play-bg.png
online.rbb.bg/Content/images/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.rbb.bg/Content/images/google-play-bg.png
Requested by
Host: online.rbb.bg
URL: https://online.rbb.bg/Content/css/style.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
194.48.206.22 , Bulgaria, ASN44396 (RBB-, BG),
Reverse DNS
online.rbb.bg
Software
/
Resource Hash
c84158c02aa08b902be924e5b9b81fd349cd09510aa72710c70a6d55ac931fcd
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Strict-Transport-Security max-age=31536000;includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://online.rbb.bg/Content/css/style.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 26 May 2022 11:31:38 GMT
ETag
"0499e29f470d81:0"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=1200
Date
Tue, 21 Jun 2022 11:54:05 GMT
Content-Security-Policy
default-src 'self' 'unsafe-inline' ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ https://pisano.cx/ https://web.pisano.cx/ ; frame-src https://www.youtube.com/ https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat.infobip.com/ ; connect-src 'self' https://stg-edge.ad1x.com/ https://eu-edge.ad1x.com https://livechat-fr.infobip.com/ https://api.infobip.com https://pisano.cx https://web.pisano.cx/ https://api.pisano.cx/ https://stage.pisanousercontent.com/ wss://pisano.cx/ ; img-src 'self' data: https://pisano.cx/ https://cdn.jsdelivr.net/ https://i.ytimg.com/vi_webp/CZcQ6XltICA/mqdefault.webp https://i.ytimg.com/vi/CZcQ6XltICA/mqdefault.jpg
Server-Timing
dtSInfo;desc="1"
Accept-Ranges
bytes
Content-Length
3783
326381_1_0.ttf
online.rbb.bg/Content/fonts/webfonts/ 		0
0
FuturaPT-Medium.ttf
online.rbb.bg/Content/fonts/webfonts/ 		0
0
326381_0_0.ttf
online.rbb.bg/Content/fonts/webfonts/ 		0
0
iconset-rbb.woff
online.rbb.bg/Content/fonts/iconset-rbb// 		0
0
www-player.css
www.youtube.com/s/player/f05de49d/ Frame 385A 		338 KB
47 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/f05de49d/www-player.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
98ef8240733673f0a3033c41dc341b2257b546bebf39e6e4303ee907366d78a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 05:16:08 GMT
content-encoding
br
x-content-type-options
nosniff
age
23878
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47576
x-xss-protection
0
last-modified
Thu, 16 Jun 2022 00:19:15 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Wed, 21 Jun 2023 05:16:08 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 385A 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 14 Jun 2022 17:06:41 GMT
x-content-type-options
nosniff
age
586045
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 14 Jun 2023 17:06:41 GMT
www-embed-player.js
www.youtube.com/s/player/f05de49d/www-embed-player.vflset/ Frame 385A 		304 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/f05de49d/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55912cfc0ebd0cfdaea7cb26393660daf8c0d03029368e5113f70453fd915ac0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Mon, 20 Jun 2022 09:36:48 GMT
content-encoding
br
x-content-type-options
nosniff
age
94638
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
96086
x-xss-protection
0
last-modified
Thu, 16 Jun 2022 00:19:15 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 20 Jun 2023 09:36:48 GMT
base.js
www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/ Frame 385A 		2 MB
535 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
910c72692ce30e3a2ff70a8b483e14aa62fb6cc84078a9e5f800dfcd7c588c24
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Thu, 16 Jun 2022 16:41:10 GMT
content-encoding
br
x-content-type-options
nosniff
age
414776
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
547184
x-xss-protection
0
last-modified
Thu, 16 Jun 2022 00:19:15 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 16 Jun 2023 16:41:10 GMT
fetch-polyfill.js
www.youtube.com/s/player/f05de49d/fetch-polyfill.vflset/ Frame 385A 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/f05de49d/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:35:28 GMT
content-encoding
br
x-content-type-options
nosniff
age
1118
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2786
x-xss-protection
0
last-modified
Thu, 16 Jun 2022 00:19:15 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Wed, 21 Jun 2023 11:35:28 GMT
id
googleads.g.doubleclick.net/pagead/ Frame 385A
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/id
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
100 B
146 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H3
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f9f9a8d32c2182892ebb05a495ae2368ed639f972bf0a3524a52b64289d15ae3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
120
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 21 Jun 2022 11:54:06 GMT
x-content-type-options
nosniff
access-control-allow-origin
https://www.youtube.com
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame 385A 		29 B
588 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:49:42 GMT
x-content-type-options
nosniff
age
264
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29
x-xss-protection
0
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Tue, 21 Jun 2022 12:04:42 GMT
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Tue, 21 Jun 2022 11:54:06 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 385A 		64 KB
