yol.tc Open in urlscan Pro
194.1.184.22 Malicious Activity! Public Scan

URL:
http://yol.tc/Outlook-service
Submission: On July 01 via api (July 1st 2021, 1:23:41 pm UTC) from CL

Summary HTTP 39 Redirects Behaviour Indicators

Summary

This website contacted 15 IPs in 4 countries across 12 domains to perform 39 HTTP transactions. The main IP is 194.1.184.22, located in Turkey and belongs to PLUSWEB, TR. The main domain is yol.tc.

This is the only time yol.tc was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
7	194.1.184.22 194.1.184.22	210107 (PLUSWEB) (PLUSWEB)
8	54.36.158.42 54.36.158.42	16276 (OVH) (OVH)
6	178.33.123.218 178.33.123.218	16276 (OVH) (OVH)
1	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
1 2	2600:9000:210... 2600:9000:2104:3200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2620:116:800d... 2620:116:800d:21:51e4:db4b:4436:b305	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
39	15

7 194.1.184.22 (Turkey)

ASN210107 (PLUSWEB, TR)

yol.tc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 54.36.158.42 (France)

ASN16276 (OVH, FR)
PTR: lb.xtgem.com

eui42.jw.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 178.33.123.218 (France)

ASN16276 (OVH, FR)
PTR: d2.xtgem.com

9.thumbs.xtstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xtgem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
disif.images.xtstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cif.images.xtstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States)

ASN16509 (AMAZON-02, US)

edge.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2104:3200:6:44e3:f8c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:51e4:db4b:4436:b305 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	163 KB
8	jw.lt eui42.jw.lt	27 KB
7	yol.tc yol.tc	66 KB
3	quantserve.com 1 redirects edge.quantserve.com pixel.quantserve.com	10 KB
3	xtgem.com xtgem.com	5 KB
3	xtstatic.com 9.thumbs.xtstatic.com disif.images.xtstatic.com cif.images.xtstatic.com	2 KB
2	google.com adservice.google.com www.google.com	926 B
2	doubleclick.net googleads.g.doubleclick.net	5 KB
2	quantcount.com 1 redirects rules.quantcount.com	855 B
1	googletagservices.com www.googletagservices.com	27 KB
1	google.de adservice.google.de	165 B
1	googleadservices.com partner.googleadservices.com	655 B
39	12

	Domain	Requested by
8	eui42.jw.lt	yol.tc eui42.jw.lt
7	yol.tc	yol.tc
6	pagead2.googlesyndication.com	yol.tc pagead2.googlesyndication.com tpc.googlesyndication.com
3	xtgem.com	eui42.jw.lt
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	googleads.g.doubleclick.net	pagead2.googlesyndication.com
2	pixel.quantserve.com	1 redirects eui42.jw.lt
2	rules.quantcount.com	1 redirects eui42.jw.lt
1	www.google.com	tpc.googlesyndication.com
1	www.googletagservices.com	pagead2.googlesyndication.com
1	adservice.google.com	pagead2.googlesyndication.com
1	adservice.google.de	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	cif.images.xtstatic.com	eui42.jw.lt
1	disif.images.xtstatic.com	eui42.jw.lt
1	edge.quantserve.com	eui42.jw.lt
1	9.thumbs.xtstatic.com	eui42.jw.lt
39	17

This site contains no links.

Subject Issuer	Validity	Valid
*.xtgem.com R3	`2021-06-28` - `2021-09-26`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-05-31` - `2021-08-23`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-05-31` - `2021-08-23`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh

This page contains 10 frames:

Primary Page: http://yol.tc/Outlook-service
Frame ID: 546BF7F08097E6B94422F5F0A21DB0C6
Requests: 3 HTTP requests in this frame

Frame: http://yol.tc/framedRedirectTop.php?url=775
Frame ID: 8504FF8EDA050FD690842A64CCC62580
Requests: 14 HTTP requests in this frame

Frame: http://eui42.jw.lt/js/index.html?out=look
Frame ID: EF7E082499304632321D8E750065438A
Requests: 14 HTTP requests in this frame

Frame: http://disif.images.xtstatic.com/tp.gif
Frame ID: C356AD6FB7C4FB5A9F93D6FBEB15F567
Requests: 1 HTTP requests in this frame

Frame: http://cif.images.xtstatic.com/tp.gif
Frame ID: 1B87D248B9BAA4516F39329F39852D68
Requests: 1 HTTP requests in this frame

