Submitted URL: https://payments.winstonbenefits.com/
Effective URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Submission: On June 01 via manual from US — Scanned from DE

Summary

This website contacted 16 IPs in 5 countries across 14 domains to perform 44 HTTP transactions. The main IP is 209.235.242.188, located in United States and belongs to ASN-FLEXENTIAL, US. The main domain is payv3.xpress-pay.com. The Cisco Umbrella rank of the primary domain is 598613.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on February 21st 2024. Valid for: a year.
This is the only time payv3.xpress-pay.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

Apex Domain
Subdomains
Transfer
17 xpress-pay.com
pay.xpress-pay.com — Cisco Umbrella Rank: 856651
payv3.xpress-pay.com — Cisco Umbrella Rank: 598613
enroll.xpress-pay.com — Cisco Umbrella Rank: 472827
201 KB
4 google.de
www.google.de — Cisco Umbrella Rank: 7810
300 B
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
362 KB
3 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3095
www.google.com — Cisco Umbrella Rank: 2
384 B
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 345
14 KB
3 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 89
479 B
3 trust-provider.com
secure.trust-provider.com — Cisco Umbrella Rank: 44197
20 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 32
21 KB
2 sectigo.com
sectigo.com — Cisco Umbrella Rank: 1186
www.sectigo.com — Cisco Umbrella Rank: 135576
4 KB
2 gstatic.com
www.gstatic.com
23 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
85 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 126
20 B
1 tctm.co
282236.tctm.co — Cisco Umbrella Rank: 681573
466 B
1 winstonbenefits.com
payments.winstonbenefits.com
309 B
44 14
Domain Requested by
14 payv3.xpress-pay.com 1 redirects payv3.xpress-pay.com
4 www.google.de payv3.xpress-pay.com
4 www.googletagmanager.com payv3.xpress-pay.com
www.google-analytics.com
www.googletagmanager.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
payv3.xpress-pay.com
3 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
3 secure.trust-provider.com payv3.xpress-pay.com
3 www.google-analytics.com payv3.xpress-pay.com
www.google-analytics.com
2 www.gstatic.com www.googletagmanager.com
www.gstatic.com
2 www.google.com payv3.xpress-pay.com
2 enroll.xpress-pay.com payv3.xpress-pay.com
2 cdnjs.cloudflare.com payv3.xpress-pay.com
cdnjs.cloudflare.com
1 www.googleadservices.com 1 redirects
1 www.sectigo.com payv3.xpress-pay.com
1 sectigo.com 1 redirects
1 region1.analytics.google.com www.googletagmanager.com
1 282236.tctm.co www.googletagmanager.com
1 pay.xpress-pay.com 1 redirects
1 payments.winstonbenefits.com 1 redirects
44 18

This site contains links to these domains. Also see Links.

Domain
www.visa.com
Subject Issuer Validity Valid
*.xpress-pay.com
Sectigo RSA Organization Validation Secure Server CA
2024-02-21 -
2025-02-20
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
*.google-analytics.com
WR2
2024-05-13 -
2024-08-05
3 months crt.sh
secure.trust-provider.com
Sectigo RSA Organization Validation Secure Server CA
2024-02-03 -
2025-02-02
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2024-05-13 -
2024-08-05
3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 02
2024-05-01 -
2024-06-27
2 months crt.sh
*.tctm.co
Amazon RSA 2048 M02
2023-08-08 -
2024-09-03
a year crt.sh
*.google.de
WR2
2024-05-13 -
2024-08-05
3 months crt.sh
*.google.com
WR2
2024-05-13 -
2024-08-05
3 months crt.sh
*.gstatic.com
WR2
2024-05-13 -
2024-08-05
3 months crt.sh

This page contains 1 frames:

Primary Page: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Frame ID: 20A5969ECDCA1AE0BCE02C0AA16C956F
Requests: 44 HTTP requests in this frame

Screenshot

Page Title

Xpress-pay | Pay a bill

Page URL History Show full URLs

  1. https://payments.winstonbenefits.com/ HTTP 302
    https://pay.xpress-pay.com/?pk=13255 HTTP 302
    https://payv3.xpress-pay.com/pt/185194d6ac9b43c0b988443bc0d71c81 HTTP 302
    https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • /yii\.(?:validation|activeForm)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

