urlscan.io logo urlscan.io
SecurityTrails logo

50g.ksl32.xyz Open in urlscan Pro
2a06:98c1:3121::3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://50g.ksl32.xyz/step2.php#1678549171628
Effective URL: https://50g.ksl32.xyz/step2.php
Submission: On March 11 via manual from MY — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 11 domains to perform 24 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is 50g.ksl32.xyz.
TLS certificate: Issued by GTS CA 1P5 on March 7th 2023. Valid for: 3 months.
This is the only time 50g.ksl32.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 2a06:98c1:312... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
7 14 146.75.116.193 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
2 103.235.46.191 55967 (BAIDU Bei...)
3 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
24 10
5    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
50g.ksl32.xyz
4g.xr58.xyz
2    2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
14    146.75.116.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
i.imgur.com
1    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700:3033::6815:6aa (United States)

ASN13335 (CLOUDFLARENET, US)
jm52.xyz
1    2606:4700:3033::ac43:b865 (United States)

ASN13335 (CLOUDFLARENET, US)
4g.kazi0.xyz
1    2606:4700:3035::ac43:db8b (United States)

ASN13335 (CLOUDFLARENET, US)
uv83.xyz
2    103.235.46.191 (Hong Kong)

ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN)
hm.baidu.com
3    2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
Apex Domain
Subdomains		 Transfer
14 imgur.com
i.imgur.com — Cisco Umbrella Rank: 6053
5 KB
4 ksl32.xyz
50g.ksl32.xyz
149 KB
3 gstatic.com
fonts.gstatic.com
54 KB
2 baidu.com
hm.baidu.com — Cisco Umbrella Rank: 8479
12 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34
1 KB
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2388
253 B
1 xr58.xyz
4g.xr58.xyz
34 KB
1 uv83.xyz
uv83.xyz
34 KB
1 kazi0.xyz
4g.kazi0.xyz
34 KB
1 jm52.xyz
jm52.xyz
34 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 42
82 KB
24 11
Domain Requested by
14 i.imgur.com 7 redirects 50g.ksl32.xyz
4 50g.ksl32.xyz 50g.ksl32.xyz
3 fonts.gstatic.com fonts.googleapis.com
2 hm.baidu.com 50g.ksl32.xyz
2 fonts.googleapis.com 50g.ksl32.xyz
1 region1.google-analytics.com www.googletagmanager.com
1 4g.xr58.xyz 50g.ksl32.xyz
1 uv83.xyz 50g.ksl32.xyz
1 4g.kazi0.xyz 50g.ksl32.xyz
1 jm52.xyz 50g.ksl32.xyz
1 www.googletagmanager.com 50g.ksl32.xyz
24 11

This site contains no links.

Subject Issuer Validity Valid
*.ksl32.xyz
GTS CA 1P5		 2023-03-07 -
2023-06-05		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-05-14 -
2023-05-13		 a year crt.sh
*.kazi0.xyz
GTS CA 1P5		 2023-03-09 -
2023-06-07		 3 months crt.sh
baidu.com
GlobalSign RSA OV SSL CA 2018		 2022-07-05 -
2023-08-06		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-02-20 -
2023-05-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://50g.ksl32.xyz/step2.php
Frame ID: 4ADBC95F10470943BCFD959911E09E77
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Education Support Program

Detected technologies

Overall confidence: 100%
Detected patterns
  • hm\.baidu\.com/hm\.js
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

24
Requests

71 %
HTTPS

80 %
IPv6

11
Domains

11
Subdomains

10
IPs

3
Countries

439 kB
Transfer

927 kB
Size

7
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://i.imgur.com/g6cV61A.png HTTP 302
  • https://i.imgur.com/removed.png
Request Chain 6
  • https://i.imgur.com/0UHB1f0.png HTTP 302
  • https://i.imgur.com/removed.png
Request Chain 7
  • https://i.imgur.com/sSMYbTT.png HTTP 302
  • https://i.imgur.com/removed.png
Request Chain 8
  • https://i.imgur.com/NiqWOfU.jpg HTTP 302
  • https://i.imgur.com/removed.png
Request Chain 9
  • https://i.imgur.com/xGDBDEM.jpg HTTP 302
  • https://i.imgur.com/removed.png
Request Chain 10
  • https://i.imgur.com/QXVecld.jpg HTTP 302
  • https://i.imgur.com/removed.png
Request Chain 11
  • https://i.imgur.com/D3BlBjV.jpg HTTP 302
  • https://i.imgur.com/removed.png