Frame: https://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9ldWk0Mi5qdy5sdFwvanNcL2luZGV4Lmh0bWw/b3V0PWxvb2siLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJldWk0Mi5qdy5sdCIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=
Frame ID: ABC3FFDB57BC62BEE607DDADAD05FC02
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210628/r20190131/zrt_lookup.html
Frame ID: BCBE92A6115D0EF48D08B7031523762B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2922494028953189&output=html&h=60&slotname=6789653150&adk=2786707073&adf=123856640&pi=t.ma~as.6789653150&w=468&lmt=1625145805&psa=0&format=468x60&url=http%3A%2F%2Fyol.tc%2FframedRedirectTop.php%3Furl%3D775&flash=0&wgl=1&dt=1625145805000&bpp=17&bdt=158&idt=57&shv=r20210628&ptt=9&saldr=aa&correlator=4798721961207&frm=21&ife=1&pv=2&ga_vid=1344507443.1625145805&ga_sid=1625145805&ga_hid=452795645&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1132&ady=0&biw=1600&bih=1200&isw=1600&ish=72&ifk=3835884735&scr_x=0&scr_y=0&eid=31060974%2C31061746%2C31061662&oid=3&pvsid=1549210709472490&top=http%3A%2F%2Fyol.tc%2FOutlook-service&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C72&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=4&bc=23&ifi=1&uci=1.lsth41mm0ki3&fsb=1&xpc=uyF6FbxdWM&p=http%3A//yol.tc&dtd=77
Frame ID: 80A0C0161332568D1117243556EB71CD
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 6D32DDDBD0AC99638B38A7D661E735F2
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0DDD320B7D9C12186AB472E7532FDD35
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

39
Requests

41 %
HTTPS

73 %
IPv6

12
Domains

17
Subdomains

15
IPs

4
Countries

307 kB
Transfer

953 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 18

http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js HTTP 301
https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js

Request Chain 19

http://pixel.quantserve.com/pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-1625145803402;pbcn=u;pbc=;ns=1;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;d=eui42.jw.lt;je=0;sr=1600x1200x24;dst=1;et=1625145803402;tzo=-120;ogl= HTTP 301
https://pixel.quantserve.com/pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-1625145803402;pbcn=u;pbc=;ns=1;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;d=eui42.jw.lt;je=0;sr=1600x1200x24;dst=1;et=1625145803402;tzo=-120;ogl=

39 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set Outlook-service Show response
yol.tc/ 2 KB
1 KB 1859ms
1773ms Document
text/html 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://yol.tc/Outlook-service
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 / PHP/5.6.40
Resource Hash: 47ee0a2e32ab8fe53cc85e8aa6f0ef6612c66696a5c40ec1009f3d186068d6d4

Request headers

Host: yol.tc
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:21:29 GMT
Server: Apache/2
X-Powered-By: PHP/5.6.40
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: shorturl=c3tb184n8g26po9g0rua499nl2; path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 718
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK bootstrap.css
yol.tc/themes/v3/styles/css/ 121 KB
18 KB 86ms
86ms Stylesheet
text/css 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://yol.tc/themes/v3/styles/css/bootstrap.css
Requested by: Host: yol.tc
URL: http://yol.tc/Outlook-service
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 /
Resource Hash: e59179702fff6732311be76961a0b18cd160eb27057b22cfae2d0a567f14345f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yol.tc
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://yol.tc/Outlook-service
Cookie: shorturl=c3tb184n8g26po9g0rua499nl2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yol.tc/Outlook-service
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:21:30 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Oct 2016 15:43:46 GMT
Server: Apache/2
ETag: "1e537-53e98bdee1080-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 17919

GET
H/1.1 200
OK screen.css
yol.tc/themes/v3/styles/ 41 KB
8 KB 156ms
118ms Stylesheet
text/css 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://yol.tc/themes/v3/styles/screen.css
Requested by: Host: yol.tc
URL: http://yol.tc/Outlook-service
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 /
Resource Hash: 180abe7207414d26e3b0e9ed418ca9f79e18d1ebed46d55892e609550f0236f6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yol.tc
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://yol.tc/Outlook-service
Cookie: shorturl=c3tb184n8g26po9g0rua499nl2
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yol.tc/Outlook-service
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:21:30 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Oct 2016 15:43:24 GMT
Server: Apache/2
ETag: "a596-53e98bc9e5f00-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 7872

GET
H/1.1 200
OK framedRedirectTop.php Show response
yol.tc/ Frame 8504 2 KB
1 KB 3172ms
3134ms Document
text/html 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://yol.tc/framedRedirectTop.php?url=775
Requested by: Host: yol.tc
URL: http://yol.tc/Outlook-service
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 / PHP/5.6.40
Resource Hash: 953f0049ed9e60622413f6d8e265d4f99e5029ed23e0380138abf1a8b6dabe01

Request headers

Host: yol.tc
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://yol.tc/Outlook-service
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: shorturl=c3tb184n8g26po9g0rua499nl2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://yol.tc/Outlook-service

Response headers

Date: Thu, 01 Jul 2021 13:21:30 GMT
Server: Apache/2
X-Powered-By: PHP/5.6.40
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 923
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Cookie set index.html Show response
eui42.jw.lt/js/ Frame EF7E 15 KB
5 KB 878ms
784ms Document
text/html 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://eui42.jw.lt/js/index.html?out=look
Requested by: Host: yol.tc
URL: http://yol.tc/Outlook-service
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: a9782e715ad29e5c2e11a9a31ef4ff1ccb2a189dde23792ded5bfe953cc0e074

Request headers

Host: eui42.jw.lt
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://yol.tc/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://yol.tc/