44
Requests

95 %
HTTPS

47 %
IPv6

14
Domains

18
Subdomains

16
IPs

5
Countries

729 kB
Transfer

1874 kB
Size

16
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://payments.winstonbenefits.com/ HTTP 302
    https://pay.xpress-pay.com/?pk=13255 HTTP 302
    https://payv3.xpress-pay.com/pt/185194d6ac9b43c0b988443bc0d71c81 HTTP 302
    https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38
  • https://sectigo.com/images/seals/sectigo_trust_seal_md_2x.png HTTP 301
  • https://www.sectigo.com/images/seals/sectigo_trust_seal_md_2x.png
Request Chain 41
  • https://www.googleadservices.com/pagead/conversion/859136470/wcm?cc=ZZ&dn=6077536156&cl=3i2qCIjW424Q1sPVmQM&dma=1&dma_cps=sypham&npa=1&ct_eid=2 HTTP 302
  • https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=6077536156&cl=3i2qCIjW424Q1sPVmQM&dma=1&dma_cps=sypham

44 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 185194d6ac9b43c0b988443bc0d71c81
payv3.xpress-pay.com/bill/search/
Redirect Chain
  • https://payments.winstonbenefits.com/
  • https://pay.xpress-pay.com/?pk=13255
  • https://payv3.xpress-pay.com/pt/185194d6ac9b43c0b988443bc0d71c81
  • https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
31 KB
10 KB
Document
General
Full URL
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
d4b2d44b9b2afc075ed56446eaccfc49955a3d1488489f2cd0c7e7e3343915c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options ALLOWALL
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Encoding
gzip
Content-Length
9222
Content-Type
text/html; charset=UTF-8
Date
Sat, 01 Jun 2024 17:23:06 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
P3p
CP="P3P is here to make Internet Explorer happy."
Pragma
no-cache
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding,User-Agent
X-Frame-Options
ALLOWALL
X-Robots-Tag
noindex, nofollow
X-XSS-Protection
1; mode=block

