r2.gmsmedia.pics Open in urlscan Pro
2606:4700:3031::6815:4afb Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://r2.gmsmedia.pics/
Effective URL:
https://r2.gmsmedia.pics/
Submission: On April 16 via api (April 16th 2024, 3:03:42 am UTC) from US — Scanned from DE

Summary HTTP 35 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 14 IPs in 3 countries across 11 domains to perform 35 HTTP transactions. The main IP is 2606:4700:3031::6815:4afb, located in United States and belongs to CLOUDFLARENET, US. The main domain is r2.gmsmedia.pics.
TLS certificate: Issued by GTS CA 1P5 on March 18th 2024. Valid for: 3 months.

This is the only time r2.gmsmedia.pics was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	2606:4700:303... 2606:4700:3031::6815:4afb	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	47.89.219.37 47.89.219.37	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
3	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
5	2606:4700:e4:... 2606:4700:e4::ac40:a507	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1178:1:4... 2a00:1178:1:4b::19	35415 (WEBZILLA) (WEBZILLA)
1	2606:4700:20:... 2606:4700:20::ac43:487c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	67.216.89.16 67.216.89.16	35415 (WEBZILLA) (WEBZILLA)
3	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
35	14

11 2606:4700:3031::6815:4afb (United States)

ASN13335 (CLOUDFLARENET, US)

r2.gmsmedia.pics	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 47.89.219.37 (United States)

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

www.cutercounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:e4::ac40:a507 (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1178:1:4b::19 (Netherlands) 2 redirects

ASN35415 (WEBZILLA, NL)

glum-mortgage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::ac43:487c (United States)

ASN13335 (CLOUDFLARENET, US)

invidget.switchblade.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 67.216.89.16 (United States)

ASN35415 (WEBZILLA, NL)
PTR: 1f1-22-d3171-16.webazilla.com

10945-2.s.cdn15.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	gmsmedia.pics r2.gmsmedia.pics	19 KB
8	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 109 tpc.googlesyndication.com — Cisco Umbrella Rank: 159	207 KB
5	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 4272	178 KB
4	glum-mortgage.com 2 redirects glum-mortgage.com — Cisco Umbrella Rank: 184747	48 KB
2	cdn15.com 10945-2.s.cdn15.com — Cisco Umbrella Rank: 232766	174 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2548	254 B
1	gstatic.com fonts.gstatic.com	22 KB
1	switchblade.xyz invidget.switchblade.xyz — Cisco Umbrella Rank: 308323
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 42	100 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
1	cutercounter.com www.cutercounter.com — Cisco Umbrella Rank: 192038	802 B
35	11

	Domain	Requested by
11	r2.gmsmedia.pics	r2.gmsmedia.pics
6	pagead2.googlesyndication.com	r2.gmsmedia.pics pagead2.googlesyndication.com
5	ka-f.fontawesome.com	r2.gmsmedia.pics
4	glum-mortgage.com	2 redirects r2.gmsmedia.pics glum-mortgage.com
2	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com
2	10945-2.s.cdn15.com	r2.gmsmedia.pics
1	region1.google-analytics.com	www.googletagmanager.com
1	fonts.gstatic.com	fonts.googleapis.com
1	invidget.switchblade.xyz	r2.gmsmedia.pics
1	www.googletagmanager.com	r2.gmsmedia.pics
1	fonts.googleapis.com	r2.gmsmedia.pics
1	www.cutercounter.com	r2.gmsmedia.pics
35	12

This site contains links to these domains. Also see Links.

Domain
docs.google.com
www.cutercounter.com

Subject Issuer	Validity	Valid
gmsmedia.pics GTS CA 1P5	`2024-03-18` - `2024-06-16`	3 months	crt.sh
cutercounter.com R3	`2024-02-28` - `2024-05-28`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
ka-f.fontawesome.com GTS CA 1P5	`2024-03-05` - `2024-06-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
glum-mortgage.com R3	`2024-03-12` - `2024-06-10`	3 months	crt.sh
switchblade.xyz GTS CA 1P5	`2024-03-31` - `2024-06-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://r2.gmsmedia.pics/
Frame ID: 4472BF8DC1FAFA7B0393B55A68C609F3
Requests: 32 HTTP requests in this frame

Frame: https://invidget.switchblade.xyz/vV7mkcPhMy?theme=dark
Frame ID: 7F073C32CC9D8699F5272A37DD5149F1
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/html/r20240411/r20110914/zrt_lookup_fy2021.html
Frame ID: D47C69A93DDB310336A8A5EA9580D8A7
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6700774525685317&output=html&adk=1812271804&adf=3025194257&lmt=1713130082&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fr2.gmsmedia.pics%2F&pra=5&wgl=1&easpi=1&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyMy4wLjYzMTIuMTIyIixudWxsLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMjMuMC42MzEyLjEyMiJdLFsiTm90OkEtQnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjEyMy4wLjYzMTIuMTIyIl1dLDBd&dt=1713236617682&bpp=3&bdt=351&idt=116&shv=r20240411&mjsv=m202404080101&ptt=9&saldr=aa&abxe=1&eoidce=1&nras=1&correlator=6983555465295&frm=20&pv=2&ga_vid=2007188947.1713236618&ga_sid=1713236618&ga_hid=1665038783&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95328448%2C31082770%2C42532524%2C44798934%2C95326316%2C95329427%2C95320378%2C31081873%2C95321865&oid=2&pvsid=2961533187805674&tmod=1726009619&uas=0&nvt=1&fsapi=1&fc=1920&brdim=860%2C860%2C860%2C860%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&ifi=1&uci=a!1&fsb=1&dtd=144
Frame ID: 6813F44F4272E332AAA56E7A14F8F566
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6700774525685317&output=html&h=280&slotname=5324022054&adk=1558636061&adf=854766408&pi=t.ma~as.5324022054&w=1200&fwrn=4&fwrnh=100&lmt=1713130082&rafmt=1&format=1200x280&url=https%3A%2F%2Fr2.gmsmedia.pics%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyMy4wLjYzMTIuMTIyIixudWxsLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMjMuMC42MzEyLjEyMiJdLFsiTm90OkEtQnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjEyMy4wLjYzMTIuMTIyIl1dLDBd&dt=1713236617685&bpp=2&bdt=353&idt=150&shv=r20240411&mjsv=m202404080101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=6983555465295&frm=20&pv=1&ga_vid=2007188947.1713236618&ga_sid=1713236618&ga_hid=1665038783&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95328448%2C31082770%2C42532524%2C44798934%2C95326316%2C95329427%2C95320378%2C31081873%2C95321865&oid=2&pvsid=2961533187805674&tmod=1726009619&uas=0&nvt=1&fc=1920&brdim=860%2C860%2C860%2C860%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&ifi=2&uci=a!2&fsb=1&dtd=158
Frame ID: A71455928FDB5E2DF8B375D3508D070F
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C66DF454E9D30D17EADB1954D2CA59FA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dashboard