Response headers

Date: Thu, 01 Jul 2021 13:23:21 GMT
Vary: Host,Accept-Encoding
Set-Cookie: _xta_uid=a3891653a92c196f4571ab88b6fe76fa; expires=Sat, 01-Jul-2023 13:23:22 GMT; Max-Age=63072000; path=/; domain=.jw.lt; httponly _xta_vid=3a72e131f2d71986657c002149a638ad-1625145802; expires=Thu, 01-Jul-2021 13:53:22 GMT; Max-Age=1800; path=/; domain=.jw.lt; httponly
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Pragma: no-cache
Expires: Wed, 17 Sep 1975 21:32:10 GMT
Content-Encoding: gzip
Content-Length: 3960
Content-Type: text/html; charset=utf-8
Age: 0
X-Cache: MISS
X-Cache-Hits: 0
Accept-Ranges: bytes
Connection: close

GET
H/1.1 200
OK xtgem_template.css
eui42.jw.lt/ Frame EF7E 26 KB
4 KB 314ms
275ms Stylesheet
text/css 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://eui42.jw.lt/xtgem_template.css?v=1624293210
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: be1a82ba5de4aeb57e3542ab4bc038b50d15235c3c92b165cdbff424c426ee57

Request headers

Referer: http://eui42.jw.lt/js/index.html?out=look
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
Content-Encoding: gzip
Age: 0
Vary: Host,Accept-Encoding
X-Cache: MISS
Content-Type: text/css;charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 4348
X-Cache-Hits: 0

GET
H/1.1 200
OK styles.css
eui42.jw.lt/js/css/ Frame EF7E 2 KB
1 KB 609ms
571ms Stylesheet
text/css 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://eui42.jw.lt/js/css/styles.css
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: 86590fb064dbc16160906ed4a43d789355ee022192b0c70eaec7bcf9343ea53f

Request headers

Referer: http://eui42.jw.lt/js/index.html?out=look
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
Content-Encoding: gzip
Age: 0
Vary: Host,Accept-Encoding
X-Cache: MISS
Content-Type: text/css;charset=UTF-8
Connection: close
Accept-Ranges: bytes
Content-Length: 882
X-Cache-Hits: 0

GET
H/1.1 200
OK logo.png
eui42.jw.lt/js/images/ Frame EF7E 2 KB
3 KB 701ms
662ms Image
image/png 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eui42.jw.lt/js/images/logo.png
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

Referer: http://eui42.jw.lt/js/index.html?out=look
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
X-Ngz: 1
Age: 0
X-Cache: MISS
Content-Type: image/png
Expires: Sat, 31 Jul 2021 13:23:22 GMT
Cache-Control: max-age=2592000
Connection: close
Accept-Ranges: bytes
Content-Length: 2503
X-Cache-Hits: 0

GET
H/1.1 200
OK header_bg.png
eui42.jw.lt/js/images/ Frame EF7E 6 KB
6 KB 413ms
375ms Image
image/png 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eui42.jw.lt/js/images/header_bg.png
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

Referer: http://eui42.jw.lt/js/index.html?out=look
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
X-Ngz: 1
Last-Modified: Mon, 21 Jun 2021 16:44:12 GMT
Age: 0
ETag: "16e0-5c5496214a132"
X-Cache: MISS
Content-Type: image/png
Expires: Sat, 31 Jul 2021 13:23:22 GMT
Cache-Control: max-age=2592000
Connection: close
Accept-Ranges: bytes
Content-Length: 5856
X-Cache-Hits: 0

GET
H/1.1 200
OK icon.png
eui42.jw.lt/js/images/ Frame EF7E 1 KB
2 KB 414ms
375ms Image
image/png 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eui42.jw.lt/js/images/icon.png
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

Referer: http://eui42.jw.lt/js/index.html?out=look
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
X-Ngz: 1
Age: 0
X-Cache: MISS
Content-Type: image/png
Expires: Sat, 31 Jul 2021 13:23:22 GMT
Cache-Control: max-age=2592000
Connection: close
Accept-Ranges: bytes
Content-Length: 1441
X-Cache-Hits: 0

GET
H/1.1 200
OK the-soda-pop-14984.jpg
9.thumbs.xtstatic.com/100/50/-/91a39b4cdfcd4a2c027f149ab2280554/backtooldschool.xtgem.com/images/blog/ Frame EF7E 1 KB
2 KB 207ms
153ms Image
image/jpeg 178.33.123.218
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://9.thumbs.xtstatic.com/100/50/-/91a39b4cdfcd4a2c027f149ab2280554/backtooldschool.xtgem.com/images/blog/the-soda-pop-14984.jpg
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 178.33.123.218 , France, ASN16276 (OVH, FR),
Reverse DNS: d2.xtgem.com
Software: /
Resource Hash: a56c2742e8ef13ee898402efb4deff555aafa6c0fc6941f2baaac03618891542