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sat, 01 Jun 2024 17:23:06 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=100
Location
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Pragma
no-cache
Server
Apache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Transfer-Encoding
chunked
Vary
User-Agent
X-Frame-Options
SAMEORIGIN
X-Robots-Tag
noindex, nofollow
X-XSS-Protection
1; mode=block
bootstrap.min.css
payv3.xpress-pay.com/assets/b430252c/css/
158 KB
24 KB
Stylesheet
General
Full URL
https://payv3.xpress-pay.com/assets/b430252c/css/bootstrap.min.css
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:06 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"279d8-60f9c5c49f828-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=98
Content-Length
24186
X-XSS-Protection
1; mode=block
activeform.min.css
payv3.xpress-pay.com/assets/e23181ee/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://payv3.xpress-pay.com/assets/e23181ee/css/activeform.min.css
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
2fe555ade512f20a939fff0f535b283c8f155683c4885174d723983f065b8695
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"1638-60f9c5c495418-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=100
Content-Length
1614
X-XSS-Protection
1; mode=block
remarc.css
payv3.xpress-pay.com/css/
9 KB
3 KB
Stylesheet
General
Full URL
https://payv3.xpress-pay.com/css/remarc.css
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
035e9e52caefd0f6358e6ce22a4b97e9961b46ece80418d4bca8e9c719fc171a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Sun, 10 Sep 2023 12:17:32 GMT
Server
Apache
ETag
"25b9-6050031b2c83e-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=100
Content-Length
2768
X-XSS-Protection
1; mode=block
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.9.0/css/
55 KB
10 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.9.0/css/all.min.css
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:06 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
244179
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
9939
last-modified
Mon, 04 May 2020 16:10:08 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e60-da9f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yqK3b5%2FaPf4GhrlHzi4uXJYDdYlarBEbsrzHCPX7lNu8ZbPhqdPqnEUUHBo1NV7KmxT%2BmBUykXSpoVLfbLu9b8984y3WZ7UZn3vVWmsqT3dY2o6EUFtnl2w6AU6iyiwGh7zJdh8h"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88d0e3bfad6535eb-FRA
expires
Thu, 22 May 2025 17:23:06 GMT
16415901-banner.png
enroll.xpress-pay.com/images/banners/
8 KB
8 KB
Image
General
Full URL
https://enroll.xpress-pay.com/images/banners/16415901-banner.png
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.237.45 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
syseast-xpcinf1.inetuhosted.net
Software
Apache /
Resource Hash
c5a845fdf1d9fae832851cbf5ea39609a7adb67df32f9fefa6a5308841635f58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Pragma
no-cache
Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Thu, 05 Aug 2021 20:18:46 GMT
Server
Apache
ETag
"1fd1-5c8d5a04ffbf8"
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
8145
X-XSS-Protection
1; mode=block
Expires
0
poweredbyxpc.png
enroll.xpress-pay.com/images/banners/
3 KB
3 KB
Image
General
Full URL
https://enroll.xpress-pay.com/images/banners/poweredbyxpc.png
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.237.45 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
syseast-xpcinf1.inetuhosted.net
Software
Apache /
Resource Hash
9bba86ca6dbbaf462776c44649fa3336807bac345cc4c424fb1d0268388c0294
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Pragma
no-cache
Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
Last-Modified
Wed, 10 Jan 2024 14:35:16 GMT
Server
Apache
ETag
"bc0-60e9856eb4826"
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
3008
X-XSS-Protection
1; mode=block
Expires
0
visa-on-the-list-2023.png
payv3.xpress-pay.com/images/
20 KB
21 KB
Image
General
Full URL
https://payv3.xpress-pay.com/images/visa-on-the-list-2023.png
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
d469de82275c49ce8bcac7d5802649331e870e9a8b1153a7bb6c45d58a90e7ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Sun, 10 Sep 2023 00:55:27 GMT
Server
Apache
ETag
"508a-604f6aa6bd8db"
Vary
User-Agent
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=99
Content-Length
20618
X-XSS-Protection
1; mode=block
jquery.min.js
payv3.xpress-pay.com/assets/4f062366/
85 KB
30 KB
Script
General
Full URL
https://payv3.xpress-pay.com/assets/4f062366/jquery.min.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"155ed-60f9c5c4930f0-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=99
Content-Length
30362
X-XSS-Protection
1; mode=block
yii.js
payv3.xpress-pay.com/assets/8314ff45/
20 KB
6 KB
Script
General
Full URL
https://payv3.xpress-pay.com/assets/8314ff45/yii.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
995516724f69e24ddf82e9279a65d50a6f64a2c325226f7133bda794d6bf79a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"51d9-60f9c5c495800-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=97
Content-Length
5828
X-XSS-Protection
1; mode=block
yii.activeForm.js
payv3.xpress-pay.com/assets/8314ff45/
36 KB
8 KB
Script
General
Full URL
https://payv3.xpress-pay.com/assets/8314ff45/yii.activeForm.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
b156192d2524056dbc8af028d8a71dfb5a74346ccc5a0910ef98182005762a1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"9046-60f9c5c495800-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=100
Content-Length
7454
X-XSS-Protection
1; mode=block
bootstrap.min.js
payv3.xpress-pay.com/assets/b430252c/js/
61 KB
15 KB
Script
General
Full URL
https://payv3.xpress-pay.com/assets/b430252c/js/bootstrap.min.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
423217abf8775cea2dc30fa1fe3e1c5e24dc359a80f1c37ad29a86094bfe81d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:18 GMT
Server
Apache
ETag
"f463-60f9c5c4c70f8-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=100
Content-Length
15319
X-XSS-Protection
1; mode=block
activeform.min.js
payv3.xpress-pay.com/assets/e23181ee/js/
3 KB
2 KB
Script
General
Full URL
https://payv3.xpress-pay.com/assets/e23181ee/js/activeform.min.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
d166ff5857b8fe37b3adc77ec8d4b85525667b3e02fd1bd4e2039f89a23b5a1c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"d17-60f9c5c495418-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=100