Page URL History Show full URLs

http://r2.gmsmedia.pics/ HTTP 307
https://r2.gmsmedia.pics/ Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

35
Requests

91 %
HTTPS

85 %
IPv6

11
Domains

12
Subdomains

14
IPs

3
Countries

749 kB
Transfer

1556 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://docs.google.com/spreadsheets/d/1j4pSMcTHv8APUjVet4D5vgvzP1AeRw-jOQLZW5FIvao/edit?usp=sharing
Title: Game request Status

Search URL Search Domain Scan URL

URL: https://www.cutercounter.com/hits.php?id=hxofkcx&nd=9&style=40

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://r2.gmsmedia.pics/ HTTP 307
https://r2.gmsmedia.pics/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

https://glum-mortgage.com/c.H-VxzyazGAl_tCZDzE9Fh-ZHEIlJkKP_TMUNzONPj-ERxSOTCUZ_jWdXDY1Zs-cbncldneZ_GgJhsiMjX-Vl5mZnXoF_kqNrms1ts-Yv2wxxjyM_iAZBmCcDH-YF9GMHCIZ_mKcLnMYN9-MPCQZRpSb_WUcV9WaXH-RZ0acbHcM_leMf0gEhl-MjkkYllmM_koYpxqMrD-kt0uNvSw0_yyLznAMBu-YD2ERFuGM_TIUJuKYL2-9NtOJPTQJ_GSYT3UJVl-YXXYRZpad_mcVdzeJfT-JhGiNjzkE_5mNnDoApl-MrksYtyuO_DwQxyyOzT-cBlCMDkEY_1GMHzIUJ5-NLjMRNfOM_GQIRwSZTT-gVuWcXGY5_naJbncBdh-efTg0hwiJ_nkBlhmenW-9p1qdrFsB_lucvkwNxs-azWANBrCP_TEAFmGcHm-VJ2KPLTMA_mOcP2QlRk-MTzU0VmWc_3YMZ9aNbC-ZdzedfDg0_xiJjnkplv-bnmoVpJqZ_Ds0t1uMvT-AxwyNzzAE_2C HTTP 302
https://10945-2.s.cdn15.com/creatives/71940/284297/535964_0b0e8.png

Request Chain 35

https://glum-mortgage.com/cHHIV.zJa-GLlMtNZOz_9QhRZSETl-kVPWTXUYz_NajbEcydM-CfZgjhdiD_1kslcmnnl-ppZqGrJss_MuXvVw5xZ-XzFAuBaCm_VEyFYG2H1-vJZKiLZMm_cOHPYQ9RM-CTZUmVcWn_YY9ZMaCbZ-pdbeWfcg9_aiHjRk0lc-HnMolpMq0_EsltMukvY-lxMykzYAx_MCDDkE0FN-SH0IyJLKn_MMuNYO2PR-uRMSTTUUu_YW2X9YtZJ-TbJcGdYe3_JglhYiXjR-pldmmnVoz_JqTrJsGtN-zvEw5xNyD_AAlBMCkDY-yFOGDHQIy_OKTLcMlNM-kPYQ1RMSz_UU5VNWjXZ-fZNaGbUcy_MezfMguhc-Gj5knlJmn_BohpeqTr0-wtJunvBwh_eyWz9A1Bd-FDBElFcGk_NIsJaKWLN-rNPOTPAQm_cSmTVU2VP-TXAYmZca2_lckdMezf0-mhci3jMk9_NmCnZozpd-Dr0sxtJun_pwvxbymzV-JBZCDD0E1_MGTHAIwJN-zLEM2N HTTP 302
https://10945-2.s.cdn15.com/creatives/71940/284297/535966_4e233.png

35 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
r2.gmsmedia.pics/
Redirect Chain

http://r2.gmsmedia.pics/
https://r2.gmsmedia.pics/

3 KB
2 KB

233ms
203ms

Document
text/html

2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: af289ef9c0cbe28da3c0bfdcbdf9035b729bc19dd60ff608243fd7baa79fdc97

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8750f1790ffca079-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 16 Apr 2024 03:03:37 GMT
last-modified: Sun, 14 Apr 2024 21:28:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=moMd6ta64tabrOpp0g701tLIf%2Fp3VplksfgbpfB61803NZXlkwKXGIOirhddIPdfdQkaQPnJqCCWlymfEaSbL4NnJq0U2Y%2B23DlA6sBu7BuUGWbOGS5T%2BUzymCsoeX%2BuON7UJ5b3vaUPLUVp0GND"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
x-served-by: r2.gmsmedia.pics