Request headers

Referer: http://eui42.jw.lt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
X-Ngz: 1
Last-Modified: Sat, 26 Oct 2019 06:40:38 GMT
Age: 0
ETag: "4e7-0"
Sent-XS: 0.000
X-Cache: MISS
Content-Type: image/jpeg
Expires: Sat, 03 Jul 2021 13:23:22 GMT
Cache-Control: max-age=172800, pre-check=172800
Connection: close
Accept-Ranges: bytes
Content-Length: 1255
X-Cache-Hits: 0

GET
H/1.1 200
OK page_templates_simple.js Show response
xtgem.com/js/ Frame EF7E 982 B
802 B 137ms
97ms Script
application/javascript 178.33.123.218
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://xtgem.com/js/page_templates_simple.js
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 178.33.123.218 , France, ASN16276 (OVH, FR),
Reverse DNS: d2.xtgem.com
Software: /
Resource Hash: 5b3002cada011b91348a429587aa8197d10f3557b68a485195a2dcc1ffcacc6f

Request headers

Referer: http://eui42.jw.lt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:22 GMT
Content-Encoding: gzip
Last-Modified: Sat, 16 Nov 2019 11:03:28 GMT
Age: 0
ETag: "3d6-59774aa04e000-gzip"
Vary: Accept-Encoding
X-Cache: MISS
Content-Type: application/javascript
Expires: Sat, 31 Jul 2021 13:23:22 GMT
Cache-Control: max-age=2592000
Connection: close
Accept-Ranges: bytes
Content-Length: 409
X-Cache-Hits: 0

GET
H/1.1 200
OK quant.js Show response
edge.quantserve.com/ Frame EF7E 24 KB
9 KB 16ms
8ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://edge.quantserve.com/quant.js
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: http://eui42.jw.lt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
Content-Encoding: gzip
Etag: "WhyxmPkT7L77qVDcrjxwGw=="
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: private, max-age=604800
Transfer-Encoding: chunked
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Accept-Ranges: bytes
Expires: Thu, 08 Jul 2021 13:23:23 GMT

GET
H/1.1 200
OK tp.gif Show response
disif.images.xtstatic.com/ Frame C356 42 B
368 B 150ms
96ms Document
image/gif 178.33.123.218
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://disif.images.xtstatic.com/tp.gif
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 178.33.123.218 , France, ASN16276 (OVH, FR),
Reverse DNS: d2.xtgem.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Host: disif.images.xtstatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://eui42.jw.lt/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://eui42.jw.lt/

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
Last-Modified: Sat, 16 Nov 2019 11:03:28 GMT
ETag: "2a-59774aa04e000"
Content-Length: 42
Cache-Control: max-age=2592000
Expires: Sat, 31 Jul 2021 13:23:23 GMT
Content-Type: image/gif
Age: 0
X-Cache: MISS
X-Cache-Hits: 0
Accept-Ranges: bytes
Connection: close

GET
H/1.1 200
OK tp.gif Show response
cif.images.xtstatic.com/ Frame 1B87 42 B
368 B 133ms
94ms Document
image/gif 178.33.123.218
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://cif.images.xtstatic.com/tp.gif
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 178.33.123.218 , France, ASN16276 (OVH, FR),
Reverse DNS: d2.xtgem.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Host: cif.images.xtstatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://eui42.jw.lt/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://eui42.jw.lt/

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
Last-Modified: Sat, 16 Nov 2019 11:03:28 GMT
ETag: "2a-59774aa04e000"
Content-Length: 42
Cache-Control: max-age=2592000
Expires: Sat, 31 Jul 2021 13:23:23 GMT
Content-Type: image/gif
Age: 0
X-Cache: MISS
X-Cache-Hits: 0
Accept-Ranges: bytes
Connection: close

GET
H/1.1 200
OK Cookie set __xt_authbar Show response
xtgem.com/ Frame ABC3 14 KB
3 KB 1006ms
844ms Document
text/html 178.33.123.218
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9ldWk0Mi5qdy5sdFwvanNcL2luZGV4Lmh0bWw/b3V0PWxvb2siLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJldWk0Mi5qdy5sdCIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.33.123.218 , France, ASN16276 (OVH, FR),
Reverse DNS: d2.xtgem.com
Software: /
Resource Hash: 44df5db6ee644931b57c73c8f035168f340f847ad19e5c2f411b6ce5c3f14334

Request headers

Host: xtgem.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://eui42.jw.lt/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://eui42.jw.lt/

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: session=w4~o5olnqv1mvu7s0rm5pi1h4q7d6; expires=Fri, 02-Jul-2021 13:23:23 GMT; Max-Age=86400; path=/; domain=.xtgem.com; httponly __template=web; expires=Sat, 31-Jul-2021 13:23:23 GMT; Max-Age=2592000; path=/ __lang=us; expires=Sat, 31-Jul-2021 13:23:23 GMT; Max-Age=2592000; path=/
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2778
Content-Type: text/html; charset=UTF-8
Age: 0
X-Cache: MISS
X-Cache-Hits: 0
Accept-Ranges: bytes

GET
H/1.1 200
OK bg.png
eui42.jw.lt/js/images/ Frame EF7E 1 KB
2 KB 1135ms
1091ms Image
image/png 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eui42.jw.lt/js/images/bg.png
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/css/styles.css
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: 6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

