urlscan.io logo urlscan.io
SecurityTrails logo

kof.portalqthmp.xyz Open in urlscan Pro
2606:4700:3037::6815:846  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://iugopoas.blogspot.be/
Effective URL: https://kof.portalqthmp.xyz/
Submission: On September 08 via api from IE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 4 countries across 16 domains to perform 57 HTTP transactions. The main IP is 2606:4700:3037::6815:846, located in United States and belongs to CLOUDFLARENET, US. The main domain is kof.portalqthmp.xyz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 25th 2021. Valid for: a year.
This is the only time kof.portalqthmp.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

1    2a00:1450:4007:818::2001 (Ireland)

ASN15169 (GOOGLE, US)
iugopoas.blogspot.be
4    2a00:1450:4007:80e::2001 (Ireland)

ASN15169 (GOOGLE, US)
iugopoas.blogspot.com
ropdas.blogspot.com
4    2a00:1450:4007:806::2003 (Ireland)

ASN15169 (GOOGLE, US)
www.gstatic.com
2    2a00:1450:4007:80d::2009 (Ireland)

ASN15169 (GOOGLE, US)
resources.blogblog.com
2    2a00:1450:4007:80b::2009 (Ireland)

ASN15169 (GOOGLE, US)
www.blogger.com
1    2a00:1450:4007:808::2001 (Ireland)

ASN15169 (GOOGLE, US)
dermossa.blogspot.com
1    185.211.246.154 (Moscow, Russian Federation)

ASN202984 (TEAM-HOST AS, RU)
pydgmp.xyz
8    2606:4700:3037::6815:846 (United States)

ASN13335 (CLOUDFLARENET, US)
kof.portalqthmp.xyz
9    2a02:6b8::1:119 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)
mc.yandex.ru
mc.yandex.com
4    2a00:1450:4007:816::2003 (Ireland)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    85.119.149.96 (Russian Federation)

ASN50340 (SELECTEL-MSK, RU)
s.plpstatic.ru
14    2a00:1450:4007:805::200e (Ireland)

ASN15169 (GOOGLE, US)
www.youtube.com
2    2a00:1450:4007:80a::2002 (Ireland)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4007:805::2004 (Ireland)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4007:81a::2001 (Ireland)

ASN15169 (GOOGLE, US)
yt3.ggpht.com
7    2a00:1450:4001:6e::8 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
r3---sn-4g5ednsd.googlevideo.com
1    2a00:1450:4007:80e::2016 (Ireland)

ASN15169 (GOOGLE, US)
i.ytimg.com
Domain Requested by
14 www.youtube.com kof.portalqthmp.xyz
www.youtube.com
8 kof.portalqthmp.xyz ropdas.blogspot.com
kof.portalqthmp.xyz
7 r3---sn-4g5ednsd.googlevideo.com www.youtube.com
7 mc.yandex.com 2 redirects kof.portalqthmp.xyz
mc.yandex.ru
4 fonts.gstatic.com kof.portalqthmp.xyz
www.youtube.com
4 www.gstatic.com iugopoas.blogspot.com
ropdas.blogspot.com
www.youtube.com
www.gstatic.com
2 googleads.g.doubleclick.net 1 redirects kof.portalqthmp.xyz
2 mc.yandex.ru 1 redirects kof.portalqthmp.xyz
2 ropdas.blogspot.com dermossa.blogspot.com
ropdas.blogspot.com
2 www.blogger.com iugopoas.blogspot.com
ropdas.blogspot.com
2 resources.blogblog.com iugopoas.blogspot.com
ropdas.blogspot.com
2 iugopoas.blogspot.com iugopoas.blogspot.com
1 i.ytimg.com kof.portalqthmp.xyz
1 yt3.ggpht.com kof.portalqthmp.xyz
1 www.google.com www.youtube.com
1 s.plpstatic.ru kof.portalqthmp.xyz
1 pydgmp.xyz 1 redirects
1 dermossa.blogspot.com iugopoas.blogspot.com
1 iugopoas.blogspot.be 1 redirects
57 19

This site contains no links.

Subject Issuer Validity Valid
misc-sni.blogspot.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2021-08-23 -
2021-11-15		 3 months crt.sh
*.blogger.com
GTS CA 1C3		 2021-08-23 -
2021-11-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-08-25 -
2022-08-24		 a year crt.sh
mc.yandex.ru
Yandex CA		 2021-07-28 -
2022-01-07		 5 months crt.sh
*.plpstatic.ru
R3		 2021-08-28 -
2021-11-26		 3 months crt.sh
*.google.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-08-23 -
2021-11-15		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh
*.c.docs.google.com
GTS CA 1C3		 2021-08-17 -
2021-10-26		 2 months crt.sh
edgestatic.com
GTS CA 1C3		 2021-08-16 -
2021-11-08		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://kof.portalqthmp.xyz/
Frame ID: 4BAEA97EAA1368CCDC514D08D72CC954
Requests: 29 HTTP requests in this frame

Frame: https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Frame ID: CDC22789F5C91F4687433462E1F59C9D
Requests: 31 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://iugopoas.blogspot.be/ HTTP 302
    https://iugopoas.blogspot.com/ Page URL
  2. https://dermossa.blogspot.com/ Page URL
  3. https://ropdas.blogspot.com/ Page URL
  4. https://pydgmp.xyz/go/444323/44z2y2 HTTP 302
    https://kof.portalqthmp.xyz/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <(?:param|embed|iframe)[^>]+youtube(?:-nocookie)?\.com/(?:v|embed)
Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