Redirect headers

Location: https://r2.gmsmedia.pics/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 font.js Show response
r2.gmsmedia.pics/assets/js/ 11 KB
5 KB 222ms
222ms Script
application/javascript 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/js/font.js
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c9a3d179bfed32846024ccba2747d360ea292c74ee721f1924feb2bc4d6844f0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"2c3a-18dd413a1f7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n3vuJFC4tzxHrpyRKdV7gQ0rG61142KotKwf0PKSkdWzRyXVyNWELnD3FA6Ltc%2B8KYN80%2FiPrAEnywmyGtdevDv2RgDTu0zK9cAkNd4%2BDVdcyn9%2B375ykK1N%2BTUP1e%2F2pV3BlUtGQokv6%2FLNpApm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17a58afa079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H3 200 randomSentence.js Show response
r2.gmsmedia.pics/assets/js/ 743 B
847 B 220ms
219ms Script
application/javascript 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/js/randomSentence.js?v=2
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c3234cfbbb5246b4e59b0709eb239d0833d712fd4bc8f889d4697c7ca81f3d40

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"2e7-18e38ebce9b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CmLUxMBxtusy5Vrk51X3l8wnA18ggKodfF3Ayeex296c7v4hyDaT43JZ31nMOId0eUZOXBJWj5SLxKsgSogB80uqwTE2ECGi9AeWMZ0yAG6a53%2FfaI6Pcly%2BUpY%2FAxb2V9ykA4M0XultE1rw%2FC5u"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17a58b1a079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H3 200 index.css
r2.gmsmedia.pics/assets/css/ 2 KB
1 KB 225ms
225ms Stylesheet
text/css 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/css/index.css
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: c1c567e3cc6aeb229ffff4bc6f1cbb4c39cb995f1a7404ba28b1a1760fb3bc24

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"8cd-18ed8ec8100"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d7VuII9A%2FJMrxwUMMKnbKnb8b3E%2Froniu1UwOnQEWNGfJLSz5A2wTEcBT6eavmnCP09P0hl5zbkpWp%2FO0%2Fmi9ChIDybphrej52bPIC0B6iLyxgxm6wXJW3PD888LgQzK3ZZi3RUc7EVg56b4rSN1"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17a58b2a079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H3 200 style.css
r2.gmsmedia.pics/assets/css/ 2 KB
1 KB 224ms
223ms Stylesheet
text/css 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/css/style.css
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a86338081e5ba630b64ba27e36e0052908885e5af6adace25b468880e4d58c8d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"722-18ee3c462d1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rn2lTHaEJbKTgJnEQ15h3KTtl5i6Wj%2BRbVgWF6GqcmMV0rF534iH97OJL94s%2FQLiCtIqXubuoMf6Fe3LTsYZVox3SIHDqlBKf3eseIo7BpmoqxtpZ%2Fgoi%2BiwlWUHqK9I6hASH1kQnaHyyHJarUk"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17a58b5a079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H3 200 nav.css
r2.gmsmedia.pics/assets/css/ 1 KB
1 KB 218ms
218ms Stylesheet
text/css 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/css/nav.css?v=3
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 2c9644f034a7c343c658b15e8ca0608a0322018ccc995895518a44853413be6f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"561-18ede7fce95"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fl5ZGX1ncFHl4QwelAD16uq8NmF3mHO97jxAqJSJ5pMmaUjzvfGA1putHNt3jgIuWvw0%2F9MLxyBbXBCSrKON9h0Zlfq%2BZu6pyrKg0t2lWvv6knOFXYUzzIOVDOzvq92tjYyNjyl3KIIBwDgUS34b"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17a58b7a079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H3 200 script.js Show response
r2.gmsmedia.pics/assets/js/ 3 KB
2 KB 223ms
223ms Script
application/javascript 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/js/script.js?v=4
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ad95360941438449df1f2d001e27183ecb65c38854cc810f10bb31538b5c2d3d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"ac7-18ee46bec8b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=biiDxRFIdZabNIj9NFjjWJDHzXTQ1iJwG04%2FbPkvAwnNEEk7O1OvkT3b%2BvZK5GKyw4j%2Fo58SYTNNCkd%2BCDZlg26ROypGyyuY8XmT73NVPNABNGtUTT%2BMrFrPamM%2BxjmEPQUUp3J8xmieDyz7XRIG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17a58b8a079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H3 200 easteregg.min.js Show response
r2.gmsmedia.pics/assets/js/ 442 B
780 B 201ms
201ms Script
application/javascript 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/js/easteregg.min.js
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 39d7c7ac65d9e4421322a5ab7e0cd2fcead337da3c66749c65aa7f4bab785dad

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"1ba-18dd413a1f7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JaO77K2yAvKrR2iPLFYq%2FF8W%2F7JymJ1IieUfy5YeYZgGru4AQVAbUaq4SNfYDNK05hA5xITPorVDjIyE43Fk4ysJtDbIcgH5Tj32h%2BB7OPBN09i3u84wwX0mDZAqjDuOJv5JRzJNMecoTp4%2BU1qL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=77183
cf-ray: 8750f17bc97da079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H/1.1 200
OK hits.php
www.cutercounter.com/ 602 B
802 B 1344ms
159ms Image
image/gif 47.89.219.37
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cutercounter.com/hits.php?id=hxofkcx&nd=9&style=40
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 47.89.219.37 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: Apache / PHP/7.0.33
Resource Hash: 4d989de012143487e4c4a1becaf3150f754ea86483a85724150387d1b0f55139

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 16 Apr 2024 03:03:38 GMT
Server: Apache
Connection: Keep-Alive
X-Powered-By: PHP/7.0.33
Content-Length: 602
Keep-Alive: timeout=5, max=100
Content-Type: image/gif

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 145 KB
50 KB 44ms
25ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6700774525685317

Requested by

Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44d80b32506d9decced07ce10e4d14f36d4610a27be92b5e2b51112b9e3e700f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Origin: https://r2.gmsmedia.pics
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51170
x-xss-protection: 0
server: cafe
etag: 3174369069186146828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Tue, 16 Apr 2024 03:03:37 GMT

GET
H3 200 free.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 100 KB
23 KB 53ms
23ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free.min.css?token=8e467ad554
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/font.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e0821588462d15b0ff8e911760fc041332c162e2e30ab4b1071bcc8eb6c8223