30 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0a3c738291f1a9d425a2a28eb7783e529fe7e4f1f14aed1fdd557d83ecbcdbb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Tue, 21 Jun 2022 11:54:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
30325
x-xss-protection
0
remote.js
www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/ Frame 385A 		119 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
be91f3e4f521dc3b397fe3126f903209058ae627c8109f7b04498c9f5aa26d2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Thu, 16 Jun 2022 16:41:11 GMT
content-encoding
br
x-content-type-options
nosniff
age
414775
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37766
x-xss-protection
0
last-modified
Thu, 16 Jun 2022 00:19:15 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 16 Jun 2023 16:41:11 GMT
ERhGGOqIPzKNtJ98GuZRXp5WacAiDPPBDZWuiZqubaM.js
www.google.com/js/th/ Frame 385A 		36 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/th/ERhGGOqIPzKNtJ98GuZRXp5WacAiDPPBDZWuiZqubaM.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
11184618ea883f328db49f7c1ae6515e9e5669c0220cf3c10d95ae899aae6da3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Mon, 20 Jun 2022 19:56:18 GMT
x-content-type-options
nosniff
age
57468
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36455
x-xss-protection
0
last-modified
Fri, 10 Jun 2022 11:00:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:56:18 GMT
embed.js
www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/ Frame 385A 		27 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7e0ef2bfc3f1d951fc972917dcac6574ea26e5005dac2eac961022d4786d1f43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Thu, 16 Jun 2022 16:41:11 GMT
content-encoding
br
x-content-type-options
nosniff
age
414775
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8123
x-xss-protection
0
last-modified
Thu, 16 Jun 2022 00:19:15 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 16 Jun 2023 16:41:11 GMT
truncated
/ Frame 385A 		175 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type
image/png
AKedOLTtUROYewfMCNfwkjvpEyDjRp3UUE_sa3RMESU8=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 385A 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yt3.ggpht.com/ytc/AKedOLTtUROYewfMCNfwkjvpEyDjRp3UUE_sa3RMESU8=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
35f06935b808d1f55b211eb0674c1fbcc80493031b69d224dc2c1c61d3896d32
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 08:27:04 GMT
x-content-type-options
nosniff
age
12422
content-disposition
inline;filename="unnamed.jpg"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3323
x-xss-protection
0
server
fife
etag
"v11"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
timing-allow-origin
*
expires
Tue, 14 Jun 2022 11:46:28 GMT
sddefault.webp
i.ytimg.com/vi_webp/1Wh2xI03Tgs/ Frame 385A 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ytimg.com/vi_webp/1Wh2xI03Tgs/sddefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b065d519a47e9f19646102ce5337382fcdc7a3f8fc7399f0d26e214c4824a1a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:06 GMT
x-content-type-options
nosniff
server
sffe
etag
"1589868051"
vary
Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
image/webp
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33702
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 21 Jun 2022 13:54:06 GMT
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 385A 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Mon, 20 Jun 2022 21:29:26 GMT
x-content-type-options
nosniff
age
51880
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9832
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:49 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Tue, 20 Jun 2023 21:29:26 GMT
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame 385A 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2007
x-xss-protection
0
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview"
vary
Accept-Encoding
report-to
{"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 21 Jun 2022 11:54:06 GMT
generate_204
www.youtube.com/ Frame 385A 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.youtube.com/generate_204?_gS-fQ
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/1Wh2xI03Tgs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 11:54:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
cast_sender.js
www.gstatic.com/eureka/clank/102/ Frame 385A 		52 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/eureka/clank/102/cast_sender.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c0bc3be07587388188143cb937f57c41c1921c60d0ad0c1a278c9099b6fc26a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date
Tue, 21 Jun 2022 07:35:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
15498
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15092
x-xss-protection
0
last-modified
Mon, 04 Apr 2022 15:13:55 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="cloudview-release"
vary
Accept-Encoding
report-to
{"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
expires
Wed, 22 Jun 2022 07:35:48 GMT
GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 385A 		98 B
142 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
323d9b087e38d11a20afbbd41e80772c3b654de2f57687f2dfa33cf571042b49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