57
Requests

100 %
HTTPS

88 %
IPv6

16
Domains

19
Subdomains

16
IPs

4
Countries

2849 kB
Transfer

6551 kB
Size

17
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://iugopoas.blogspot.be/ HTTP 302
    https://iugopoas.blogspot.com/ Page URL
  2. https://dermossa.blogspot.com/ Page URL
  3. https://ropdas.blogspot.com/ Page URL
  4. https://pydgmp.xyz/go/444323/44z2y2 HTTP 302
    https://kof.portalqthmp.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://iugopoas.blogspot.be/ HTTP 302
  • https://iugopoas.blogspot.com/
Request Chain 29
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9390.dMF4m6OiumEMPu_jvjToZ_GrND9S0RmLGmdja1pKPjXfijVesAwPEJA_4Hq3jmfH.q9SR8LcFoNA7LVDJEQzpTzjCZus%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9390.kgeA4tNcUck0y6RwHQV2Xza1EzOOtdF3PubcvyfuhT-B92pK3J7b8RWMOuypfZdyj4hyt8k0G2bgPcYHq4JP_A%2C%2C.H-a7lW3JZRmImMqyh7lBTBCt8f4%2C
Request Chain 30
  • https://googleads.g.doubleclick.net/pagead/id HTTP 302
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Request Chain 51
  • https://mc.yandex.com/watch/52828042?wmode=7&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&page-ref=https%3A%2F%2Fropdas.blogspot.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A631%3Acn%3A1%3Adp%3A0%3Als%3A1229440630567%3Ahid%3A988972808%3Az%3A0%3Ai%3A202109082225010%3Aet%3A1631139910%3Ac%3A1%3Arn%3A681501765%3Arqn%3A1%3Au%3A163113991013197734%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1631139909052%3Ads%3A50%2C32%2C93%2C1%2C664%2C0%2C%2C153%2C13%2C%2C%2C%2C997%3Adsn%3A50%2C32%2C94%2C0%2C664%2C0%2C%2C156%2C14%2C%2C%2C%2C997%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1631139911%3At%3A HTTP 302
  • https://mc.yandex.com/watch/52828042/1?wmode=7&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&page-ref=https%3A%2F%2Fropdas.blogspot.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A631%3Acn%3A1%3Adp%3A0%3Als%3A1229440630567%3Ahid%3A988972808%3Az%3A0%3Ai%3A202109082225010%3Aet%3A1631139910%3Ac%3A1%3Arn%3A681501765%3Arqn%3A1%3Au%3A163113991013197734%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1631139909052%3Ads%3A50%2C32%2C93%2C1%2C664%2C0%2C%2C153%2C13%2C%2C%2C%2C997%3Adsn%3A50%2C32%2C94%2C0%2C664%2C0%2C%2C156%2C14%2C%2C%2C%2C997%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1631139911%3At%3A

57 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
iugopoas.blogspot.com/
Redirect Chain
  • https://iugopoas.blogspot.be/
  • https://iugopoas.blogspot.com/
70 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://iugopoas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80e::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
iugopoas.blogspot.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

content-security-policy
upgrade-insecure-requests
content-security-policy-report-only
default-src https: blob: data: 'unsafe-inline' 'unsafe-eval'; report-uri https://www.blogger.com/cspreport
content-type
text/html; charset=UTF-8
expires
Wed, 08 Sep 2021 22:25:07 GMT
date
Wed, 08 Sep 2021 22:25:07 GMT
cache-control
private, max-age=0
last-modified
Sat, 07 Aug 2021 01:01:10 GMT
etag
W/"4c99f300b5a9ddf3caba32612f034a345094291137b4a61e547c5293e5048c5d"
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
15169
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

location
https://iugopoas.blogspot.com/
content-type
text/html; charset=UTF-8
content-encoding
gzip
date
Wed, 08 Sep 2021 22:25:07 GMT
expires
Wed, 08 Sep 2021 22:25:07 GMT
cache-control
private, max-age=0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
content-security-policy
frame-ancestors 'self'
x-xss-protection
1; mode=block
content-length
177
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
clipboard.min.js
www.gstatic.com/external_hosted/clipboardjs/ 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js
Requested by
Host: iugopoas.blogspot.com
URL: https://iugopoas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iugopoas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:08 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Wed, 14 Apr 2021 19:28:00 GMT
server
sffe
age
0
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=0
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3475
x-xss-protection
0
expires
Wed, 08 Sep 2021 22:25:08 GMT
3307614517-indie_compiled.js
resources.blogblog.com/blogblog/data/res/ 		138 KB
138 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.blogblog.com/blogblog/data/res/3307614517-indie_compiled.js
Requested by
Host: iugopoas.blogspot.com
URL: https://iugopoas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80d::2009 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iugopoas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 08:20:10 GMT
x-content-type-options
nosniff
last-modified
Thu, 02 Sep 2021 15:51:39 GMT
server
sffe
age
223498
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
141119
x-xss-protection
0
expires
Mon, 13 Sep 2021 08:20:10 GMT
cookienotice.js
iugopoas.blogspot.com/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://iugopoas.blogspot.com/js/cookienotice.js
Requested by
Host: iugopoas.blogspot.com
URL: https://iugopoas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80e::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:path
/js/cookienotice.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
iugopoas.blogspot.com
referer
https://iugopoas.blogspot.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://iugopoas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 08 Sep 2021 19:10:19 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2026
x-xss-protection
0
expires
Wed, 15 Sep 2021 22:25:08 GMT
672507172-widgets.js
www.blogger.com/static/v1/widgets/ 		148 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/widgets/672507172-widgets.js
Requested by
Host: iugopoas.blogspot.com
URL: https://iugopoas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80b::2009 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://iugopoas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 03 Sep 2021 04:49:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 30 Aug 2021 05:49:18 GMT
server
sffe
age
495328
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54924
x-xss-protection
0
expires
Sat, 03 Sep 2022 04:49:40 GMT
/
dermossa.blogspot.com/ 		70 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://dermossa.blogspot.com/
Requested by
Host: iugopoas.blogspot.com
URL: https://iugopoas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:808::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
dermossa.blogspot.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://iugopoas.blogspot.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://iugopoas.blogspot.com/

Response headers

content-type
text/html; charset=UTF-8
expires
Wed, 08 Sep 2021 22:25:08 GMT
date
Wed, 08 Sep 2021 22:25:08 GMT
cache-control
private, max-age=0
last-modified
Mon, 16 Aug 2021 18:14:44 GMT
etag
W/"65d5d10d729b353e8f4a79f6cb24c097a904036bf8f7205974cb2c72aa3b59f2"
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
15162
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
ropdas.blogspot.com/ 		72 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ropdas.blogspot.com/
Requested by
Host: dermossa.blogspot.com
URL: https://dermossa.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80e::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
9f5100ffd6578745c3440e23408336eeef6729c6ddb74879d43d18e72b850b2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
ropdas.blogspot.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://dermossa.blogspot.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://dermossa.blogspot.com/