Content-Length
1400
X-XSS-Protection
1; mode=block
yii.validation.js
payv3.xpress-pay.com/assets/8314ff45/
17 KB
4 KB
Script
General
Full URL
https://payv3.xpress-pay.com/assets/8314ff45/yii.validation.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
9123ef5cf89cdb1ee2e6db82eb04ff97e874de65e8db71ddba2e66fde522ac06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Last-Modified
Tue, 23 Jan 2024 12:48:17 GMT
Server
Apache
ETag
"4413-60f9c5c495800-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=98
Content-Length
3359
X-XSS-Protection
1; mode=block
gtm.js
www.googletagmanager.com/
290 KB
100 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PWQZPFP
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
873ca9de6254fa33a975e169a188a48a2c975f4ca07afce54a16212a44d06ee1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
102150
x-xss-protection
0
last-modified
Sat, 01 Jun 2024 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 01 Jun 2024 17:23:07 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 01 Jun 2024 16:29:08 GMT
last-modified
Tue, 12 Dec 2023 18:09:08 GMT
server
Golfe2
age
3239
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Sat, 01 Jun 2024 18:29:08 GMT
trustlogo.js
secure.trust-provider.com/trustlogo/javascript/
14 KB
14 KB
Script
General
Full URL
https://secure.trust-provider.com/trustlogo/javascript/trustlogo.js
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.199.212.148 , United Kingdom, ASN48447 (SECTIGO, GB),
Reverse DNS
secure.trust-provider.com
Software
/
Resource Hash
1ba30b444f0489b7da1ca80092c7879835ba96404751aabbdb2647de4261fa05
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Mon, 20 May 2024 10:00:52 GMT
accept-ranges
bytes
etag
"664b1f54-3709"
content-length
14089
content-type
application/javascript
bcbg.jpg
payv3.xpress-pay.com/images/
47 KB
47 KB
Image
General
Full URL
https://payv3.xpress-pay.com/images/bcbg.jpg
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/css/remarc.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
efff1fac9b76d309a52009564f02a9f996fcabf055a6501c1d7502f1e1e80169
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/css/remarc.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:07 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 22 Aug 2019 01:55:30 GMT
Server
Apache
ETag
"bb80-590aafbfc2880"
Vary
User-Agent
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=96
Content-Length
48000
X-XSS-Protection
1; mode=block
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.9.0/webfonts/
74 KB
74 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.9.0/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.9.0/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.9.0/css/all.min.css
Origin
https://payv3.xpress-pay.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
247709
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
75440
last-modified
Mon, 04 May 2020 16:10:08 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e60-126b0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ky49iaQHoLA%2FaN%2FfT4Q5Y9WNz0O7iGZb82IJiEQ7bpdgsPEySqU7ekNG4uJm5hlqu4f5IzHpxEK0d3zFwHjnovBHOq6OfcNHiF1wWCR%2B4u3WPfmWrA56vQ3alIvUpTegCSAQhns"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
88d0e3c1ff7bbbd9-FRA
expires
Thu, 22 May 2025 17:23:07 GMT
collect
www.google-analytics.com/j/
16 B
226 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2126608698&t=pageview&_s=1&dl=https%3A%2F%2Fpayv3.xpress-pay.com%2Fbill%2Fsearch%2F185194d6ac9b43c0b988443bc0d71c81&ul=de-de&de=UTF-8&dt=Xpress-pay%20%7C%20Pay%20a%20bill&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1379588830&gjid=728415503&cid=772509848.1717262587&tid=UA-50558733-1&_gid=1297858577.1717262587&_r=1&_slc=1&z=511765521
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
ff464d717510921b1c1e70a3cf53f7c02c015b0248cb5105199cd219b0e2b02a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://payv3.xpress-pay.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
16
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
353 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-50558733-1&cid=772509848.1717262587&jid=1379588830&gjid=728415503&_gid=1297858577.1717262587&_u=IEBAAEAAAAAAACAAI~&z=1288114283
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://payv3.xpress-pay.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.googletagmanager.com/gtag/
279 KB
96 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-MKG7PGX06R&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5bdd0a80d4667c00218ac28fff6bdf2beb51380f94363bfdeb94cbe88ca0ceb2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
98405
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 01 Jun 2024 17:23:07 GMT
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=2126608698&t=pageview&_s=1&dl=https%3A%2F%2Fpayv3.xpress-pay.com%2Fbill%2Fsearch%2F185194d6ac9b43c0b988443bc0d71c81&ul=de-de&de=UTF-8&dt=Xpress-pay%20%7C%20Pay%20a%20bill&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAACAAI~&jid=675094871&gjid=261579828&cid=772509848.1717262587&tid=UA-50558733-2&_gid=1297858577.1717262587&_r=1&_slc=1&gtm=45He45t0n81PWQZPFPv77133950za200&gcd=13l3l3l2l1&dma_cps=sypham&dma=1&npa=1&z=1112920626
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.239.38.178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://payv3.xpress-pay.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
bat.js
bat.bing.com/
45 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWQZPFP
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Sat, 01 Jun 2024 17:23:07 GMT
last-modified
Thu, 29 Feb 2024 19:58:06 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B312497BB2AD4A92B447E0471FD0225D Ref B: FRA31EDGE0118 Ref C: 2024-06-01T17:23:07Z
etag
"01b4e9c496bda1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13261
destination
www.googletagmanager.com/gtag/
234 KB
83 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-859136470&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWQZPFP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ea266491d88bdfffc93e8646558deab901b75a27117830d2ec804e12ae21be72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
84862
x-xss-protection
0
last-modified
Sat, 01 Jun 2024 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 01 Jun 2024 17:23:07 GMT
js
www.googletagmanager.com/gtag/
234 KB