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request step2.php
50g.ksl32.xyz/ 		19 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://50g.ksl32.xyz/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1dc47de0d87d72bc972deb77987d650c61eb9285d85469d4b3c230b54266ebcf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7a652d9b4d27d0c5-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 11 Mar 2023 16:29:46 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D9G9lM8wR8nS%2BuKyQwuF%2FfxfXtPOe58q3rSJDor4IWPsSyNwTM7lCOH1fDbtqz1gdvAZou2mvi2kbQOsicT1Uh%2FOg9SkrMbxXGVK3idCbl9Un0O%2FjH3uoFhMZXYloG8FY3yd6GVa2hA8Zt9e"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
jquery.min.js
50g.ksl32.xyz/js/ 		94 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://50g.ksl32.xyz/js/jquery.min.js
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/step2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 02 Mar 2023 09:13:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2687
etag
W/"640068c9-1762e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CiiuZPxhJTq4vTPcow%2BCAg53tgP1NFpzL8mwr76VgU9RWYo06b9Kjv18GvwhV8pTWw1nngfll0%2BJSK8zYubAFhgyws%2FurMyqu3SWLaN2eYO8zUd9iutW8Ny2PEuJ9719uZv29XGHhTXKZnxF"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7a652d9c5e97d0c5-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 12 Mar 2023 03:44:59 GMT
cookie.min.js
50g.ksl32.xyz/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://50g.ksl32.xyz/js/cookie.min.js
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4bb84dfa6c01e1710e8d5e808560fa8fc651370ea31cb015d9ffd951c861bda

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/step2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 02 Mar 2023 09:13:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
10485
etag
W/"640068c9-a30"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h%2FIst9g0M07K%2F1SsCtrwlD5B7Ix5T1%2BWuwxjmuR6QP7Ulpd6y%2F6KFe6wf2znTi9jm4yP55n%2BQ82RKW4MkIVQVJEz4RNyd9T6A7B9MvSgd1eJTVQpflopFh45WwJl%2FMypors8ikyhFWlJb6Jy"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7a652d9c5ea1d0c5-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 12 Mar 2023 01:35:01 GMT
css2
fonts.googleapis.com/ 		2 KB
637 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Poppins:wght@500;700&display=swap
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
842be935d39dcb195e58cafdaf280ac1088b22e48538b4946fe4fb18e9852706
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 11 Mar 2023 16:29:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 11 Mar 2023 16:29:46 GMT
droidarabicnaskh.css
fonts.googleapis.com/earlyaccess/ 		1 KB
624 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/earlyaccess/droidarabicnaskh.css
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0facd387627530907acc0b41d7076a1313a748ba84d37983618c04f2e66f1849
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
expires
Sat, 11 Mar 2023 16:29:46 GMT
klq.jpg
50g.ksl32.xyz/images/ 		107 KB
107 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://50g.ksl32.xyz/images/klq.jpg
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c9fb542b9815c49abac2a695cdb8fe909386012b4646e4c40acd5abb877ad3e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/step2.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
140315
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
109472
last-modified
Thu, 02 Mar 2023 09:13:46 GMT
server
cloudflare
etag
"640068ca-1aba0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=syMd%2BLP3owuMVFYItCzChV5MO7P%2Fr180X3oiKHa%2Bi9%2FC2T3DU12yWrHxToAJwNqdmm8IyeLf%2FEBP8SKvY%2BVd4QQb8bkH0XPLEa0wG9JUFz5lQyvkTEWsqd%2BcVET6NL0xaRSHqbgFYJOrRxnE"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
cf-ray
7a652d9cbc1c1af8-AMS
expires
Sun, 09 Apr 2023 01:31:11 GMT
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/g6cV61A.png
  • https://i.imgur.com/removed.png
503 B
578 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.468888,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318545

Redirect headers

x-cache-hits
0, 1
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
26
x-timer
S1678552186.435213,VS0,VE1
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kiad7000138-IAD, cache-fra-eddf8230103-FRA
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/0UHB1f0.png
  • https://i.imgur.com/removed.png
503 B
824 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.468334,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318541

Redirect headers

x-cache-hits
0, 2
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
69
x-timer
S1678552186.434414,VS0,VE0
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kcgs7200178-IAD, cache-fra-eddf8230103-FRA
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/sSMYbTT.png
  • https://i.imgur.com/removed.png
503 B
578 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.468596,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318543

Redirect headers

x-cache-hits
0, 2
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
54
x-timer
S1678552186.434727,VS0,VE0
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kjyo7100155-IAD, cache-fra-eddf8230103-FRA
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/NiqWOfU.jpg
  • https://i.imgur.com/removed.png
503 B
578 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.469137,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318546