Response headers

content-type
text/html; charset=UTF-8
expires
Wed, 08 Sep 2021 22:25:08 GMT
date
Wed, 08 Sep 2021 22:25:08 GMT
cache-control
private, max-age=0
last-modified
Wed, 08 Sep 2021 19:11:19 GMT
etag
W/"f39029b963b67e73f7f37c308ee850f648a79fc6e0665e7f2e28fbcce2d6d8fc"
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
15751
server
GSE
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
clipboard.min.js
www.gstatic.com/external_hosted/clipboardjs/ 		12 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js
Requested by
Host: ropdas.blogspot.com
URL: https://ropdas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ropdas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Wed, 14 Apr 2021 19:28:00 GMT
server
sffe
age
0
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=0
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3475
x-xss-protection
0
expires
Wed, 08 Sep 2021 22:25:09 GMT
3307614517-indie_compiled.js
resources.blogblog.com/blogblog/data/res/ 		138 KB
138 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.blogblog.com/blogblog/data/res/3307614517-indie_compiled.js
Requested by
Host: ropdas.blogspot.com
URL: https://ropdas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80d::2009 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ropdas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 08:20:10 GMT
x-content-type-options
nosniff
last-modified
Thu, 02 Sep 2021 15:51:39 GMT
server
sffe
age
223499
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
141119
x-xss-protection
0
expires
Mon, 13 Sep 2021 08:20:10 GMT
cookienotice.js
ropdas.blogspot.com/js/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ropdas.blogspot.com/js/cookienotice.js
Requested by
Host: ropdas.blogspot.com
URL: https://ropdas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80e::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:path
/js/cookienotice.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
ropdas.blogspot.com
referer
https://ropdas.blogspot.com/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://ropdas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/blogger-tech
last-modified
Wed, 08 Sep 2021 19:10:19 GMT
server
sffe
x-content-type-options
nosniff
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2026
x-xss-protection
0
expires
Wed, 15 Sep 2021 22:25:09 GMT
672507172-widgets.js
www.blogger.com/static/v1/widgets/ 		148 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/widgets/672507172-widgets.js
Requested by
Host: ropdas.blogspot.com
URL: https://ropdas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80b::2009 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://ropdas.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Fri, 03 Sep 2021 04:49:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 30 Aug 2021 05:49:18 GMT
server
sffe
age
495329
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
54924
x-xss-protection
0
expires
Sat, 03 Sep 2022 04:49:40 GMT
Primary Request /
kof.portalqthmp.xyz/
Redirect Chain
  • https://pydgmp.xyz/go/444323/44z2y2
  • https://kof.portalqthmp.xyz/
14 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/
Requested by
Host: ropdas.blogspot.com
URL: https://ropdas.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3813b0e7ef5c9d58a7192a2ee8a7179326327acaec45277a7b812c02a32d91fa

Request headers

:method
GET
:authority
kof.portalqthmp.xyz
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://ropdas.blogspot.com/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://ropdas.blogspot.com/

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xujXbxiTQHUQPn%2F94nNcKhyVcHQ%2BIqQg44zvHSp9KFukPbhhaQCnCr4%2BJ08CRfN8I1PcHlLx357h8m03G7%2FxKu8tAPXBCvzqf3ryk0YOz2ldqNY5wJ53oxwBGCGjWy1JrdwGygNwglZ249cWYQTPIP6y"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
68bb97543e380746-FRA
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Server
nginx/1.14.1
Date
Wed, 08 Sep 2021 22:25:09 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
X-Powered-By
PHP/7.1.33
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=375b3d983b49dea03c29e6d4b04879fd; expires=Wed, 07-Nov-2040 22:25:09 GMT; Max-Age=604800000; path=/; domain=pydgmp.xyz u=444323; expires=Sat, 09-Oct-2021 22:25:09 GMT; Max-Age=2678400; path=/; domain=pydgmp.xyz o=44z2y2; expires=Sat, 09-Oct-2021 22:25:09 GMT; Max-Age=2678400; path=/; domain=pydgmp.xyz
Location
https://kof.portalqthmp.xyz
vendors.css
kof.portalqthmp.xyz/ 		308 KB
40 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/vendors.css
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
21f538bb5a3b10b0c6758f5072ca4469075bc6367444dc0bf8c0177617280997

Request headers

:path
/vendors.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
age
4238
etag
W/"4d14e-5c9b136a91bc0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6CqO9%2Bjs%2FMOF82vWmEI2Yfgzd6%2BkHhBnBUkD9ylTv5ro01P7CUZpbJVFu0khEaUOGr%2Bu0HF7ed3JY6SFlDGpcRZ6pYxhdCSezlLnovI0qn36queujl40C%2BlYUNgLNLCLnvv3067yK5QUlNcod7%2FmpvA5"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
68bb9754ef1a0746-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
plp.css
kof.portalqthmp.xyz/ 		560 KB
38 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/plp.css
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25cd4b3632c9b1622968d1b3de5841c14a3c563dd507da009f14cc06b48b4292

Request headers

:path
/plp.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
age
4238
etag
W/"8c021-5c9b136a91bc0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BIVsg3OlrNi11I0%2Bm%2FgxNWE%2B7pSUCs9xEGhZrS%2BrH3fLcP7VK76meeYZqSwRO1pVLjJ3g%2B5UlyzLDkLa2peJTA4Z1k3Hb1E5jU4vOu%2BGQg3%2BKGj388e6zt6i7TtisThnFC2l48aJ5IhLmCURLS5ufrfW"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
68bb9754ef1b0746-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
nodes.css
kof.portalqthmp.xyz/ 		115 KB
46 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/nodes.css
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
274533f86a530bf9f4ef20a622e84a80456f37f6d649e9e9df76ee548645b380

Request headers

:path
/nodes.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
age
4155
etag
W/"1ca0a-5c9b136a91bc0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V%2FeqNZMwilPdJYYxnrBljLSEefsxNsp28XTw%2FvVI1gqeCOI9n0208v1BBVgBOXTYYcGwMKQ76dAfPNn73C8A0%2FJZRMrZqAo%2BCKkRgj5rleehVRuNfddWY0HUe8EtbEvVKPstklUqTyj9g4Yw0GJEQK01"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
68bb9754ef1c0746-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
vendors.js
kof.portalqthmp.xyz/ 		355 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/vendors.js
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a8106ac064e738cd838a7a836bd9527ef3f6b40d9ef44dcdd742c3aef3d818c

Request headers

:path
/vendors.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
age
4238
etag
W/"58d0b-5c9b136a91bc0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xQtfGRnTg9EdyKDx2ps0YxuqpHWibltJr135H6l9NjOj5v0OAVk9i%2BYkK%2BtlN3V05MnkPs%2FPGUtCJ7KLRhl6UbUF5KyccRi5g1yB%2B3VdGnNr4JFj6Kkla7pOp6dJbaf6pj3K%2FEvpMhRKH56DF5f69Xkl"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
68bb9754ef1d0746-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
plp.js
kof.portalqthmp.xyz/ 		77 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/plp.js
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
687584625fa912e0fd6fec7f0fbee226ba732b64712d1080d06cdb88689d959f

Request headers

:path
/plp.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
age
4155
etag
W/"13471-5c9b136a91bc0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=llY%2By0ErvmGYP9uWRfXUg%2FoWsMbGOdrVCrR67MxMkVQF%2Ff9XaKiynyZIgx7oZD3dYYVz8RSl3HOXs%2BI%2BzwcQLGNZOysdVNidZecrYrscLGG963UYN%2Fm3D8Wi2GiyU2%2BmfWLMoW8xTO4eP%2BU1QhQk7A7S"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
68bb9754ef1f0746-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
nodes.js
kof.portalqthmp.xyz/ 		49 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://kof.portalqthmp.xyz/nodes.js
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1db6a268677e54cf4be9704ccc6ac6e3288f015472211c4127fee25ef6243cad