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
via: 1.1 a23dafbbb9a61c77bda1d66d97f24e2e.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
server: cloudflare
etag: W/"ae737a19e46fd502ba9cbe9e33213861"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=30hdVbhGbQ0LZNJCFAUVdsaEpQvTJSOP40s0c1lEMS%2BCvIUtzdzYV4hth7TT2oz7Rwzi3xxMTPMm3EnjqZaRONp6oqhRAOMD18bIu1IxZ5nfj5%2B0Z6eb3xBWnM2Oro1oR6ANIS5G05U52KqJ2Lm0CWShXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 8750f17bf9ca927f-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: TbpnyGUHRe_ttanUdxTfXn9JvdF7O4awlrjHb7cBCpK03lRxXAnQYg==

GET
H3 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 27 KB
5 KB 59ms
30ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-shims.min.css?token=8e467ad554
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/font.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 236e285339a2a692e9491d356489cdf83513cfb1add049a0620123d644e47554

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
via: 1.1 a7631312afe99e40229aa0da70662112.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
server: cloudflare
etag: W/"da06df503ced6ee507b5fb4fa0999f74"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zWbZKBQ%2BrZLHo%2FIqbVJguVafiXv8%2BJz5BOytHWBUrp%2FCGccebguLBTGwitGZN%2B55VecOfWDaCwD0S%2F0C6oMHZQzQX2b7hXfbMbC%2FPu9TIm%2B%2BkaBvju1%2FRctrN61EroIwI%2FAsqs%2FbeNTV83Vhx%2BdXkaqwow%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 8750f17bf9cb927f-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: sXKW99Y1WqmMIpYrcdW37Ae5WCkzdxY-XrieVEN4yJhTlKcRcNkoog==

GET
H3 200 free-v5-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 823 B
1 KB 50ms
21ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free-v5-font-face.min.css?token=8e467ad554
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/font.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e81443469aa4b967191ce19b7474eb223746a2b8d5dc42d3786da84d99dfad9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
via: 1.1 747e99d9d8c5e29fdc713cf866bc3f82.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
server: cloudflare
etag: W/"dbf296002d53e56d340b105d9d764940"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XwYLtb6XO4cyEavZZzJcJIzVZ4Zf6iQravfFSiFI6ZuFIjuotQJonKx9VCpLUzdbJAldjxRLHjCOn8xzqqo9rPKHPu3jb5N%2BMpoE7gPdSnZ2E2aTUBCiIMmn0GWNAZXtZSE4v29XTYKeCpAsN7qNirE9Kg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 8750f17bf9c9927f-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: SNGVYL0yiRYaL8yG5hEr4-645s13XAruSNxS_1pK-BVOsyaUT85XrQ==

GET
H3 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v6.4.2/css/ 2 KB
1 KB 51ms
22ms Fetch
text/css 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/css/free-v4-font-face.min.css?token=8e467ad554
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/font.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c58c4804370b9c347d517491c450416ca371fb1403aceaa1d6f751403b07c48

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
via: 1.1 ef4ff53b101ef123a46ec560b6c94cb8.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 01 Aug 2023 19:07:56 GMT
server: cloudflare
etag: W/"9b853b50f37dd0ca770ce0f294d427df"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FNFIZPDZ2Ju1wyznJyWAHok%2B3%2FYwdExUk%2F6fKiXK3OVWyyurxOwC%2FK2kfzQkqoto%2B8Kk0ERBjkl%2BqSvrWUoBVlAxLwtZUVEmcLBAFLK8OpS5NGa1ywGPWwocscJZFIqvRWxgP1pH73jwGI58DXa56QlbmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
cf-ray: 8750f17bf9c8927f-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: Mv6bCRgrDEWr5l2fCHIEkmcTk7udBY78bCJWdlSEeQYoJ3wXe03yGw==

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1 KB 45ms
16ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Inter&display=swap

Requested by

Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/css/index.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

134d30ed9c825909dd32af40d469aaafedfe1b17447abee0ed6c43c7254d2a48

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 16 Apr 2024 01:30:51 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 Apr 2024 03:03:37 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 299 KB
100 KB 52ms
23ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N0LG27M8L8

Requested by

Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/script.js?v=4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

326788cc06f2403dddb891b1b2a5a4530751a509ce2207c58b58cdec3036237c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 101578
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 16 Apr 2024 03:03:37 GMT

GET
H2 200 1_MnTDAswENmzVEc3c Show response
glum-mortgage.com/aDWu5.weYGWBdjlsQ/2H9dk/ZpTY9p6Cb_2h5/l/SdWDQx9ANaTHEaw/MODPcsxoN_iS0/ 139 KB
47 KB 92ms
57ms Script
application/javascript 2a00:1178:1:4b::19
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

https://glum-mortgage.com/aDWu5.weYGWBdjlsQ/2H9dk/ZpTY9p6Cb_2h5/l/SdWDQx9ANaTHEaw/MODPcsxoN_iS0/1_MnTDAswENmzVEc3c

Requested by

Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/script.js?v=4

Protocol

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

2a00:1178:1:4b::19 , Netherlands, ASN35415 (WEBZILLA, NL),

Reverse DNS

Software

nginx /

Resource Hash

1e745d7791d5061ecdbd60e603cf059a90951f18efd0dab417e87fe3ad2e1f49

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Mon, 26 Jul 2011 05:00:00 GMT

GET
H3 200 ads.json Show response
r2.gmsmedia.pics/assets/json/ 110 B
596 B 106ms
106ms Fetch
application/json 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/json/ads.json
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/script.js?v=4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 447713b6239c288c374d4906a40fde72ed10f0b052cf5af680def097eedce693

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Wed, 13 Mar 2024 17:46:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"6e-18e38ebce9b"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cWYMQsWalR5XZyAoPw2fgsVDdG6d3%2BcLWKoWsSTkoLpfcheRZa2hiQS5%2BeI2NvH4HUTp3cftdBln6TuOylg3FmaCOfWFYYFvg9%2BQSxkkcW0mxEfjhkMJKnyz%2BCYcB%2FAoV9xUy8xy9ds6uBW5lrDd"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0
cf-ray: 8750f17c19a4a079-FRA
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics

GET
H2 200 vV7mkcPhMy
invidget.switchblade.xyz/ Frame 7F07 0
0 455ms
399ms Document
image/svg+xml 2606:4700:20::ac43:487c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://invidget.switchblade.xyz/vV7mkcPhMy?theme=dark
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:487c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: max-age=14400
cf-cache-status: EXPIRED
cf-ray: 8750f17c79fa4d4a-FRA
content-encoding: br
content-type: image/svg+xml; charset=utf-8
date: Tue, 16 Apr 2024 03:03:38 GMT
etag: W/"6589-dKfMc5unonXuSDJs75AlBRhGaPo"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6BHVuc0ssZZ%2BVsOkERWAwmRS78ix1MgMCc8BR%2FX%2BhG9YuFgX%2FnGdKh%2FoGaN38fOa%2BBlDfBHq%2BPU0IPcoL%2FFZzSAihrvPn3M3nnnSEkV0au1p6lYVGYFyJ4krA4k%2BXfoNAb2m1HF1osgzMN%2FPiTLIRelCqLr3%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express
x-served-by: invidget.switchblade.xyz

GET
H2 200 UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfAZ9hiA.woff2
fonts.gstatic.com/s/inter/v13/ 21 KB
22 KB 41ms
18ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v13/UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuLyfAZ9hiA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2301bb030a2bcaa9c763cc4771bd717aac16709c29eaba00673fcbe7cdf99a59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://r2.gmsmedia.pics
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 09 Apr 2024 14:21:25 GMT
x-content-type-options: nosniff
age: 564132
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 21564
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 23:49:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 09 Apr 2025 14:21:25 GMT

GET
H3 200 free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v6.4.2/webfonts/ 147 KB
147 KB 27ms
27ms Font
font/woff2 2606:4700:e4::ac40:a507
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v6.4.2/webfonts/free-fa-solid-900.woff2
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e4::ac40:a507 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3e9a900f61c6811de529e4227226b898ce88b65a66347d0088a2da3af5e60b5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Origin: https://r2.gmsmedia.pics
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA56-C2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 150020
last-modified: Tue, 01 Aug 2023 19:25:32 GMT
server: cloudflare
etag: "a8dcee416ebfe6e615e5902a49500e48"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m%2Bt5b4hDntT6MPRbtiY6Z%2B6c3UkzFB99dABPrJg0k00NfTEX8P2wkRM8pxN%2FL7yFvrLgW4UjTbzrRsIEHFzUPUDHzkZXkN7jXTWXMLRxa6MPFJOfmzXXmDMTnV2hvffugh8SoXIjsaX8xNVyh3m2rcL10g%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=31556926
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 8750f17c49ef927f-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: iAtMg-sXr0FqJXZZFqlHmYGSJJy5LXhKf0ERh6H9xSpiGouXGGCK3Q==

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404080101/ 408 KB
138 KB 61ms
44ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6700774525685317&plah=r2.gmsmedia.pics&aplac=true

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6700774525685317

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2d8ca36828277232d1ec3f7c967745280081a338135501ffb4ebb4d2cb46793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141583
x-xss-protection: 0
server: cafe
etag: 495392127721440178
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 16 Apr 2024 03:03:37 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
254 B 38ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-N0LG27M8L8&gtm=45je44f0v897329575za200&_p=1713236617612&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=2007188947.1713236618&ul=de-de&sr=1600x1200&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1713236617&sct=1&seg=0&dl=https%3A%2F%2Fr2.gmsmedia.pics%2F&dt=Dashboard&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=649
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N0LG27M8L8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 03:03:37 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://r2.gmsmedia.pics
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 YR2-xTpUZ.WV5W0_ZYGZFa0bY-Td9eyfcgm_likjPkTlA-wnNojpkqz_ZsmtQuzvN-WxEyxzYAT_IC1DZEWFR-iHOIGJQK5_YM2NUO5PM-2RMS3TMUj_BWmXZYDZR-ib
glum-mortgage.com/ 0
322 B 14ms
13ms Ping
text/plain 2a00:1178:1:4b::19
WEBZILLA

General

Check archive.org

Show headers Download Go to

Full URL

https://glum-mortgage.com/YR2-xTpUZ.WV5W0_ZYGZFa0bY-Td9eyfcgm_likjPkTlA-wnNojpkqz_ZsmtQuzvN-WxEyxzYAT_IC1DZEWFR-iHOIGJQK5_YM2NUO5PM-2RMS3TMUj_BWmXZYDZR-ib

Requested by

Host: glum-mortgage.com
URL: https://glum-mortgage.com/aDWu5.weYGWBdjlsQ/2H9dk/ZpTY9p6Cb_2h5/l/SdWDQx9ANaTHEaw/MODPcsxoN_iS0/1_MnTDAswENmzVEc3c

Protocol

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

2a00:1178:1:4b::19 , Netherlands, ASN35415 (WEBZILLA, NL),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 16 Apr 2024 03:03:37 GMT
x-content-type-options: nosniff
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Mon, 26 Jul 2011 05:00:00 GMT

GET
DATA 200
OK truncated
/ 195 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf245e3d670cc0220fa53fe33770b35e643c203a03630c685391ab3dab40b5a2

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7625d2873ff74aa19885e86e164fc7ee122587bbe54dbb57c82a7d3b31b4b22f

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

535964_0b0e8.png
10945-2.s.cdn15.com/creatives/71940/284297/
Redirect Chain

https://glum-mortgage.com/c.H-VxzyazGAl_tCZDzE9Fh-ZHEIlJkKP_TMUNzONPj-ERxSOTCUZ_jWdXDY1Zs-cbncldneZ_GgJhsiMjX-Vl5mZnXoF_kqNrms1ts-Yv2wxxjyM_iAZBmCcDH-YF9GMHCIZ_mKcLnMYN9-MPCQZRpSb_WUcV9WaXH-RZ0acbH...
https://10945-2.s.cdn15.com/creatives/71940/284297/535964_0b0e8.png