Redirect headers

x-cache-hits
0, 4
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
373
x-timer
S1678552186.434376,VS0,VE0
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kiad7000086-IAD, cache-fra-eddf8230103-FRA
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/xGDBDEM.jpg
  • https://i.imgur.com/removed.png
503 B
565 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.468874,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318545

Redirect headers

x-cache-hits
0, 2
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
142
x-timer
S1678552186.434326,VS0,VE2
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kcgs7200053-IAD, cache-fra-eddf8230103-FRA
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/QXVecld.jpg
  • https://i.imgur.com/removed.png
503 B
565 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.468461,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318543

Redirect headers

x-cache-hits
0, 2
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
137
x-timer
S1678552186.434334,VS0,VE0
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kjyo7100178-IAD, cache-fra-eddf8230103-FRA
removed.png
i.imgur.com/
Redirect Chain
  • https://i.imgur.com/D3BlBjV.jpg
  • https://i.imgur.com/removed.png
503 B
578 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/removed.png
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Server
146.75.116.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
age
30962674
x-cache
HIT, HIT
content-length
503
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230103-FRA
last-modified
Wed, 14 May 2014 05:44:36 GMT
server
cat factory 1.0
x-timer
S1678552186.498334,VS0,VE0
etag
"d835884373f4d6c8f24742ceabe74946"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-cache-hits
23848, 318547

Redirect headers

x-cache-hits
0, 2
date
Sat, 11 Mar 2023 16:29:46 GMT
strict-transport-security
max-age=300
server
cat factory 1.0
age
121
x-timer
S1678552186.465773,VS0,VE0
x-cache
HIT, HIT
access-control-allow-methods
GET, OPTIONS
location
https://i.imgur.com/removed.png
access-control-allow-origin
*
accept-ranges
bytes
content-length
0
retry-after
0
x-served-by
cache-iad-kiad7000146-IAD, cache-fra-eddf8230103-FRA
js
www.googletagmanager.com/gtag/ 		242 KB
82 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-NBT1TSK6X5
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
471742e3330d24a3ec28822ea751eb6f7e23e62d856a2456524ceed5f7ac82d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
83724
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 11 Mar 2023 16:29:46 GMT
jquery.min.js
jm52.xyz/js/ 		94 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jm52.xyz/js/jquery.min.js?_=1678552186334
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/js/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:6aa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 02 Mar 2023 09:13:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"640068c9-1762e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4unZqwS%2B%2BGZAA1PNJ7w2ptnAhYoyQMez1kZhb8vtv7JPlkWGRxfeOD8Xb2QhPmXFQ6ZxCz6QnqaBviD72%2F9eXEekz3Uq229r%2FqYf%2Babg8Xbh4GaZFW6zlN5REn3UWXLgsF6auYEJ7Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7a652d9d8d15b8f4-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 12 Mar 2023 04:29:46 GMT
jquery.min.js
4g.kazi0.xyz/js/ 		94 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://4g.kazi0.xyz/js/jquery.min.js?_=1678552186335
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/js/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:b865 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 02 Mar 2023 09:13:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"640068c9-1762e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8LAzJ%2BLnFs4elZiraQLSY%2BSRkyUv%2BbnbVSSsE8IT6YIC0flFTZbR076MW4ajdeBnvh5adJNJEfNB2o6i%2F7SoIjKI9y57TGxDXD6Eg1mgM3XE%2BuRpPbUhPavVAVJ86nnALjqsA0cXCNa%2BKDM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7a652d9d8eb7b891-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 12 Mar 2023 04:29:46 GMT
jquery.min.js
uv83.xyz/js/ 		94 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://uv83.xyz/js/jquery.min.js?_=1678552186336
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/js/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::ac43:db8b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 02 Mar 2023 09:13:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"640068c9-1762e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CJwDKXPxaDRIERng6Zv5J38uHYHASq5m9fvfYCyrDNP%2BfAbZon3jdlft04qorCVOihRfW%2F5pdYO0aQuCYFQEMnCx53enCXjuJ%2BJB5ZKMbVyj2KFyhWfI9NMl%2FLwUf33czmfm7Ezgnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7a652d9dad619ba0-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 12 Mar 2023 04:29:46 GMT
jquery.min.js
4g.xr58.xyz/js/ 		94 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://4g.xr58.xyz/js/jquery.min.js?_=1678552186337
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/js/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 11 Mar 2023 16:29:46 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 02 Mar 2023 09:13:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"640068c9-1762e"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GOdtFw%2BUmqSO%2FY85VmEepEitM6i%2BS71mugBzJxf98ZmTsWumehAnMuQSIkuaAiCiMR5JNKXK1HVQvbv54HVhdPtOkDD%2BT47YzjVX4DBuf%2BHEzEJw%2BvUrOhOXBR6P9akrgogesvN0%2Bb%2Bkng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=43200
cf-ray
7a652d9e19020b04-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
Sun, 12 Mar 2023 04:29:46 GMT
hm.js
hm.baidu.com/ 		29 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hm.baidu.com/hm.js?96d553200d356105f31d0144e46133a0
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),
Reverse DNS
Software
apache /
Resource Hash
162dcaa0fc9f7d812431dd9cc6753ddc213ca4dd4004e154f3ac646fb7d6c9af
Security Headers
Name Value
Strict-Transport-Security max-age=172800