83 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-859136470
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWQZPFP
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.104 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s49-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
e230e13197ba47834a5665e500f5cc79413cad6af245533173960f1ba11951ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
84919
x-xss-protection
0
last-modified
Sat, 01 Jun 2024 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 01 Jun 2024 17:23:07 GMT
t.js
282236.tctm.co/
1 B
466 B
Script
General
Full URL
https://282236.tctm.co/t.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PWQZPFP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223d:a000:12:de4a:40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ctm /
Resource Hash
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
content-encoding
gzip
via
1.1 e94c77a12a65a84cbcef7856ed7e0fb8.cloudfront.net (CloudFront)
last-modified
Sat, 01 Jun 2024 17:23:07 GMT
server
ctm
x-amz-cf-pop
FRA56-P3
etag
W/665b58fb00044e7c8cee5ec4-282236
x-cache
Miss from cloudfront
content-type
application/x-javascript
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=86400
x-amz-cf-id
QVyt4EX4v5z8COhMo6xdA1jBR4v8SUeZ9AHkNXdlGuEqoYYAhPjQbA==
collect
stats.g.doubleclick.net/j/
4 B
70 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-50558733-2&cid=772509848.1717262587&jid=675094871&gjid=261579828&_gid=1297858577.1717262587&npa=1&_u=aEDAAEABAAAAACAAI~&z=114634563
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://payv3.xpress-pay.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.analytics.google.com/g/
0
258 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-MKG7PGX06R&_ng=1&gtm=45je45t0v9134465847za200&_p=1717262587118&_gaz=1&gcd=13l3l3l2l2&npa=0&dma_cps=sypham&dma=1&ul=de-de&sr=1600x1200&cid=772509848.1717262587&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B125.0.6422.112%7CChromium%3B125.0.6422.112%7CNot.A%252FBrand%3B24.0.0.0&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_eu=ABAI&_s=1&dl=https%3A%2F%2Fpayv3.xpress-pay.com%2Fbill%2Fsearch%2F185194d6ac9b43c0b988443bc0d71c81&dt=Xpress-pay%20%7C%20Pay%20a%20bill&sid=1717262587&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=4227
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MKG7PGX06R&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://payv3.xpress-pay.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
56 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-MKG7PGX06R&cid=772509848.1717262587&gtm=45je45t0v9134465847za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l2&npa=0&frm=0
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-MKG7PGX06R&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://payv3.xpress-pay.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-MKG7PGX06R&cid=772509848.1717262587&gtm=45je45t0v9134465847za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l2&npa=0&frm=0&z=2054657999
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-50558733-1&cid=772509848.1717262587&jid=1379588830&_u=IEBAAEAAAAAAACAAI~&z=1114896203
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-50558733-1&cid=772509848.1717262587&jid=1379588830&_u=IEBAAEAAAAAAACAAI~&z=1114896203
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-50558733-2&cid=772509848.1717262587&jid=675094871&npa=1&_u=aEDAAEABAAAAACAAI~&z=348211771
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.68 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f4.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-50558733-2&cid=772509848.1717262587&jid=675094871&npa=1&_u=aEDAAEABAAAAACAAI~&z=348211771
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
loader.js
www.gstatic.com/wcm/
6 KB
3 KB
Script
General
Full URL
https://www.gstatic.com/wcm/loader.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-859136470
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
670f77f11cb4c747f5de1affa5b53687cf7a20d1eaf99b0ef5c9c60858aefa55
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:13:29 GMT
content-encoding
br
x-content-type-options
nosniff
age
578
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2133
x-xss-protection
0
last-modified
Wed, 20 Mar 2024 23:18:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Sat, 01 Jun 2024 18:13:29 GMT
134596622.js
bat.bing.com/p/action/
0
117 B
Script
General
Full URL
https://bat.bing.com/p/action/134596622.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Sat, 01 Jun 2024 17:23:07 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 314C9F5A2C584D2B8ABA4D1D91B4B874 Ref B: FRA31EDGE0118 Ref C: 2024-06-01T17:23:07Z
x-cache
CONFIG_NOCACHE
seal_bg.gif
secure.trust-provider.com/trustlogo/images/popup/
5 KB
5 KB
Image
General
Full URL
https://secure.trust-provider.com/trustlogo/images/popup/seal_bg.gif
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.199.212.148 , United Kingdom, ASN48447 (SECTIGO, GB),
Reverse DNS
secure.trust-provider.com
Software
/
Resource Hash
6a8d73fd166e03d8e1c024ac60d01d9110c4ac56b45f5bb402739e4095d4a95b
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Mon, 20 May 2024 10:00:53 GMT
accept-ranges
bytes
etag
"664b1f55-12f3"
content-length
4851
content-type
image/gif
warranty_level.gif
secure.trust-provider.com/trustlogo/images/popup/
713 B
892 B
Image
General
Full URL
https://secure.trust-provider.com/trustlogo/images/popup/warranty_level.gif
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
91.199.212.148 , United Kingdom, ASN48447 (SECTIGO, GB),
Reverse DNS
secure.trust-provider.com
Software
/
Resource Hash
e45902c0c28d8a669a37a61914c1eb760b093f7cc2d41693d52f82327329218d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
strict-transport-security
max-age=15724800; includeSubDomains
last-modified
Mon, 20 May 2024 10:02:10 GMT
accept-ranges
bytes
etag
"664b1fa2-2c9"
content-length
713
content-type
image/gif
sectigo_trust_seal_md_2x.png
www.sectigo.com/images/seals/
Redirect Chain
  • https://sectigo.com/images/seals/sectigo_trust_seal_md_2x.png
  • https://www.sectigo.com/images/seals/sectigo_trust_seal_md_2x.png
4 KB
4 KB
Image
General
Full URL
https://www.sectigo.com/images/seals/sectigo_trust_seal_md_2x.png
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Server
2606:4700::6811:a44b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8a52e591f079061ede00df3d349fc7354b304514eb69c323cce18dbc4709a90