86 KB
87 KB

85ms
12ms

Image
image/png

67.216.89.16
WEBZILLA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://10945-2.s.cdn15.com/creatives/71940/284297/535964_0b0e8.png
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/
Protocol: H2
Server: 67.216.89.16 , United States, ASN35415 (WEBZILLA, NL),
Reverse DNS: 1f1-22-d3171-16.webazilla.com
Software: ucdn/1.24.0 /
Resource Hash: 812f346ba204c09c2bcfc54774e6eabde275329b49238b59846e2516edc69e9a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 16 Apr 2024 03:03:37 GMT
x-openstack-request-id: txbe2fe2f021f74b0b800b8-006614f4f3
content-length: 88493
x-trans-id: txbe2fe2f021f74b0b800b8-006614f4f3
last-modified: Tue, 03 Oct 2023 12:15:42 GMT
server: ucdn/1.24.0
x-ureq-id: YhqVaoy3XnPWpOITyVBR+JM/3JMDksvZfqrfo/3asU3SCkxqZ/wlRAqr0snvsQArl2gt7OBpn6Egk6/67wqfsHPHTsOtb6I7W+XkRFdNTsaLQfz8IqqN3D92mO3tdCv8
etag: "64db2d0b95248182d902dc6473f5af61"
x-served-from: l1
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: image/png
x-vhostid: 94, 11845
access-control-allow-origin: *
x-timestamp: 1696335341.86801
cache-control: max-age=13523953
accept-ranges: bytes
expires: Thu, 19 Sep 2024 15:42:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Apr 2024 03:03:37 GMT
x-content-type-options: nosniff
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
location: https://10945-2.s.cdn15.com/creatives/71940/284297/535964_0b0e8.png
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Mon, 26 Jul 2011 05:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html
pagead2.googlesyndication.com/pagead/html/r20240411/r20110914/ Frame D47C 0
0 20ms
7ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/html/r20240411/r20110914/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202404080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6700774525685317&plah=r2.gmsmedia.pics&aplac=true

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

age: 30114
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 15 Apr 2024 18:41:43 GMT
etag: 5035419970550746386
expires: Mon, 29 Apr 2024 18:41:43 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 403 ads
pagead2.googlesyndication.com/pagead/ Frame 6813 0
0 30ms
29ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6700774525685317&output=html&adk=1812271804&adf=3025194257&lmt=1713130082&plat=3%3A16%2C4%3A16%2C8%3A4194304%2C9%3A134250504%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fr2.gmsmedia.pics%2F&pra=5&wgl=1&easpi=1&asro=0&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyMy4wLjYzMTIuMTIyIixudWxsLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMjMuMC42MzEyLjEyMiJdLFsiTm90OkEtQnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjEyMy4wLjYzMTIuMTIyIl1dLDBd&dt=1713236617682&bpp=3&bdt=351&idt=116&shv=r20240411&mjsv=m202404080101&ptt=9&saldr=aa&abxe=1&eoidce=1&nras=1&correlator=6983555465295&frm=20&pv=2&ga_vid=2007188947.1713236618&ga_sid=1713236618&ga_hid=1665038783&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95328448%2C31082770%2C42532524%2C44798934%2C95326316%2C95329427%2C95320378%2C31081873%2C95321865&oid=2&pvsid=2961533187805674&tmod=1726009619&uas=0&nvt=1&fsapi=1&fc=1920&brdim=860%2C860%2C860%2C860%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&ifi=1&uci=a!1&fsb=1&dtd=144

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 16 Apr 2024 03:03:37 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 403 ads
pagead2.googlesyndication.com/pagead/ Frame A714 0
0 25ms
24ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/ads?ltd_cs=1&client=ca-pub-6700774525685317&output=html&h=280&slotname=5324022054&adk=1558636061&adf=854766408&pi=t.ma~as.5324022054&w=1200&fwrn=4&fwrnh=100&lmt=1713130082&rafmt=1&format=1200x280&url=https%3A%2F%2Fr2.gmsmedia.pics%2F&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyJXaW4zMiIsIjEwLjAuMCIsIng4NiIsIiIsIjEyMy4wLjYzMTIuMTIyIixudWxsLDAsbnVsbCwiNjQiLFtbIkdvb2dsZSBDaHJvbWUiLCIxMjMuMC42MzEyLjEyMiJdLFsiTm90OkEtQnJhbmQiLCI4LjAuMC4wIl0sWyJDaHJvbWl1bSIsIjEyMy4wLjYzMTIuMTIyIl1dLDBd&dt=1713236617685&bpp=2&bdt=353&idt=150&shv=r20240411&mjsv=m202404080101&ptt=9&saldr=aa&abxe=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=6983555465295&frm=20&pv=1&ga_vid=2007188947.1713236618&ga_sid=1713236618&ga_hid=1665038783&ga_fc=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=642&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95328448%2C31082770%2C42532524%2C44798934%2C95326316%2C95329427%2C95320378%2C31081873%2C95321865&oid=2&pvsid=2961533187805674&tmod=1726009619&uas=0&nvt=1&fc=1920&brdim=860%2C860%2C860%2C860%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&bz=1&ifi=2&uci=a!2&fsb=1&dtd=158

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 16 Apr 2024 03:03:37 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 quotes.json Show response
r2.gmsmedia.pics/assets/json/ 2 KB
1 KB 107ms
106ms Fetch
application/json 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/assets/json/quotes.json
Requested by: Host: r2.gmsmedia.pics
URL: https://r2.gmsmedia.pics/assets/js/randomSentence.js?v=2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 4588dcd61f336a27e8f79c09ed32b48fc4fae3f222d59076fd2b8daa65daba64