Referer: http://eui42.jw.lt/js/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
X-Ngz: 1
Age: 0
X-Cache: MISS
Content-Type: image/png
Expires: Sat, 31 Jul 2021 13:23:23 GMT
Cache-Control: max-age=2592000
Connection: close
Accept-Ranges: bytes
Content-Length: 1434
X-Cache-Hits: 0

GET
H/1.1 200
OK f1.woff
eui42.jw.lt/js/faces/ Frame EF7E 4 KB
5 KB 1061ms
1029ms Font
application/octet-stream 54.36.158.42
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://eui42.jw.lt/js/faces/f1.woff
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/css/styles.css
Protocol: HTTP/1.1
Server: 54.36.158.42 , France, ASN16276 (OVH, FR),
Reverse DNS: lb.xtgem.com
Software: /
Resource Hash: 9393c54f1f8c5d9e1a755636d86edf69dcdff13513bcbcb75a5d2e49c5463617

Request headers

Origin: http://eui42.jw.lt
Referer: http://eui42.jw.lt/js/css/styles.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
Last-Modified: Mon, 21 Jun 2021 16:57:24 GMT
Age: 0
ETag: "11d0-5c549914bc975"
X-Cache: MISS
Content-Type: application/octet-stream
Connection: close
Accept-Ranges: bytes
Content-Length: 4560
X-Cache-Hits: 0

GET
H/1.1 200
OK close2.png
xtgem.com/images/ Frame EF7E 564 B
902 B 133ms
94ms Image
image/png 178.33.123.218
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xtgem.com/images/close2.png?v=0.01
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: HTTP/1.1
Server: 178.33.123.218 , France, ASN16276 (OVH, FR),
Reverse DNS: d2.xtgem.com
Software: /
Resource Hash: bc5dcb35fc074321d66b9d7809e286e4afe72c7b08d1e799672126c92150ecd3

Request headers

Referer: http://eui42.jw.lt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
X-Ngz: 1
Last-Modified: Sat, 16 Nov 2019 11:03:28 GMT
Age: 0
ETag: "234-59774aa04e000"
X-Cache: MISS
Content-Type: image/png
Expires: Sat, 31 Jul 2021 13:23:23 GMT
Cache-Control: max-age=2592000
Connection: close
Accept-Ranges: bytes
Content-Length: 564
X-Cache-Hits: 0

GET
H2

200

rules-p-0cfM8Oh7M9bVQ.js Show response
rules.quantcount.com/ Frame EF7E
Redirect Chain

http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js
https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js

3 B
429 B

43ms
13ms

Script
application/javascript

2600:9000:2104:3200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js
Requested by: Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:3200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: http://eui42.jw.lt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 30 Jun 2021 18:58:24 GMT
via: 1.1 bf5caee39117de5337c47c748b716e80.cloudfront.net (CloudFront)
age: 66299
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:40:53 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: AMS1-C1
accept-ranges: bytes
x-amz-cf-id: qpSNGJXK3nrmXOgVyh5QokwxC0ZLJwze5YVZzNEn5-w8c09B_73Uzg==

Redirect headers

Date: Thu, 01 Jul 2021 13:23:23 GMT
Via: 1.1 7f71f5258c6bbee046a26011fbbfa997.cloudfront.net (CloudFront)
Server: CloudFront
X-Amz-Cf-Pop: AMS1-C1
X-Cache: Redirect from cloudfront
Content-Type: text/html
Location: https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js
Connection: keep-alive
Content-Length: 183
X-Amz-Cf-Id: 8zcLkkUQla6eLKcZgTT93avqCxVTXz9lOi1ExhMvDDvDuN7G_aHvTw==

GET
H2

200

pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-1625145803402;pbcn=u;pbc=;ns=1;ce=1;qj...
pixel.quantserve.com/ Frame EF7E
Redirect Chain

http://pixel.quantserve.com/pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-1625145803...
https://pixel.quantserve.com/pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-162514580...

35 B
373 B

23ms
9ms

Image
image/gif

2620:116:800d:21:51e4:db4b:4436:b305
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-1625145803402;pbcn=u;pbc=;ns=1;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;d=eui42.jw.lt;je=0;sr=1600x1200x24;dst=1;et=1625145803402;tzo=-120;ogl=

Requested by

Host: eui42.jw.lt
URL: http://eui42.jw.lt/js/index.html?out=look

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:51e4:db4b:4436:b305 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: http://eui42.jw.lt/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jul 2021 13:23:23 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

Redirect headers

Location: https://pixel.quantserve.com/pixel;r=2109978593;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Feui42.jw.lt%2Fjs%2Findex.html%3Fout%3Dlook;ref=http%3A%2F%2Fyol.tc%2F;uht=2;fpan=1;fpa=P0-459169984-1625145803402;pbcn=u;pbc=;ns=1;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;d=eui42.jw.lt;je=0;sr=1600x1200x24;dst=1;et=1625145803402;tzo=-120;ogl=
Date: Thu, 01 Jul 2021 13:23:23 GMT
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 0
Expires: Fri, 02 Jul 2021 13:23:23 GMT