Request headers

:path
/nodes.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:09 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
age
4238
etag
W/"c438-5c9b136a91bc0-gzip"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1fPBvMbJBmKSH3ahreppF%2FRlhXlRltbxdKfGrAn%2FnFlyL6vXCJDKEALqWFEa%2BGI9supsbXc2K5PQKjYMzv4Y4sib5E6l5xdBIkbUjfqyBgBGgfaDMNw7HRV0LwE0ujLquzHCgKZv9yTtuFZA7Miv%2FbbU"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
68bb9754ef200746-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
tag.js
mc.yandex.ru/metrika/ 		224 KB
72 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
96e61209b1c1fff1abe78fb763fbf093a04e6e992dc24b299ab1c4c5f4272f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
content-encoding
br
last-modified
Wed, 08 Sep 2021 16:07:49 GMT
etag
"61372b26-11d31"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
73009
expires
Wed, 08 Sep 2021 23:25:10 GMT
truncated
/ 		72 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e6f25c73e33c988f6335eeeb5fcb71905d31951e6ad7d8d7d387ea3552e7ba3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/png
k3k702ZOKiLJc3WVjuplzAcuEIXEaFWBWXA4NoGd_Oo.woff
fonts.gstatic.com/s/opensans/v13/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v13/k3k702ZOKiLJc3WVjuplzAcuEIXEaFWBWXA4NoGd_Oo.woff
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/plp.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:816::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd01185f335d20e75286a45c3c44d4f9af567fff4c78dbf6ec414a60f3c602f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://kof.portalqthmp.xyz/
Origin
https://kof.portalqthmp.xyz
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 17:47:38 GMT
x-content-type-options
nosniff
age
189452
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19196
x-xss-protection
0
last-modified
Mon, 27 Apr 2015 23:46:23 GMT
server
sffe
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 06 Sep 2022 17:47:38 GMT
RjgO7rYTmqiVp7vzi-Q5UbO3LdcAZYWl9Si6vvxL-qU.woff
fonts.gstatic.com/s/opensans/v13/ 		19 KB
19 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v13/RjgO7rYTmqiVp7vzi-Q5UbO3LdcAZYWl9Si6vvxL-qU.woff
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/plp.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:816::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e8f00bed071bc169467cc91b1d2d8405ce391f070d10e6c97781c20d4d96170
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://kof.portalqthmp.xyz/
Origin
https://kof.portalqthmp.xyz
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 21:34:13 GMT
x-content-type-options
nosniff
age
89457
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19400
x-xss-protection
0
last-modified
Mon, 27 Apr 2015 23:45:38 GMT
server
sffe
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 07 Sep 2022 21:34:13 GMT
fontawesome-webfont.woff2
s.plpstatic.ru/fonts/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s.plpstatic.ru/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/vendors.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
85.119.149.96 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),
Reverse DNS
Software
openresty /
Resource Hash
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Referer
https://kof.portalqthmp.xyz/
Origin
https://kof.portalqthmp.xyz
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:10 GMT
Last-Modified
Wed, 09 Dec 2020 08:24:00 GMT
Server
openresty
ETag
"5fd089a0-118d8"
Content-Type
application/font-woff2
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Keep-Alive
timeout=20
Content-Length
71896
bWj4jfk1Y8A
www.youtube.com/embed/ Frame CDC2 		56 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/vendors.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5af2033a9a27ec649db89e93d143bf8e1b300d0abbaf262dd03c21cf8ccae508
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/bWj4jfk1Y8A?rel=0&autoplay=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://kof.portalqthmp.xyz/
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 08 Sep 2021 22:25:10 GMT
strict-transport-security
max-age=31536000
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy
ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding
br
server
ESF
x-xss-protection
0
set-cookie
YSC=y3lzzO9ncFo; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=HQ9PSqMTfTo; Domain=.youtube.com; Expires=Mon, 07-Mar-2022 22:25:10 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+681; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
1.png
kof.portalqthmp.xyz/ 		115 B
472 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://kof.portalqthmp.xyz/1.png
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:846 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72c4db2af0f69f216e8d173856d48ffe51288c0ff5b2619bf7fec1819bda817d

Request headers

:path
/1.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
kof.portalqthmp.xyz
referer
https://kof.portalqthmp.xyz/
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4151
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length
115
last-modified
Mon, 16 Aug 2021 18:17:27 GMT
server
cloudflare
etag
"73-5c9b136a91bc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YRMU6%2Bnr7iifVElgzH2hfwqXlAeOK6y8JtHXZGEB0lzr9enR76rEVvRbJzM8NIHUXlk7dfTCtPtXB9Is1F%2FK0%2BRIKsxnP64R8cah5xVJrbizpHt4BP0KvSJjergHKSZs6pEVpWvaiTXkXmwZcrjEEz26"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
68bb9755f88a0746-FRA
www-player-webp.css
www.youtube.com/s/player/a1c3b4e5/ Frame CDC2 		329 KB
45 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/www-player-webp.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
46717c032f82e2316c694c6cb20d63d109954cc77e1aeee251dd5b1591915716
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 17:34:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
103845
vary
Accept-Encoding, Origin
content-type
text/css
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46331
x-xss-protection
0
expires
Wed, 07 Sep 2022 17:34:25 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CDC2 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:816::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 08:10:47 GMT
x-content-type-options
nosniff
age
224063
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 06 Sep 2022 08:10:47 GMT
www-embed-player.js
www.youtube.com/s/player/a1c3b4e5/www-embed-player.vflset/ Frame CDC2 		200 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05fd39f96778a9df88f5987a7457a3658fc1ec740ca5962171db5fb26a17e3b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 17:34:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
103845
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
67151
x-xss-protection
0
expires
Wed, 07 Sep 2022 17:34:25 GMT
base.js
www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/ Frame CDC2 		2 MB
504 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d96c18f2222947b7acd2b3511caee509ea0b06bc29cb218d505de134cf454652
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 17:45:59 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
103151
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
515225
x-xss-protection
0
expires
Wed, 07 Sep 2022 17:45:59 GMT
fetch-polyfill.js
www.youtube.com/s/player/a1c3b4e5/fetch-polyfill.vflset/ Frame CDC2 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 17:34:25 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
103845
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2830
x-xss-protection
0
expires
Wed, 07 Sep 2022 17:34:25 GMT
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9390.dMF4m6OiumEMPu_jvjToZ_GrND9S0RmLGmdja1pKPjXfijVesAwPEJA_4Hq3jmfH.q9SR8LcFoNA7LVDJEQzpTzjCZus%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9390.kgeA4tNcUck0y6RwHQV2Xza1EzOOtdF3PubcvyfuhT-B92pK3J7b8RWMOuypfZdyj4hyt8k0G2bgPcYHq4JP_A%2C%2C.H-a7lW3JZRmImMqyh7lBTBCt8f4%2C
75 B
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9390.kgeA4tNcUck0y6RwHQV2Xza1EzOOtdF3PubcvyfuhT-B92pK3J7b8RWMOuypfZdyj4hyt8k0G2bgPcYHq4JP_A%2C%2C.H-a7lW3JZRmImMqyh7lBTBCt8f4%2C
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9390.kgeA4tNcUck0y6RwHQV2Xza1EzOOtdF3PubcvyfuhT-B92pK3J7b8RWMOuypfZdyj4hyt8k0G2bgPcYHq4JP_A%2C%2C.H-a7lW3JZRmImMqyh7lBTBCt8f4%2C
date
Wed, 08 Sep 2021 22:25:10 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
id
googleads.g.doubleclick.net/pagead/ Frame CDC2
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/id
  • https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
113 B
473 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80a::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
faf6afa380be2199fc2b95edc2f11f06493eb4972bdd1f3ca42c8e7c66104b13
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
133
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Wed, 08 Sep 2021 22:25:10 GMT
x-content-type-options
nosniff
access-control-allow-origin
https://www.youtube.com
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
advert.gif
mc.yandex.com/metrika/ 		43 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
last-modified
Wed, 08 Sep 2021 16:07:49 GMT
etag
"61372b26-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Wed, 08 Sep 2021 23:25:10 GMT
TUGxdKGgSBnbvYhbgWJGNExZIxwNTenabxxqeDU0yyc.js
www.google.com/js/th/ Frame CDC2 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/th/TUGxdKGgSBnbvYhbgWJGNExZIxwNTenabxxqeDU0yyc.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::2004 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d41b174a1a04819dbbd885b816246344c59231c0d4de9da6f1c6a783534cb27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 05 Sep 2021 16:59:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
278732
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13310
x-xss-protection
0
last-modified
Mon, 30 Aug 2021 13:00:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 05 Sep 2022 16:59:38 GMT
embed.js
www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/ Frame CDC2 		24 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b91d5da6549200810597bea0634466333985321138a1ecb148fccaf463ef56f3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 17:45:59 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
103151
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7362
x-xss-protection
0
expires
Wed, 07 Sep 2022 17:45:59 GMT
player
www.youtube.com/youtubei/v1/ Frame CDC2 		76 KB
20 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e35819fd6ad6c769e5a349798e2c6c3d33b4dda2f6017a375fd58eccb37df4b8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
X-Youtube-Client-Name
56
X-Youtube-Client-Version
1.20210905.0.0
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
X-Goog-Visitor-Id
CgtIUTlQU3FNVGZUbyjG8OSJBg%3D%3D
Content-Type
application/json