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:39 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Sat, 16 Mar 2024 20:42:02 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"826-18e490005c0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ysD9GHOtAm9vt9pdEujWxh0i2Y4SMGQBcyeF3oxVDkTAV5Da3YUfYQ2c3HEu9p6JJN6uV0HEQEQ8tIRZRwar9PAkLQD9Qny6CyMClFMWqHjUwBMZyV%2BI%2FgVw9ecwawdyxfdnCPpG023ALy9ehG4h"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=0
cf-ray: 8750f1843e5ca079-FRA
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 23ms
22ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240411&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71b4f8993cf48a69b306d7639ec2536aa8c3ef268ff083d37a4c7052df24cd37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12363
x-xss-protection: 0

GET
H3 200 canvas.ico
r2.gmsmedia.pics/img/ 32 KB
4 KB 297ms
295ms Other
image/x-icon 2606:4700:3031::6815:4afb
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r2.gmsmedia.pics/img/canvas.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:4afb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 46bf05e4101596386341b4c193ba9ef1ae1fb40dd26b87c10799e941d9425d2b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:39 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: Express
alt-svc: h3=":443"; ma=86400
x-served-by: r2.gmsmedia.pics
server: cloudflare
etag: W/"80dc-18dd413a1fb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UxKNG8EGta7c1BbFQo80hqK9lPOJJhNQOMAwxwyZVqnLxtK5x9DihGRgpVhcp79koc7UZhw0SXnH2gQdV3SSbJIoDBaAVcbxPexbP1cJOeF%2Fub8nPoz1oMwZIjrRRRrvp6G3FcpGsK7InoInUNKd"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
access-control-allow-origin: *
cache-control: max-age=77181
cf-ray: 8750f1844e8ea079-FRA
expires: Wed, 17 Apr 2024 00:30:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 60ms
24ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://r2.gmsmedia.pics/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 03:03:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 16 Apr 2024 03:03:38 GMT

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C66D 0
0 27ms
7ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
age: 10316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 16 Apr 2024 00:11:43 GMT
expires: Wed, 16 Apr 2025 00:11:43 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET sodar
pagead2.googlesyndication.com/pagead/ 0
0

GET
H2

200

535966_4e233.png
10945-2.s.cdn15.com/creatives/71940/284297/
Redirect Chain

https://glum-mortgage.com/cHHIV.zJa-GLlMtNZOz_9QhRZSETl-kVPWTXUYz_NajbEcydM-CfZgjhdiD_1kslcmnnl-ppZqGrJss_MuXvVw5xZ-XzFAuBaCm_VEyFYG2H1-vJZKiLZMm_cOHPYQ9RM-CTZUmVcWn_YY9ZMaCbZ-pdbeWfcg9_aiHjRk0lc-H...
https://10945-2.s.cdn15.com/creatives/71940/284297/535966_4e233.png

86 KB
87 KB

13ms
12ms

Image
image/png

67.216.89.16
WEBZILLA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://10945-2.s.cdn15.com/creatives/71940/284297/535966_4e233.png
Protocol: H2
Server: 67.216.89.16 , United States, ASN35415 (WEBZILLA, NL),
Reverse DNS: 1f1-22-d3171-16.webazilla.com
Software: ucdn/1.24.0 /
Resource Hash: 33667b0c8dde1f5b32c54f9d8b0b70ad8cbdc01ee881fd06ca3f0d5e9da2155a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://r2.gmsmedia.pics/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Tue, 16 Apr 2024 03:03:40 GMT
x-openstack-request-id: tx9b7409c648a64020b97cf-006614f53b
content-length: 88519
x-trans-id: tx9b7409c648a64020b97cf-006614f53b
last-modified: Tue, 03 Oct 2023 12:15:43 GMT
server: ucdn/1.24.0
x-ureq-id: YhqVaoy3XnPWpOITyVBR+JM/3JMDksvZfqrfo/3asU3SCkxqZ/wlRAqr0snvsQArl2gt7OBpn6Egk6/67wqfsHPHTsOtb6I7W+XkRFdNTsaLQfz8IqqN3D92mO3tdCv8
etag: "b6f8c3fb70e85d237b66b3e480c3ab26"
x-served-from: l1
access-control-allow-methods: HEAD, GET, OPTIONS
content-type: image/png
x-vhostid: 105, 11856
access-control-allow-origin: *
x-timestamp: 1696335342.22819
cache-control: max-age=13524022
accept-ranges: bytes
expires: Thu, 19 Sep 2024 15:44:02 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 Apr 2024 03:03:40 GMT
x-content-type-options: nosniff
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-WoW64
location: https://10945-2.s.cdn15.com/creatives/71940/284297/535966_4e233.png
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 0
expires: Mon, 26 Jul 2011 05:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240411&jk=2961533187805674&bg=!KyilKGfNAAbi8lI9wvI7ADQBe5WfOJQg_BIHYVmSxgFKmcTu9cMpB2wc3dxVfL1pIocyWa2C0stpOaZHuri6nHPPv6PEAgAAAExSAAAAA2gBB34ANcVZ2opv04EcfK_a4FItCYXOFMbPOlfMZer2rt87gE5tF5Y4n6yt40de9AIlSSRqke1ZenMKmQKcbBfkhkt1RbZgTJA1AhcoRly_7p0rDXa_E1mduqjH4BI_9IrhdLQ5SlYLto9zmgYDSB3ue3gEcp4UDTCVKNJ7VqnW86gDECzQ51UcZZs1-dcozDmvmJi6REdweR1ywId1_gBZlVCQr3iN3zfw83ryWxyPrT2x_XWWCqWycLKin0ZZ2efnk8cXHq2FcVK2HjCXenv4cKilcmEQVjDtILyQIRd9xs8JFUEkEh9yVgOlS1GtbyOBEgj-3Ye6Cx3vuGjhP3-EG9gvy2BG4iDXhojHlfQfYxUqbEIumK4KIPwye66Q5TNqZT9izEClA-pa_Jrgv9haqsbUx3pEPCiay8XoNbzlr0eZ5LEyibyZ8edLYDHePpEbMb-3H5VIrrigXkBmf5nm0GbwbtQPW1Yglr9W5QBd_cEygGrAYJ63d--2ME2jsnWYcM0MHtWY6q7lySIvV_H-jKjrO4QxbdDClOK9wFoTQKx5RNAY1dHA6kISBjZOocTb2_9JjeYeG1Nc4torGZ9JhB0dDkS4oSO1gMw-ZvHSfTMMTPPZJUsA9jsuAOON_RXLHhmaZ0oQD5g9Ki2WmdVXSBApYAip50D_-eBp3u5xz-z7_Pt-zmcjsOtxLTaEERsPpbmeirQ8UjNF9TAFPtFwyYMR1A5S767isVwCXnjP_fkKskU3gj4NLIvTMXxR9jBQjqj_cyTqx5uy2goBAwcrOmIBu6wqQ_YpEh5GTh77p3LWO1dWjd0XFl1fW8XP3g10Roo4VghfXNuqB32cYyt1KeI6IRNeoa3chp0Cp74zjkscZSj-fPGusfsvaG69noK-1r2uGAd_6rYlp0_zKRse890UU_GpNfv07NYMIFGYpSdkdt80KPXQC37mEZGB4wIlIqkg6dgx_Oo