X-User-Agent
grpc-web-javascript/0.1
Referer
https://www.youtube.com/
X-Goog-Api-Key
AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type
application/json+protobuf

Response headers

date
Tue, 21 Jun 2022 11:54:06 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server
ESF
x-frame-options
SAMEORIGIN
content-type
application/json+protobuf; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
vary
Origin, X-Origin, Referer
content-length
118
x-xss-protection
0
GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method
POST
Origin
https://www.youtube.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type,x-goog-api-key,x-user-agent
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
https://www.youtube.com
access-control-max-age
3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
content-type
text/html
date
Tue, 21 Jun 2022 11:54:06 GMT
server
ESF
vary
origin referer x-origin
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
0
log_event
www.youtube.com/youtubei/v1/ Frame 385A 		28 B
54 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/f05de49d/player_ias.vflset/fr_FR/base.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
0
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/1Wh2xI03Tgs
X-YouTube-Client-Version
1.20220615.02.00
X-YouTube-Time-Zone
Etc/Unknown
X-Goog-Visitor-Id
CgtZUUZkenF3eW1payje4saVBg%3D%3D
X-YouTube-Ad-Signals
dt=1655812446279&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C566%2C304&vis=1&wgl=true&ca_type=image

Response headers

date
Tue, 21 Jun 2022 11:54:08 GMT
content-encoding
br
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Tue, 21 Jun 2022 11:54:08 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/webfonts/326381_1_0.woff
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/webfonts/FuturaPT-Medium.woff
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/webfonts/326381_0_0.woff
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/iconset-rbb//iconset-rbb.ttf?wxo579
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/webfonts/326381_1_0.ttf
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/webfonts/FuturaPT-Medium.ttf
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/webfonts/326381_0_0.ttf
Domain
online.rbb.bg
URL
https://online.rbb.bg/Content/fonts/iconset-rbb//iconset-rbb.woff?wxo579

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Raiffeisen Bank (Banking)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation

2 Cookies

Domain/Path Name / Value
.youtube.com/ Name: YSC
Value: dX4bTziXnqw
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: YQFdzqwymik

11 Console Messages

Source Level URL
Text
network error URL: https://www.amisenvoyage.fr/Scripts/libs/require.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.amisenvoyage.fr/Scripts/libs/promise.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://www.amisenvoyage.fr/Scripts/libs/smartbanner.min.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://online.rbb.bg/Content/fonts/webfonts/326381_1_0.woff
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/webfonts/FuturaPT-Medium.woff
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/webfonts/326381_0_0.woff
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/iconset-rbb//iconset-rbb.ttf?wxo579
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/webfonts/326381_1_0.ttf
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/webfonts/FuturaPT-Medium.ttf
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/webfonts/326381_0_0.ttf
Message:
Failed to load resource: net::ERR_CONNECTION_RESET
network error URL: https://online.rbb.bg/Content/fonts/iconset-rbb//iconset-rbb.woff?wxo579
Message:
Failed to load resource: net::ERR_CONNECTION_RESET

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
jnn-pa.googleapis.com
online.rbb.bg
static.doubleclick.net
www.amisenvoyage.fr
www.google.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
online.rbb.bg
185.49.20.101
194.48.206.22
2a00:1450:4001:808::2016
2a00:1450:4001:809::200e
2a00:1450:4001:80b::2003
2a00:1450:4001:829::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2004
2a00:1450:4001:82b::200a
2a00:1450:4001:830::2003
2a00:1450:4001:831::2006
0a3c738291f1a9d425a2a28eb7783e529fe7e4f1f14aed1fdd557d83ecbcdbb4
11184618ea883f328db49f7c1ae6515e9e5669c0220cf3c10d95ae899aae6da3
1af1054fde4c9fa4ab8cd305fb5d88dda8124e214556b1338bfbb0a5b762cb75
323d9b087e38d11a20afbbd41e80772c3b654de2f57687f2dfa33cf571042b49
35f06935b808d1f55b211eb0674c1fbcc80493031b69d224dc2c1c61d3896d32
37bd4d70610f8c7b47fbb2fe56e87c88d4384c68a1f3da56d72496e9b0217174
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
55912cfc0ebd0cfdaea7cb26393660daf8c0d03029368e5113f70453fd915ac0
5c95c6c1193ef4afdf14770fe02d2f008be731d477b38ad44e3a497241984696
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6d80dfe07d24a3d6be3c36cf7b4f5b954ae99c49668e4c00e9c4c9598d98ad44
7e0ef2bfc3f1d951fc972917dcac6574ea26e5005dac2eac961022d4786d1f43
89dff036ab45ec3efd6e551ab3679501670c50882bcb04e3aefbc787983773b0
910c72692ce30e3a2ff70a8b483e14aa62fb6cc84078a9e5f800dfcd7c588c24
975a67bfdded2b81ee5e32452eda5cdcb5d407fc20e8e484da8740220cd52b0c
98ef8240733673f0a3033c41dc341b2257b546bebf39e6e4303ee907366d78a9
a2c4542824c1da51e8c8e798240f38c518138628f621534603c13ff8dc378dbd
b065d519a47e9f19646102ce5337382fcdc7a3f8fc7399f0d26e214c4824a1a0
b2b769bc93904f1ed851dd0c266c5a14ae9fca670ec9cc39fa00065286fb1ae4
be91f3e4f521dc3b397fe3126f903209058ae627c8109f7b04498c9f5aa26d2a
c0bc3be07587388188143cb937f57c41c1921c60d0ad0c1a278c9099b6fc26a6
c217104d220cdeac917eef80147241d82791bb9bf2a45580f23c7f9b6b535ff6
c84158c02aa08b902be924e5b9b81fd349cd09510aa72710c70a6d55ac931fcd
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
f9f9a8d32c2182892ebb05a495ae2368ed639f972bf0a3524a52b64289d15ae3