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://payv3.xpress-pay.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Sat, 01 Jun 2024 17:23:08 GMT
cf-cache-status
HIT
last-modified
Wed, 15 May 2024 09:41:37 GMT
server
cloudflare
age
101932
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=2592000
accept-ranges
bytes
cf-ray
88d0e3c74b203718-FRA
content-length
3957
expires
Mon, 01 Jul 2024 17:23:08 GMT

Redirect headers

location
https://www.sectigo.com/images/seals/sectigo_trust_seal_md_2x.png
date
Sat, 01 Jun 2024 17:23:07 GMT
server
nginx
content-length
162
x-ccacdn-proxy-id
mcdpinlb3
x-frame-options
SAMEORIGIN
content-type
text/html
0
bat.bing.com/action/
0
288 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134596622&tm=gtm002&Ver=2&mid=cc11ded8-7e59-4223-b91d-463aab639488&sid=9cbcee40203b11ef9c9e370f35c3a8cd&vid=9cbd0ba0203b11ef9062435971353008&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Xpress-pay%20%7C%20Pay%20a%20bill&p=https%3A%2F%2Fpayv3.xpress-pay.com%2Fbill%2Fsearch%2F185194d6ac9b43c0b988443bc0d71c81&r=&lt=4399&evt=pageLoad&sv=1&rn=446355
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 01 Jun 2024 17:23:07 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 8FDD7575626B485F95BE5AF07D6242E5 Ref B: FRA31EDGE0118 Ref C: 2024-06-01T17:23:07Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
call-tracking_9.js
www.gstatic.com/call-tracking/
62 KB
21 KB
Script
General
Full URL
https://www.gstatic.com/call-tracking/call-tracking_9.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6d8f8fd6de0b42e3acc7b2f3005c599e9f54d21355c3d6850a5c13daca10d5ad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 01 Jun 2024 14:01:22 GMT
content-encoding
br
x-content-type-options
nosniff
age
12105
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-telephony
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20777
x-xss-protection
0
last-modified
Mon, 22 Jan 2024 22:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-telephony"
vary
Accept-Encoding
report-to
{"group":"ads-telephony","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-telephony"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sun, 01 Jun 2025 14:01:22 GMT
wcm
www.google.de/pagead/attribution/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/859136470/wcm?cc=ZZ&dn=6077536156&cl=3i2qCIjW424Q1sPVmQM&dma=1&dma_cps=sypham&npa=1&ct_eid=2
  • https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=6077536156&cl=3i2qCIjW424Q1sPVmQM&dma=1&dma_cps=sypham
80 B
111 B
XHR
General
Full URL
https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=6077536156&cl=3i2qCIjW424Q1sPVmQM&dma=1&dma_cps=sypham
Requested by
Host: payv3.xpress-pay.com
URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Protocol
H3
Server
142.250.74.195 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s02-in-f3.1e100.net
Software
cafe /
Resource Hash
d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://payv3.xpress-pay.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Sat, 01 Jun 2024 17:23:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
null
content-type
application/json; charset=UTF-8
cache-control
private
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
87
x-xss-protection
0

Redirect headers

date
Sat, 01 Jun 2024 17:23:07 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://www.google.de/pagead/attribution/wcm?cc=ZZ&dn=6077536156&cl=3i2qCIjW424Q1sPVmQM&dma=1&dma_cps=sypham
access-control-allow-origin
https://payv3.xpress-pay.com
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
favicon.ico
payv3.xpress-pay.com/favicons/
15 KB
15 KB
Other
General
Full URL
https://payv3.xpress-pay.com/favicons/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.235.242.188 , United States, ASN13649 (ASN-FLEXENTIAL, US),
Reverse DNS
pay.xpress-pay.com
Software
Apache /
Resource Hash
4f89bb0c563887bb5bc3559e12b581860f54410d278f10b1446a42205b58ac8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Sat, 01 Jun 2024 17:23:08 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 22 Aug 2019 01:55:30 GMT
Server
Apache
ETag
"3aee-590aafbfc2880"
Vary
User-Agent
Content-Type
image/vnd.microsoft.icon
Connection
Keep-Alive
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Keep-Alive
timeout=5, max=99
Content-Length
15086
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