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19792
x-xss-protection
0
expires
Wed, 08 Sep 2021 22:25:10 GMT
truncated
/ Frame CDC2 		175 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/png
AKedOLTt8SXdZktc_UxsigDDx_S3Chl-ZWTVbTzR7A=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame CDC2 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yt3.ggpht.com/ytc/AKedOLTt8SXdZktc_UxsigDDx_S3Chl-ZWTVbTzR7A=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:81a::2001 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
0355e77705a01dceeffdbd08ba6adcb760676eb6aa57025a8ca5704727a166ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 19:40:09 GMT
x-content-type-options
nosniff
server
fife
age
9901
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1036
x-xss-protection
0
expires
Thu, 09 Sep 2021 19:40:09 GMT
truncated
/ Frame CDC2 		331 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a458644f17e3ebbbc39ea974d6367f5a4970e43a66a82b8422bbc03d80dafd28

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type
image/png
KFOmCnqEu92Fr1Mu5mxKOzY.woff2
fonts.gstatic.com/s/roboto/v18/ Frame CDC2 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:816::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
Origin
https://www.youtube.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 01 Sep 2021 23:12:43 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:49 GMT
server
sffe
age
601947
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9832
x-xss-protection
0
expires
Thu, 01 Sep 2022 23:12:43 GMT
qoe
www.youtube.com/api/stats/ Frame CDC2 		0
178 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/api/stats/qoe?event=streamingstats&fmt=243&afmt=251&cpn=iu2-Kc3gwAyKq6gl&ei=Rjg5Yc-LIOHysAL6k6OoDw&el=embedded&docid=bWj4jfk1Y8A&ns=yt&fexp=23858057%2C23983296%2C24001037%2C24001373%2C24002022%2C24002025%2C24002923%2C24004644%2C24007246%2C24027700%2C24080738%2C24082662%2C24082700%2C24095681%2C24632123&cl=394994133&seq=1&cbr=Chrome&cbrver=92.0.4515.159&c=WEB_EMBEDDED_PLAYER&cver=1.20210905.0.0&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&vps=0.000:N,0.007:B,0.163:B,0.163:B&cmt=0.007:0.000,0.163:0.000&ctmp=cc:t.153;useVodTrack&afs=0.163:251::i&vfs=0.163:243:243::r&view=0.163:720:405&bwe=0.163:130000&bat=0.163:1:1&vis=0.163:0&bh=0.163:0.000
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Video Stats Server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 08 Sep 2021 22:25:10 GMT
x-content-type-options
nosniff
server
Video Stats Server
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		100 KB
101 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=243&aitags=133%2C134%2C135%2C136%2C160%2C242%2C243%2C244%2C247%2C278&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=video%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=5900025&dur=539.399&lmt=1588606185745071&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5431432&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRgIhAOYAW0kLXJth-Yc50OsOZGs6hgC3Fh4X_9O7iihHYFd2AiEA2LIjEDbt0fp5Z-wI9li4pvI6pqou8oj1AIm6h5972FU%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=0-102347&rn=1&rbuf=0
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
ebb74b596db2b91e96e3fd3fe1da9e14fd6b21eaceb585c6a18027bb45e30406
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:10 GMT
X-Restrict-Formats-Hint
None
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
102348
Last-Modified
Mon, 04 May 2020 15:29:45 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21300
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
X-Content-Type-Options
nosniff
Expires
Wed, 08 Sep 2021 22:25:10 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		65 KB
66 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=251&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=audio%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=10080577&dur=539.461&lmt=1606639368664253&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5432434&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZRrdeA2PoDFZ1dNGBpSEfpDMOvY6AJNn7VtKruG47q4CIC4UUNRF_3vUzAzxen07LPzUeVt5WWWmqXKdZizFHdBX&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=0-66716&rn=2&rbuf=0
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
e9652fbf9dd634b72ba232d4e5614208102648270481b6978bd34431005aa327
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:10 GMT
X-Content-Type-Options
nosniff
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
66717
Last-Modified
Sun, 29 Nov 2020 08:42:48 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
audio/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21300
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
Expires
Wed, 08 Sep 2021 22:25:10 GMT
remote.js
www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/ Frame CDC2 		95 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
729a9d4c4393bc05195c8c3af40df61bdd92d4ad499749abe0883bbaaf35b423
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 18:16:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
101313
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29889
x-xss-protection
0
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 07 Sep 2022 18:16:37 GMT
captions.js
www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/ Frame CDC2 		63 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/captions.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
854730907559703c340fc5234864645f7ea220c2353029576ef8c0816435089c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 18:16:56 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
101294
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24379
x-xss-protection
0
expires
Wed, 07 Sep 2022 18:16:56 GMT
endscreen.js
www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/ Frame CDC2 		26 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/endscreen.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d36d689bad3f0b4b62a66ae57b271e74848320e5603d6b236ec003aa6306f52c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Tue, 07 Sep 2021 18:16:56 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 06 Sep 2021 00:16:56 GMT
server
sffe
age
101294
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7098
x-xss-protection
0
expires
Wed, 07 Sep 2022 18:16:56 GMT
next
www.youtube.com/youtubei/v1/ Frame CDC2 		4 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/next?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
490ab4ef6298aaa9f173b3f0d2befbd3b0028114d3b6576c0eb849f42a440248
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
X-Youtube-Client-Name
56
X-Youtube-Client-Version
1.20210905.0.0
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
X-Goog-Visitor-Id
CgtIUTlQU3FNVGZUbyjG8OSJBg%3D%3D
Content-Type
application/json