GET
H/1.1 200
OK bootstrap.css
yol.tc/themes/v3/styles/css/ Frame 8504 121 KB
18 KB 81ms
80ms Stylesheet
text/css 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://yol.tc/themes/v3/styles/css/bootstrap.css
Requested by: Host: yol.tc
URL: http://yol.tc/framedRedirectTop.php?url=775
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 /
Resource Hash: e59179702fff6732311be76961a0b18cd160eb27057b22cfae2d0a567f14345f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yol.tc
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://yol.tc/framedRedirectTop.php?url=775
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yol.tc/framedRedirectTop.php?url=775
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:21:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Oct 2016 15:43:46 GMT
Server: Apache/2
ETag: "1e537-53e98bdee1080-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 17919

GET
H/1.1 200
OK screen.css
yol.tc/themes/v3/styles/ Frame 8504 41 KB
8 KB 154ms
115ms Stylesheet
text/css 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://yol.tc/themes/v3/styles/screen.css
Requested by: Host: yol.tc
URL: http://yol.tc/framedRedirectTop.php?url=775
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 /
Resource Hash: 180abe7207414d26e3b0e9ed418ca9f79e18d1ebed46d55892e609550f0236f6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yol.tc
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://yol.tc/framedRedirectTop.php?url=775
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yol.tc/framedRedirectTop.php?url=775
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:21:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Oct 2016 15:43:24 GMT
Server: Apache/2
ETag: "a596-53e98bc9e5f00-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 7872

GET
H/1.1 200
OK adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8504 135 KB
48 KB 31ms
24ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: yol.tc
URL: http://yol.tc/framedRedirectTop.php?url=775

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31f21cea1e77ebbc5c403518be04795b70fccf496ae7d705d74a77005743ffda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Thu, 01 Jul 2021 13:23:24 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 4826160477689554439
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 48730
X-XSS-Protection: 0
Expires: Thu, 01 Jul 2021 13:23:24 GMT

GET
H/1.1 200
OK blue.png
yol.tc/themes/v3/images/logo/ Frame 8504 12 KB
12 KB 152ms
113ms Image
image/png 194.1.184.22
PLUSWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://yol.tc/themes/v3/images/logo/blue.png
Requested by: Host: yol.tc
URL: http://yol.tc/framedRedirectTop.php?url=775
Protocol: HTTP/1.1
Server: 194.1.184.22 , Turkey, ASN210107 (PLUSWEB, TR),
Reverse DNS
Software: Apache/2 /
Resource Hash: 4915305748c2750e4a8228ac479fa9a84dc7625773b12a7e120dd89d138247c3

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: yol.tc
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://yol.tc/framedRedirectTop.php?url=775
Connection: keep-alive
Cache-Control: no-cache
Referer: http://yol.tc/framedRedirectTop.php?url=775
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Thu, 01 Jul 2021 13:21:34 GMT
Last-Modified: Thu, 20 Oct 2016 11:34:41 GMT
Server: Apache/2
ETag: "2fe3-53f4a4fb5d640"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=100
Content-Length: 12259

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210628/r20190131/ Frame BCBE 10 KB
5 KB 6ms
5ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210628/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210628/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://yol.tc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://yol.tc/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 30 Jun 2021 18:41:57 GMT
expires: Wed, 14 Jul 2021 18:41:57 GMT
content-type: text/html; charset=UTF-8
etag: 15579341980913220427
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4579
x-xss-protection: 0
age: 67287
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20210628/r20190131/ Frame 8504 240 KB
89 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210628/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2922494028953189&plah=yol.tc&amaexp=1&bust=exp%3D31061746

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e233a147eb1f2dc7932e22c7199051febacd3246e31ee3cb3675db87dec8c042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91162
x-xss-protection: 0
server: cafe
etag: 13729711335453486071
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 01 Jul 2021 13:23:25 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ Frame 8504 196 B
655 B 179ms
61ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=yol.tc&callback=_gfp_s_&client=ca-pub-2922494028953189

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20210628/r20190131/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2922494028953189&plah=yol.tc&amaexp=1&bust=exp%3D31061746

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

404bf3da3ece2593c315435ab7d5df6d45106735eaace645c2d347e83d48c4b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 189
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 8504 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=yol.tc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 8504 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=yol.tc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 400 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 80A0 603 B
67 B 39ms
37ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2922494028953189&output=html&h=60&slotname=6789653150&adk=2786707073&adf=123856640&pi=t.ma~as.6789653150&w=468&lmt=1625145805&psa=0&format=468x60&url=http%3A%2F%2Fyol.tc%2FframedRedirectTop.php%3Furl%3D775&flash=0&wgl=1&dt=1625145805000&bpp=17&bdt=158&idt=57&shv=r20210628&ptt=9&saldr=aa&correlator=4798721961207&frm=21&ife=1&pv=2&ga_vid=1344507443.1625145805&ga_sid=1625145805&ga_hid=452795645&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1132&ady=0&biw=1600&bih=1200&isw=1600&ish=72&ifk=3835884735&scr_x=0&scr_y=0&eid=31060974%2C31061746%2C31061662&oid=3&pvsid=1549210709472490&top=http%3A%2F%2Fyol.tc%2FOutlook-service&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C72&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=4&bc=23&ifi=1&uci=1.lsth41mm0ki3&fsb=1&xpc=uyF6FbxdWM&p=http%3A//yol.tc&dtd=77