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 11 Mar 2023 16:29:47 GMT
Content-Encoding
gzip
Strict-Transport-Security
max-age=172800
Server
apache
Etag
a1940b9b1cfbff375e3683dde37927ff
P3p
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Content-Type
application/javascript
Cache-Control
max-age=0, must-revalidate
Content-Length
11257
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@500;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://50g.ksl32.xyz
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Fri, 10 Mar 2023 13:58:42 GMT
x-content-type-options
nosniff
age
95464
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7748
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:21:30 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 09 Mar 2024 13:58:42 GMT
pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@500;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://50g.ksl32.xyz
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 18:44:14 GMT
x-content-type-options
nosniff
age
251132
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
7816
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:11:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 07 Mar 2024 18:44:14 GMT
DroidNaskh-Regular.woff2
fonts.gstatic.com/ea/droidarabicnaskh/v7/ 		38 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/ea/droidarabicnaskh/v7/DroidNaskh-Regular.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/earlyaccess/droidarabicnaskh.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
68b4ac5833d4474ef046db5c1495c5b70c16f6fe6f219656dbb7129b8faeed20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://50g.ksl32.xyz
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Wed, 08 Mar 2023 16:37:03 GMT
x-content-type-options
nosniff
age
258763
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39220
x-xss-protection
0
last-modified
Wed, 13 Aug 2014 16:50:04 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
vary
Accept-Encoding
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 07 Mar 2024 16:37:03 GMT
collect
region1.google-analytics.com/g/ 		0
253 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-NBT1TSK6X5&gtm=45je3360&_p=736069579&cid=1227891892.1678552187&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1678552186&sct=1&seg=0&dl=https%3A%2F%2F50g.ksl32.xyz%2Fstep2.php&dt=Education%20Support%20Program&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-NBT1TSK6X5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 11 Mar 2023 16:29:46 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://50g.ksl32.xyz
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
hm.gif
hm.baidu.com/ 		43 B
299 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1600x1200&vl=1200&et=0&ja=0&ln=en-us&lo=0&rnd=2068342898&si=96d553200d356105f31d0144e46133a0&v=1.3.0&lv=1&sn=4233&r=0&ww=1600&u=https%3A%2F%2F50g.ksl32.xyz%2Fstep2.php%231678552186901&tt=Education%20Support%20Program
Requested by
Host: 50g.ksl32.xyz
URL: https://50g.ksl32.xyz/step2.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
103.235.46.191 , Hong Kong, ASN55967 (BAIDU Beijing Baidu Netcom Science and Technology Co., Ltd., CN),
Reverse DNS
Software
apache /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=172800
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://50g.ksl32.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 11 Mar 2023 16:29:48 GMT
Strict-Transport-Security
max-age=172800
X-Content-Type-Options
nosniff
Server
apache
Content-Type
image/gif
Cache-Control
private, max-age=0, no-cache
Content-Length
43

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery function| Cookies number| timeleft number| downloadTimer number| time number| likes number| comments number| shares string| text1 string| text2 string| text3 string| error string| abcde string| saved string| share object| swidth number| width function| hh function| jp function| fh object| _hmt function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal boolean| _bdhm_loaded_96d553200d356105f31d0144e46133a0 object| mini_tangram_log_v5e51e

7 Cookies

Domain/Path Name / Value
50g.ksl32.xyz/ Name: loclang
Value: nl
.ksl32.xyz/ Name: _ga_NBT1TSK6X5
Value: GS1.1.1678552186.1.0.1678552186.0.0.0
.ksl32.xyz/ Name: _ga
Value: GA1.1.1227891892.1678552187
50g.ksl32.xyz/ Name: jumpurl
Value: 4g.kazi0.xyz
.hm.baidu.com/ Name: HMACCOUNT_BFESS
Value: D045C7BB0884D894
.50g.ksl32.xyz/ Name: Hm_lvt_96d553200d356105f31d0144e46133a0
Value: 1678552188
.50g.ksl32.xyz/ Name: Hm_lpvt_96d553200d356105f31d0144e46133a0
Value: 1678552188