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1242
x-xss-protection
0
expires
Wed, 08 Sep 2021 22:25:10 GMT
maxresdefault.webp
i.ytimg.com/vi_webp/bWj4jfk1Y8A/ Frame CDC2 		144 KB
145 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ytimg.com/vi_webp/bWj4jfk1Y8A/maxresdefault.webp
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:80e::2016 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
024063e39183dffe98a786d63df94162aab45445ae372939f6511350c4cf555a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
x-content-type-options
nosniff
server
sffe
age
0
etag
"1581859187"
vary
Origin
content-type
image/webp
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
147872
x-xss-protection
0
expires
Thu, 09 Sep 2021 00:25:10 GMT
generate_204
www.youtube.com/ Frame CDC2 		0
37 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.youtube.com/generate_204?6ROE3w
Requested by
Host: kof.portalqthmp.xyz
URL: https://kof.portalqthmp.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame CDC2 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 22:25:10 GMT
content-encoding
gzip
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
x-content-type-options
nosniff
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2007
x-xss-protection
0
expires
Wed, 08 Sep 2021 22:25:10 GMT
cast_sender.js
www.gstatic.com/eureka/clank/92/ Frame CDC2 		52 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/eureka/clank/92/cast_sender.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:806::2003 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
347929e823326917ec72df0adfe9a05f12ac69dca63e1c1ff0c9265bd87b1550
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Wed, 08 Sep 2021 19:10:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
11655
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15330
x-xss-protection
0
last-modified
Mon, 14 Jun 2021 15:08:18 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=86400
accept-ranges
bytes
expires
Thu, 09 Sep 2021 19:10:55 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		98 KB
99 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=243&aitags=133%2C134%2C135%2C136%2C160%2C242%2C243%2C244%2C247%2C278&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=video%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=5900025&dur=539.399&lmt=1588606185745071&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5431432&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRgIhAOYAW0kLXJth-Yc50OsOZGs6hgC3Fh4X_9O7iihHYFd2AiEA2LIjEDbt0fp5Z-wI9li4pvI6pqou8oj1AIm6h5972FU%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=102348-202733&rn=3&rbuf=2145
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
35801fafd45c911a5724d37bf7fe8ea9317350246e41ddef73cb31651c4ac36e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:10 GMT
X-Restrict-Formats-Hint
None
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
100386
Last-Modified
Mon, 04 May 2020 15:29:45 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21300
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
X-Content-Type-Options
nosniff
Expires
Wed, 08 Sep 2021 22:25:10 GMT
1
mc.yandex.com/watch/52828042/
Redirect Chain
  • https://mc.yandex.com/watch/52828042?wmode=7&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&page-ref=https%3A%2F%2Fropdas.blogspot.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xt...
  • https://mc.yandex.com/watch/52828042/1?wmode=7&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&page-ref=https%3A%2F%2Fropdas.blogspot.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5...
350 B
432 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/watch/52828042/1?wmode=7&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&page-ref=https%3A%2F%2Fropdas.blogspot.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A631%3Acn%3A1%3Adp%3A0%3Als%3A1229440630567%3Ahid%3A988972808%3Az%3A0%3Ai%3A202109082225010%3Aet%3A1631139910%3Ac%3A1%3Arn%3A681501765%3Arqn%3A1%3Au%3A163113991013197734%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1631139909052%3Ads%3A50%2C32%2C93%2C1%2C664%2C0%2C%2C153%2C13%2C%2C%2C%2C997%3Adsn%3A50%2C32%2C94%2C0%2C664%2C0%2C%2C156%2C14%2C%2C%2C%2C997%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1631139911%3At%3A
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
51e54871e5925ffd5d1aabf103637c1fa844a9084230ef6c7b8d06d6babcfe8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://kof.portalqthmp.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Sep 2021 22:25:10 GMT
x-content-type-options
nosniff
last-modified
Wed, 08-Sep-2021 22:25:10 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://kof.portalqthmp.xyz
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
350
x-xss-protection
1; mode=block
expires
Wed, 08-Sep-2021 22:25:10 GMT