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2922494028953189&output=html&h=60&slotname=6789653150&adk=2786707073&adf=123856640&pi=t.ma~as.6789653150&w=468&lmt=1625145805&psa=0&format=468x60&url=http%3A%2F%2Fyol.tc%2FframedRedirectTop.php%3Furl%3D775&flash=0&wgl=1&dt=1625145805000&bpp=17&bdt=158&idt=57&shv=r20210628&ptt=9&saldr=aa&correlator=4798721961207&frm=21&ife=1&pv=2&ga_vid=1344507443.1625145805&ga_sid=1625145805&ga_hid=452795645&ga_fc=0&nhd=1&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1132&ady=0&biw=1600&bih=1200&isw=1600&ish=72&ifk=3835884735&scr_x=0&scr_y=0&eid=31060974%2C31061746%2C31061662&oid=3&pvsid=1549210709472490&top=http%3A%2F%2Fyol.tc%2FOutlook-service&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C72&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=4&bc=23&ifi=1&uci=1.lsth41mm0ki3&fsb=1&xpc=uyF6FbxdWM&p=http%3A//yol.tc&dtd=77
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://yol.tc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://yol.tc/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 01 Jul 2021 13:23:25 GMT
server: cafe
content-length: 46
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 01-Jul-2021 13:38:25 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8504 72 KB
27 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29d592e34e3d2c8ca0c55ceafd75940de79cdb6381d8ceb372d226e7820e7220

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1624879999447392"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27719
x-xss-protection: 0
expires: Thu, 01 Jul 2021 13:23:25 GMT

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ Frame 8504 0
459 B 39ms
39ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=adfil-imp&wp=ca-pub-2922494028953189&c=8&n=0&t=0&w=0&x=1

Requested by

Host: yol.tc
URL: http://yol.tc/framedRedirectTop.php?url=775

Protocol

HTTP/1.1

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jul 2021 13:23:25 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 8504 10 KB
8 KB 28ms
28ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210628&st=env

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68a4026cc4dc6c5df10ed80b42497abf708161b01130f8f440727ee66ee63360

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7986
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 8504 17 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 13:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Thu, 01 Jul 2021 13:23:25 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 6D32 12 KB
5 KB 16ms
14ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://yol.tc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://yol.tc/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Thu, 01 Jul 2021 13:16:14 GMT
expires: Fri, 01 Jul 2022 13:16:14 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 0DDD 783 B
761 B 24ms
24ms Document
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

10f3af4bc803d6bfd4f42303c11df56d986851b5ffc54dd6b47d439479611898

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cVKipq91Ulp89P2h386Hig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://yol.tc/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: http://yol.tc/

Response headers

expires: Thu, 01 Jul 2021 13:23:25 GMT
date: Thu, 01 Jul 2021 13:23:25 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-cVKipq91Ulp89P2h386Hig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 DbygjneaO4DVyaaVGwd-ToFDSMFkJodatxAyqShhIKw.js Show response
pagead2.googlesyndication.com/bg/ Frame 6D32 14 KB
6 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/DbygjneaO4DVyaaVGwd-ToFDSMFkJodatxAyqShhIKw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0dbca08e779a3b80d5c9a6951b077e4e814348c16426875ab71032a9286120ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Jul 2021 11:14:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5767
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 16:28:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 01 Jul 2022 11:14:48 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8504 0
20 B 41ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210628&jk=1549210709472490&bg=!_P-l_7vNAAYo4NJEKOA7ACkAdvg8Wt2FeZAqturNTNCj2frWIBDAxMGO9q9epqx7Glcx6-Joi7S_EQIAAABoUgAAAAxoAQcKAEQOz5ZPOQFSwEB7qfwnL5H61R7t4GFjrzoWUf5hI0lC4ct8DnzfgE0CgE2xggAjs4Ww1nWi10k0eoITcjDufjK3fGKbLpkCY_wvfYMNKuQIj9vLPKhdpKINZfITFA6v40RZlNVch-yKQCaY2WItN_yAKhNlgMGZCcyUiLzd78PZ0K9zWUWjY47NQQR0R1Y8LtJodmEOx8m42JPx2ZhxrUh15rra4fE7tOwX9ywwmqCOB5WMDLRuRMwf7hwlWxGAUMqCbhvWU2WKvnT6TzpAY1TECHQ6zVVFkIF9rCGoFFR7nWuwcNSgr1KeTIYIMxQbYSMB76IR24jj9-a0SGAuera16-9vWu_WMYy0lUliCWdoz7mlvhUPmL8da-vI3-M1yd1arXkjCQz7N_H85gsoHP6ajuGl1ac4R7NuiysSBRybQ-mCcFCH3eyAsVRe7ro76HdrgOsH3BVWMnuKrf-MHpdIVM1Uf2FO1DDUvhrTazM6_IkQLhRslPFR1s4JB-dYqnpc_GLZPCI7tCAWmRw92dvRMZ9yRniFet0mqguB-CJ0-bDzKLkdpKvJ8-198M4D5u8WKQys04kZB8x1Oj3gii_XrM3nk98idWdjOmT97WeH0KRZ-JIDHcPJI1yYB_pFlN8C9cLTfcMAcvc1RVa62bhT-jEEU1q8h-tQ5TWsrclFcUcPHapdVrQjRaCWoI4quIob9amG-aTLBuUDiOO6TkNQ9RINQpO9dvOh-trh1uMqiNkM4AgqXIyRiAtCwfhq2JoQls6n51CbGwZPgAEOpRFpSss7weCJJ2maC5HImitIcvym_7ls6l3kIw5XnoJbJjJ9RVa1k8oKfa1-OHW_gCXdima91xFyW8viX2lA1r83YjtpKavhVhjdynFN3-EWeJ_jJjT2V4WyRG14