Verdicts & Comments Add Verdict or Comment

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.gmsmedia.pics/	1970-01-21 05:29:56	Name: _ga Value: GA1.1.2007188947.1713236618
			.gmsmedia.pics/	1970-01-21 05:29:56	Name: _ga_N0LG27M8L8 Value: GS1.1.1713236617.1.0.1713236617.0.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10945-2.s.cdn15.com
fonts.googleapis.com
fonts.gstatic.com
glum-mortgage.com
invidget.switchblade.xyz
ka-f.fontawesome.com
pagead2.googlesyndication.com
r2.gmsmedia.pics
region1.google-analytics.com
tpc.googlesyndication.com
www.cutercounter.com
www.googletagmanager.com
pagead2.googlesyndication.com
2001:4860:4802:32::36
2606:4700:20::ac43:487c
2606:4700:3031::6815:4afb
2606:4700:e4::ac40:a507
2a00:1178:1:4b::19
2a00:1450:4001:809::200a
2a00:1450:4001:80b::2002
2a00:1450:4001:813::2003
2a00:1450:4001:813::2008
2a00:1450:4001:827::2002
2a00:1450:4001:82a::2001
47.89.219.37
67.216.89.16
0e81443469aa4b967191ce19b7474eb223746a2b8d5dc42d3786da84d99dfad9
134d30ed9c825909dd32af40d469aaafedfe1b17447abee0ed6c43c7254d2a48
1e745d7791d5061ecdbd60e603cf059a90951f18efd0dab417e87fe3ad2e1f49
2301bb030a2bcaa9c763cc4771bd717aac16709c29eaba00673fcbe7cdf99a59
236e285339a2a692e9491d356489cdf83513cfb1add049a0620123d644e47554
2c9644f034a7c343c658b15e8ca0608a0322018ccc995895518a44853413be6f
326788cc06f2403dddb891b1b2a5a4530751a509ce2207c58b58cdec3036237c
33667b0c8dde1f5b32c54f9d8b0b70ad8cbdc01ee881fd06ca3f0d5e9da2155a
39d7c7ac65d9e4421322a5ab7e0cd2fcead337da3c66749c65aa7f4bab785dad
447713b6239c288c374d4906a40fde72ed10f0b052cf5af680def097eedce693
44d80b32506d9decced07ce10e4d14f36d4610a27be92b5e2b51112b9e3e700f
4588dcd61f336a27e8f79c09ed32b48fc4fae3f222d59076fd2b8daa65daba64
46bf05e4101596386341b4c193ba9ef1ae1fb40dd26b87c10799e941d9425d2b
4d989de012143487e4c4a1becaf3150f754ea86483a85724150387d1b0f55139
5e0821588462d15b0ff8e911760fc041332c162e2e30ab4b1071bcc8eb6c8223
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6c58c4804370b9c347d517491c450416ca371fb1403aceaa1d6f751403b07c48
71b4f8993cf48a69b306d7639ec2536aa8c3ef268ff083d37a4c7052df24cd37
7625d2873ff74aa19885e86e164fc7ee122587bbe54dbb57c82a7d3b31b4b22f
812f346ba204c09c2bcfc54774e6eabde275329b49238b59846e2516edc69e9a
a86338081e5ba630b64ba27e36e0052908885e5af6adace25b468880e4d58c8d
ad95360941438449df1f2d001e27183ecb65c38854cc810f10bb31538b5c2d3d
af289ef9c0cbe28da3c0bfdcbdf9035b729bc19dd60ff608243fd7baa79fdc97
b2d8ca36828277232d1ec3f7c967745280081a338135501ffb4ebb4d2cb46793
c1c567e3cc6aeb229ffff4bc6f1cbb4c39cb995f1a7404ba28b1a1760fb3bc24
c3234cfbbb5246b4e59b0709eb239d0833d712fd4bc8f889d4697c7ca81f3d40
c9a3d179bfed32846024ccba2747d360ea292c74ee721f1924feb2bc4d6844f0
cf245e3d670cc0220fa53fe33770b35e643c203a03630c685391ab3dab40b5a2
d3e9a900f61c6811de529e4227226b898ce88b65a66347d0088a2da3af5e60b5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

r2.gmsmedia.pics Open in urlscan Pro 2606:4700:3031::6815:4afb Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

35 Requests

91 %HTTPS

85 %IPv6

11 Domains

12 Subdomains

14 IPs

3 Countries

749 kBTransfer

1556 kBSize

2 Cookies

2 Outgoing links

Page URL History

Redirected requests

35 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

r2.gmsmedia.pics Open in urlscan Pro
2606:4700:3031::6815:4afb Public Scan

Screenshot
Live screenshot

Full Image

35
Requests

91 %
HTTPS

85 %
IPv6

11
Domains

12
Subdomains

14
IPs

3
Countries

749 kB
Transfer

1556 kB
Size

2
Cookies

35 HTTP transactions
2 data transactions