Redirect headers

pragma
no-cache
date
Wed, 08 Sep 2021 22:25:10 GMT
last-modified
Wed, 08-Sep-2021 22:25:10 GMT
location
/watch/52828042/1?wmode=7&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&page-ref=https%3A%2F%2Fropdas.blogspot.com%2F&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afp%3A982%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A631%3Acn%3A1%3Adp%3A0%3Als%3A1229440630567%3Ahid%3A988972808%3Az%3A0%3Ai%3A202109082225010%3Aet%3A1631139910%3Ac%3A1%3Arn%3A681501765%3Arqn%3A1%3Au%3A163113991013197734%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1631139909052%3Ads%3A50%2C32%2C93%2C1%2C664%2C0%2C%2C153%2C13%2C%2C%2C%2C997%3Adsn%3A50%2C32%2C94%2C0%2C664%2C0%2C%2C156%2C14%2C%2C%2C%2C997%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1631139911%3At%3A
strict-transport-security
max-age=31536000
access-control-allow-origin
https://kof.portalqthmp.xyz
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Wed, 08-Sep-2021 22:25:10 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		210 KB
211 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=243&aitags=133%2C134%2C135%2C136%2C160%2C242%2C243%2C244%2C247%2C278&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=video%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=5900025&dur=539.399&lmt=1588606185745071&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5431432&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRgIhAOYAW0kLXJth-Yc50OsOZGs6hgC3Fh4X_9O7iihHYFd2AiEA2LIjEDbt0fp5Z-wI9li4pvI6pqou8oj1AIm6h5972FU%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=202734-418059&rn=4&rbuf=4290
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
18e5adf045167e511771b44404095e34d9fc7e00341c28d0a1515133c6ab1cca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:11 GMT
X-Restrict-Formats-Hint
None
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
215326
Last-Modified
Mon, 04 May 2020 15:29:45 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21299
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
X-Content-Type-Options
nosniff
Expires
Wed, 08 Sep 2021 22:25:11 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		74 KB
75 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=251&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=audio%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=10080577&dur=539.461&lmt=1606639368664253&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5432434&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZRrdeA2PoDFZ1dNGBpSEfpDMOvY6AJNn7VtKruG47q4CIC4UUNRF_3vUzAzxen07LPzUeVt5WWWmqXKdZizFHdBX&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=66717-142137&rn=5&rbuf=4650
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
c392140009b981d8824834d5c3ba4b0f4de5f111142d49bf39d7d8e054cf2064
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:11 GMT
X-Content-Type-Options
nosniff
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
75421
Last-Modified
Sun, 29 Nov 2020 08:42:48 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
audio/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21299
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
Expires
Wed, 08 Sep 2021 22:25:11 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		294 KB
295 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=243&aitags=133%2C134%2C135%2C136%2C160%2C242%2C243%2C244%2C247%2C278&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=video%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=5900025&dur=539.399&lmt=1588606185745071&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5431432&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRgIhAOYAW0kLXJth-Yc50OsOZGs6hgC3Fh4X_9O7iihHYFd2AiEA2LIjEDbt0fp5Z-wI9li4pvI6pqou8oj1AIm6h5972FU%3D&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=418060-718748&rn=6&rbuf=9296
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
67ed9a069e48c57d2b9766fd9d8c99b6617020e5c4d9fcfb980fdb887c222b45
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:11 GMT
X-Restrict-Formats-Hint
None
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
300689
Last-Modified
Mon, 04 May 2020 15:29:45 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
video/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21299
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
X-Content-Type-Options
nosniff
Expires
Wed, 08 Sep 2021 22:25:11 GMT
videoplayback
r3---sn-4g5ednsd.googlevideo.com/ Frame CDC2 		177 KB
178 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3---sn-4g5ednsd.googlevideo.com/videoplayback?expire=1631161510&ei=Rjg5Yc-LIOHysAL6k6OoDw&ip=2001%3Aac8%3A36%3A6%3A20a%3A%3A1&id=o-APzCwGo-A3tZCqEdEa8kvpQjtO9_bWG8GlyEz4tJOiVz&itag=251&source=youtube&requiressl=yes&mh=p3&mm=31%2C26&mn=sn-4g5ednsd%2Csn-2gb7sn7k&ms=au%2Conr&mv=m&mvi=3&pl=48&initcwndbps=387500&vprv=1&mime=audio%2Fwebm&ns=NyjRftaxn1-KNoBx6VL4nSUG&gir=yes&clen=10080577&dur=539.461&lmt=1606639368664253&mt=1631139414&fvip=6&keepalive=yes&fexp=24001373%2C24007246&beids=9466586&c=WEB_EMBEDDED_PLAYER&txp=5432434&n=mAo7XfSky-iuqQ&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgZRrdeA2PoDFZ1dNGBpSEfpDMOvY6AJNn7VtKruG47q4CIC4UUNRF_3vUzAzxen07LPzUeVt5WWWmqXKdZizFHdBX&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIgWg2fXlvRxOWlQbrSf_hgFUN4iE5zoe7m28no_dXIDUECIQDv4WaDMq4C2PljAO6pLzx-nqIDp15RxOgS3v_9L2hYVA%3D%3D&alr=yes&cpn=iu2-Kc3gwAyKq6gl&cver=1.20210905.0.0&range=142138-323320&rn=7&rbuf=10001
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/player_ias.vflset/de_DE/base.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:6e::8 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gvs 1.0 /
Resource Hash
78bc46d9691be3c19fdb37fedbe31c30f781c1121f3fe3a6cdb59f6a6d6152a3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Wed, 08 Sep 2021 22:25:11 GMT
X-Content-Type-Options
nosniff
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Alt-Svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length
181183
Last-Modified
Sun, 29 Nov 2020 08:42:48 GMT
Server
gvs 1.0
Vary
Origin
Content-Type
audio/webm
Access-Control-Allow-Origin
https://www.youtube.com
Access-Control-Expose-Headers
Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control
private, max-age=21299
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Timing-Allow-Origin
https://www.youtube.com
Expires
Wed, 08 Sep 2021 22:25:11 GMT
log_event
www.youtube.com/youtubei/v1/ Frame CDC2 		28 B
200 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/a1c3b4e5/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4007:805::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
0
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/bWj4jfk1Y8A?rel=0&autoplay=1
X-YouTube-Client-Version
1.20210905.0.0
X-YouTube-Time-Zone
Etc/Unknown
X-Goog-Visitor-Id
CgtIUTlQU3FNVGZUbyjG8OSJBg%3D%3D
X-YouTube-Ad-Signals
dt=1631139910328&flash=0&frm=2&u_tz&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C720%2C405&vis=1&wgl=true&ca_type=image&bid=ANyPxKoC90prcDgX31oKNvXHGYdaNG5bmdDRS_-CHwxyZWsW_wbO3pxFsJGe-zSN4l3OY3rCzB8fG4GAXBia3pT_FSijxWKu9A

Response headers

date
Wed, 08 Sep 2021 22:25:12 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Wed, 08 Sep 2021 22:25:12 GMT
52828042
mc.yandex.com/webvisor/ 		43 B
145 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/webvisor/52828042?wmode=0&wv-part=1&wv-hit=988972808&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&rn=934862401&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1631139913%3Aw%3A1600x1200%3Av%3A631%3Az%3A0%3Ai%3A20210908222513%3Au%3A163113991013197734%3Avf%3A25rt5xty9edhsiwjn9%3Awe%3A1%3Ati%3A2%3Ast%3A1631139913
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://kof.portalqthmp.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 08 Sep 2021 22:25:13 GMT
last-modified
Wed, 08-Sep-2021 22:25:13 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://kof.portalqthmp.xyz
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 08-Sep-2021 22:25:13 GMT
52828042
mc.yandex.com/webvisor/ 		43 B
73 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/webvisor/52828042?wmode=0&wv-part=1&wv-hit=988972808&page-url=https%3A%2F%2Fkof.portalqthmp.xyz%2F&rn=666283496&wv-type=3&browser-info=gdpr%3A14%3Aet%3A1631139913%3Aw%3A1600x1200%3Av%3A631%3Az%3A0%3Ai%3A20210908222513%3Au%3A163113991013197734%3Avf%3A25rt5xty9edhsiwjn9%3Awe%3A1%3Ati%3A2%3Ast%3A1631139913
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://kof.portalqthmp.xyz/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 08 Sep 2021 22:25:13 GMT
last-modified
Wed, 08-Sep-2021 22:25:13 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://kof.portalqthmp.xyz
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Wed, 08-Sep-2021 22:25:13 GMT

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster object| plp number| plp_page_id number| plp_content_id string| plp_lang string| lptag function| error_handler object| _trackJs function| ym function| onYouTubeIframeAPIReady object| ytp function| $ function| jQuery function| _ object| Modernizr function| WOW object| store function| sweetAlertInitialize function| swal function| sweetAlert object| stackEffects function| Snowfall function| particlesJS object| jQuery111008828194726523895 object| goodshare object| Ya object| yaCounter52828042