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://yol.tc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jul 2021 13:23:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.doubleclick.net/	1970-01-19 19:25:46	Name: test_cookie Value: CheckForPermission
			.yol.tc/	1970-01-20 04:47:21	Name: __gads Value: ID=97a4342adea8dd7a-22df8bde4ec900b2:T=1625145805:RT=1625145805:S=ALNI_MayXrwZgctWVb9Fg2HaAkYAF0rpyg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9.thumbs.xtstatic.com
adservice.google.com
adservice.google.de
cif.images.xtstatic.com
disif.images.xtstatic.com
edge.quantserve.com
eui42.jw.lt
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.quantserve.com
rules.quantcount.com
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
xtgem.com
yol.tc
142.250.185.66
178.33.123.218
194.1.184.22
2600:9000:2104:3200:6:44e3:f8c0:93a1
2620:116:800d:21:51e4:db4b:4436:b305
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1450:4001:808::2002
2a00:1450:4001:809::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2004
2a00:1450:4001:813::2002
2a00:1450:4001:827::2001
2a00:1450:4001:827::2002
2a00:1450:4001:828::2002
54.36.158.42
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
0dbca08e779a3b80d5c9a6951b077e4e814348c16426875ab71032a9286120ac
10f3af4bc803d6bfd4f42303c11df56d986851b5ffc54dd6b47d439479611898
180abe7207414d26e3b0e9ed418ca9f79e18d1ebed46d55892e609550f0236f6
20b3bad1427e2212dd847357841f993f025b5061c4af1d382dcc727e102cc1e4
29d592e34e3d2c8ca0c55ceafd75940de79cdb6381d8ceb372d226e7820e7220
31f21cea1e77ebbc5c403518be04795b70fccf496ae7d705d74a77005743ffda
404bf3da3ece2593c315435ab7d5df6d45106735eaace645c2d347e83d48c4b2
44df5db6ee644931b57c73c8f035168f340f847ad19e5c2f411b6ce5c3f14334
47ee0a2e32ab8fe53cc85e8aa6f0ef6612c66696a5c40ec1009f3d186068d6d4
4915305748c2750e4a8228ac479fa9a84dc7625773b12a7e120dd89d138247c3
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5b3002cada011b91348a429587aa8197d10f3557b68a485195a2dcc1ffcacc6f
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
68a4026cc4dc6c5df10ed80b42497abf708161b01130f8f440727ee66ee63360
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
86590fb064dbc16160906ed4a43d789355ee022192b0c70eaec7bcf9343ea53f
9393c54f1f8c5d9e1a755636d86edf69dcdff13513bcbcb75a5d2e49c5463617
953f0049ed9e60622413f6d8e265d4f99e5029ed23e0380138abf1a8b6dabe01
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a56c2742e8ef13ee898402efb4deff555aafa6c0fc6941f2baaac03618891542
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a9782e715ad29e5c2e11a9a31ef4ff1ccb2a189dde23792ded5bfe953cc0e074
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
bc5dcb35fc074321d66b9d7809e286e4afe72c7b08d1e799672126c92150ecd3
be1a82ba5de4aeb57e3542ab4bc038b50d15235c3c92b165cdbff424c426ee57
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e233a147eb1f2dc7932e22c7199051febacd3246e31ee3cb3675db87dec8c042
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e59179702fff6732311be76961a0b18cd160eb27057b22cfae2d0a567f14345f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

yol.tc Open in urlscan Pro 194.1.184.22 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

39 Requests

41 %HTTPS

73 %IPv6

12 Domains

17 Subdomains

15 IPs

4 Countries

307 kBTransfer

953 kBSize

2 Cookies

0 Outgoing links

Redirected requests

39 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

yol.tc Open in urlscan Pro
194.1.184.22 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

39
Requests

41 %
HTTPS

73 %
IPv6

12
Domains

17
Subdomains

15
IPs

4
Countries

307 kB
Transfer

953 kB
Size

2
Cookies

39 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!