142 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| dataLayer string| GoogleAnalyticsObject function| ga string| tlJsHost object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager function| gtag function| _googWcmImpl string| _googWcmAk function| UET function| UET_init function| UET_push object| ueto_58c23b412c object| uetq function| TrustLogo function| TrustLogo_MouseOver function| TrustLogo_MouseMove function| TrustLogo_MouseOut function| TrustLogo_Credentials function| tLL function| tLM function| tLN function| tLWC function| tLXC function| tLZC function| tLaC function| tLX function| tLY function| tLiB function| tLQC function| tLRC function| tL1C function| tL0C function| tL9C function| tL2C function| tL3C function| tLUC function| tLrC function| tLsC function| tLtC function| tLuC function| tLvC function| tLjC function| tLz function| tLHB function| tLIB function| tLd function| tLe function| tLf function| tLh function| tLi function| tLj function| tLl function| tLm function| tLn function| tLo function| tLp function| tLq function| tLr function| tLs function| tLt function| tLu function| tLx function| tLv function| tLw function| tLy function| tLJB function| tLHC function| tLIC function| tLKB function| tLLB function| tLMB function| tL_C function| tLXB function| tLeB function| tLnB function| tLqC function| tLTC function| tLpC function| tLoB function| tLpB function| tLlB function| tLmB function| createStyleRule string| current_code string| tLB string| tLC string| tLD string| tLE string| tLF string| tLG string| tLH string| tLI string| tLnC string| tLbC string| tLlC string| tLyC string| tLMC string| tLLC string| tLNC number| tLgC number| tLeC number| tLhC number| tLP number| tLQ number| tLfC number| tLiC number| tLU number| tLV string| tLzC number| tLR number| tLS number| tLT number| tLW object| tLO string| tLYC string| tLGB string| tLNB number| tLOB number| tLPB number| tLQB number| tLRB object| tLSB string| tLTB boolean| tLUB number| tLVB string| tLWB number| version string| host function| $ function| jQuery object| yii object| bootstrap function| kvBs4InitForm function| jspbGetTypeName function| _googWccDebug function| _googCallTrackingImpl function| _gaPhoneImpl string| google_wcc_status

16 Cookies

Domain/Path Name / Value
payments.winstonbenefits.com/ Name: ASPSESSIONIDAEDTARDC
Value: MJLLHMKBJCNINPMOFIGAHBPJ
pay.xpress-pay.com/ Name: advanced-frontend
Value: q2fa6uh470h2dpa14nod45mi4k
payv3.xpress-pay.com/ Name: advanced-frontend
Value: t9rcs9aa21ngmul59t6l3e9go3
payv3.xpress-pay.com/ Name: billUrl
Value: e0a46d3602c1a1791682d4ba4cecc4334a6a928a7fdb6587acfd5ba8c95b591ea%3A2%3A%7Bi%3A0%3Bs%3A7%3A%22billUrl%22%3Bi%3A1%3Bs%3A64%3A%22https%3A%2F%2Fpayv3.xpress-pay.com%2Fpt%2F185194d6ac9b43c0b988443bc0d71c81%22%3B%7D
payv3.xpress-pay.com/ Name: cookiesEnabledXPC
Value: 15383aa962571c9e1e3931a101ef9388284287611073d4fee84e08fa6f76f610a%3A2%3A%7Bi%3A0%3Bs%3A17%3A%22cookiesEnabledXPC%22%3Bi%3A1%3Bs%3A39%3A%22Cookies%20are%20required%20to%20use%20Xpress-Pay.%22%3B%7D
payv3.xpress-pay.com/ Name: _csrf-frontend
Value: 622c8a0204415b483e91dd72df224e4123c3e0c272da43ae7d953794c12fb2e3a%3A2%3A%7Bi%3A0%3Bs%3A14%3A%22_csrf-frontend%22%3Bi%3A1%3Bs%3A32%3A%22Wc_VXtMcz0K6ehJew5vhRozSiLgOHrUM%22%3B%7D
.xpress-pay.com/ Name: _ga
Value: GA1.2.772509848.1717262587
.xpress-pay.com/ Name: _gid
Value: GA1.2.1297858577.1717262587
.xpress-pay.com/ Name: _gat
Value: 1
.xpress-pay.com/ Name: _gcl_au
Value: 1.1.1034585035.1717262587
.xpress-pay.com/ Name: _gat_UA-50558733-2
Value: 1
.xpress-pay.com/ Name: _ga_MKG7PGX06R
Value: GS1.2.1717262587.1.0.1717262587.60.0.0
282236.tctm.co/ Name: ct282236
Value: 665b58fb00044e7c8cee5ec4
.xpress-pay.com/ Name: _uetsid
Value: 9cbcee40203b11ef9c9e370f35c3a8cd
.xpress-pay.com/ Name: _uetvid
Value: 9cbd0ba0203b11ef9062435971353008
.bing.com/ Name: MUID
Value: 1C540ADF4A3A61061DB71E4E4B96607D