17 Cookies

Domain/Path Name / Value
.pydgmp.xyz/ Name: PHPSESSID
Value: 375b3d983b49dea03c29e6d4b04879fd
.pydgmp.xyz/ Name: u
Value: 444323
.pydgmp.xyz/ Name: o
Value: 44z2y2
.youtube.com/ Name: YSC
Value: y3lzzO9ncFo
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: HQ9PSqMTfTo
.portalqthmp.xyz/ Name: _ym_uid
Value: 163113991013197734
.portalqthmp.xyz/ Name: _ym_d
Value: 1631139910
.doubleclick.net/ Name: IDE
Value: AHWqTUmoBCozRO9Hc6mo-tWVd6Q7DFno5IoO8Qu8t4V3KIPjkJsliQG-M_YqgMUX
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 3449313868fake
.portalqthmp.xyz/ Name: _ym_isad
Value: 2
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 4260042144fake
.yandex.com/ Name: yandexuid
Value: 4628502381631139910
.yandex.com/ Name: yuidss
Value: 4628502381631139910
mc.yandex.com/ Name: yabs-sid
Value: 2377017001631139910
.yandex.com/ Name: i
Value: Y0fxicocPGXxkTMnqCzfSTy1CzeBBg7auE0h9IsEszoJ0qTDfAPZK1Zr9/FT3XrrhFdCj49zWT9gmQjaJ8dwipU8ICg=
.yandex.com/ Name: ymex
Value: 1662675910.yrts.1631139910#1662675910.yrtsi.1631139910
.portalqthmp.xyz/ Name: _ym_visorc
Value: w

1 Console Messages

Source Level URL
Text
network error URL: https://mc.yandex.com/sync_cookie_image_decide?token=9390.kgeA4tNcUck0y6RwHQV2Xza1EzOOtdF3PubcvyfuhT-B92pK3J7b8RWMOuypfZdyj4hyt8k0G2bgPcYHq4JP_A%2C%2C.H-a7lW3JZRmImMqyh7lBTBCt8f4%2C
Message:
Failed to load resource: the server responded with a status of 400 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dermossa.blogspot.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
iugopoas.blogspot.be
iugopoas.blogspot.com
kof.portalqthmp.xyz
mc.yandex.com
mc.yandex.ru
pydgmp.xyz
r3---sn-4g5ednsd.googlevideo.com
resources.blogblog.com
ropdas.blogspot.com
s.plpstatic.ru
www.blogger.com
www.google.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
185.211.246.154
2606:4700:3037::6815:846
2a00:1450:4001:6e::8
2a00:1450:4007:805::2004
2a00:1450:4007:805::200e
2a00:1450:4007:806::2003
2a00:1450:4007:808::2001
2a00:1450:4007:80a::2002
2a00:1450:4007:80b::2009
2a00:1450:4007:80d::2009
2a00:1450:4007:80e::2001
2a00:1450:4007:80e::2016
2a00:1450:4007:816::2003
2a00:1450:4007:818::2001
2a00:1450:4007:81a::2001
2a02:6b8::1:119
85.119.149.96
024063e39183dffe98a786d63df94162aab45445ae372939f6511350c4cf555a
0355e77705a01dceeffdbd08ba6adcb760676eb6aa57025a8ca5704727a166ea
05fd39f96778a9df88f5987a7457a3658fc1ec740ca5962171db5fb26a17e3b8
18e5adf045167e511771b44404095e34d9fc7e00341c28d0a1515133c6ab1cca
1db6a268677e54cf4be9704ccc6ac6e3288f015472211c4127fee25ef6243cad
21f538bb5a3b10b0c6758f5072ca4469075bc6367444dc0bf8c0177617280997
25cd4b3632c9b1622968d1b3de5841c14a3c563dd507da009f14cc06b48b4292
274533f86a530bf9f4ef20a622e84a80456f37f6d649e9e9df76ee548645b380
347929e823326917ec72df0adfe9a05f12ac69dca63e1c1ff0c9265bd87b1550
35801fafd45c911a5724d37bf7fe8ea9317350246e41ddef73cb31651c4ac36e
3813b0e7ef5c9d58a7192a2ee8a7179326327acaec45277a7b812c02a32d91fa
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
46717c032f82e2316c694c6cb20d63d109954cc77e1aeee251dd5b1591915716
490ab4ef6298aaa9f173b3f0d2befbd3b0028114d3b6576c0eb849f42a440248
4a8106ac064e738cd838a7a836bd9527ef3f6b40d9ef44dcdd742c3aef3d818c
4d41b174a1a04819dbbd885b816246344c59231c0d4de9da6f1c6a783534cb27
51e54871e5925ffd5d1aabf103637c1fa844a9084230ef6c7b8d06d6babcfe8f
53f2931d978bf9b24d43b5d556ecf315a6b3f089699c5ba3a954c4dde8663361
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5af2033a9a27ec649db89e93d143bf8e1b300d0abbaf262dd03c21cf8ccae508
5e6f25c73e33c988f6335eeeb5fcb71905d31951e6ad7d8d7d387ea3552e7ba3
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
67ed9a069e48c57d2b9766fd9d8c99b6617020e5c4d9fcfb980fdb887c222b45
687584625fa912e0fd6fec7f0fbee226ba732b64712d1080d06cdb88689d959f
729a9d4c4393bc05195c8c3af40df61bdd92d4ad499749abe0883bbaaf35b423
72c4db2af0f69f216e8d173856d48ffe51288c0ff5b2619bf7fec1819bda817d
78bc46d9691be3c19fdb37fedbe31c30f781c1121f3fe3a6cdb59f6a6d6152a3
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
854730907559703c340fc5234864645f7ea220c2353029576ef8c0816435089c
96e61209b1c1fff1abe78fb763fbf093a04e6e992dc24b299ab1c4c5f4272f16
9e8f00bed071bc169467cc91b1d2d8405ce391f070d10e6c97781c20d4d96170
9f5100ffd6578745c3440e23408336eeef6729c6ddb74879d43d18e72b850b2c
a458644f17e3ebbbc39ea974d6367f5a4970e43a66a82b8422bbc03d80dafd28
b91d5da6549200810597bea0634466333985321138a1ecb148fccaf463ef56f3
c392140009b981d8824834d5c3ba4b0f4de5f111142d49bf39d7d8e054cf2064
cd01185f335d20e75286a45c3c44d4f9af567fff4c78dbf6ec414a60f3c602f8
d36d689bad3f0b4b62a66ae57b271e74848320e5603d6b236ec003aa6306f52c
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d96c18f2222947b7acd2b3511caee509ea0b06bc29cb218d505de134cf454652
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
e35819fd6ad6c769e5a349798e2c6c3d33b4dda2f6017a375fd58eccb37df4b8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9652fbf9dd634b72ba232d4e5614208102648270481b6978bd34431005aa327
ebb74b596db2b91e96e3fd3fe1da9e14fd6b21eaceb585c6a18027bb45e30406
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
faf6afa380be2199fc2b95edc2f11f06493eb4972bdd1f3ca42c8e7c66104b13