4 Console Messages

Source Level URL
Text
javascript warning URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81(Line 283)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://secure.trust-provider.com/trustlogo/javascript/trustlogo.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81(Line 283)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://secure.trust-provider.com/trustlogo/javascript/trustlogo.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other warning URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://payv3.xpress-pay.com/bill/search/185194d6ac9b43c0b988443bc0d71c81
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options ALLOWALL
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

282236.tctm.co
bat.bing.com
cdnjs.cloudflare.com
enroll.xpress-pay.com
pay.xpress-pay.com
payments.winstonbenefits.com
payv3.xpress-pay.com
region1.analytics.google.com
sectigo.com
secure.trust-provider.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.sectigo.com
104.17.24.14
142.250.185.104
142.250.186.130
142.250.186.68
142.250.74.195
2001:4860:4802:34::36
209.235.237.45
209.235.242.188
216.239.38.178
2600:9000:223d:a000:12:de4a:40:93a1
2606:4700::6811:a44b
2620:1ec:c11::237
2a00:1450:4001:813::2003
2a00:1450:4001:81d::200e
2a00:1450:4001:828::2008
2a00:1450:400c:c07::9b
2a0e:ac00:c7:d45a::5bc7:d45a
50.56.42.154
91.199.212.148
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
035e9e52caefd0f6358e6ce22a4b97e9961b46ece80418d4bca8e9c719fc171a
1ba30b444f0489b7da1ca80092c7879835ba96404751aabbdb2647de4261fa05
2fe555ade512f20a939fff0f535b283c8f155683c4885174d723983f065b8695
423217abf8775cea2dc30fa1fe3e1c5e24dc359a80f1c37ad29a86094bfe81d1
4f89bb0c563887bb5bc3559e12b581860f54410d278f10b1446a42205b58ac8f
533143d96607d94d5d4292838e364aef656d3de58fe74368263776eab9c07542
5bdd0a80d4667c00218ac28fff6bdf2beb51380f94363bfdeb94cbe88ca0ceb2
670f77f11cb4c747f5de1affa5b53687cf7a20d1eaf99b0ef5c9c60858aefa55
6a8d73fd166e03d8e1c024ac60d01d9110c4ac56b45f5bb402739e4095d4a95b
6d8f8fd6de0b42e3acc7b2f3005c599e9f54d21355c3d6850a5c13daca10d5ad
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
873ca9de6254fa33a975e169a188a48a2c975f4ca07afce54a16212a44d06ee1
9123ef5cf89cdb1ee2e6db82eb04ff97e874de65e8db71ddba2e66fde522ac06
995516724f69e24ddf82e9279a65d50a6f64a2c325226f7133bda794d6bf79a5
9bba86ca6dbbaf462776c44649fa3336807bac345cc4c424fb1d0268388c0294
a8a52e591f079061ede00df3d349fc7354b304514eb69c323cce18dbc4709a90
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b156192d2524056dbc8af028d8a71dfb5a74346ccc5a0910ef98182005762a1b
c5a845fdf1d9fae832851cbf5ea39609a7adb67df32f9fefa6a5308841635f58
cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0
d166ff5857b8fe37b3adc77ec8d4b85525667b3e02fd1bd4e2039f89a23b5a1c
d469de82275c49ce8bcac7d5802649331e870e9a8b1153a7bb6c45d58a90e7ce
d4b2d44b9b2afc075ed56446eaccfc49955a3d1488489f2cd0c7e7e3343915c0
d933a98657089095397ca6126d62e3a07c39e70f82b36f8cea002c0ba5bf1e2c
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e230e13197ba47834a5665e500f5cc79413cad6af245533173960f1ba11951ab
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e45902c0c28d8a669a37a61914c1eb760b093f7cc2d41693d52f82327329218d
ea266491d88bdfffc93e8646558deab901b75a27117830d2ec804e12ae21be72
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efff1fac9b76d309a52009564f02a9f996fcabf055a6501c1d7502f1e1e80169
f886516f3d41e9e7bd994c7f7a39a89cafae9483f90396cb0ddeafe8d1ea5e72
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
ff464d717510921b1c1e70a3cf53f7c02c015b0248cb5105199cd219b0e2b02a