jocoreport.com Open in urlscan Pro
158.106.132.162 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Submission: On November 07 via manual (November 7th 2023, 9:07:23 pm UTC) from US — Scanned from DE

Summary HTTP 220 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 32 IPs in 5 countries across 20 domains to perform 220 HTTP transactions. The main IP is 158.106.132.162, located in United States and belongs to PRIVATESYSTEMS, US. The main domain is jocoreport.com. The Cisco Umbrella rank of the primary domain is 712947.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 28th 2023. Valid for: 3 months.

This is the only time jocoreport.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
54	158.106.132.162 158.106.132.162	63410 (PRIVATESY...) (PRIVATESYSTEMS)
13	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2a00:1450:400... 2a00:1450:4001:813::200a	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
4	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	192.0.78.32 192.0.78.32	2635 (AUTOMATTIC) (AUTOMATTIC)
3	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
1	104.154.142.214 104.154.142.214	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c09::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
5	192.0.77.32 192.0.77.32	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
2	2a02:2638:3::12 2a02:2638:3::12	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
9	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:46::45 2620:1ec:46::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.1.108 151.101.1.108	54113 (FASTLY) (FASTLY)
2 5	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:2638:d::c 2a02:2638:d::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
14	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.1.6 178.250.1.6	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
48	2a02:2638:3::10 2a02:2638:3::10	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	2a02:2638:3::1a 2a02:2638:3::1a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	185.89.210.180 185.89.210.180	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
220	32

54 158.106.132.162 (United States)

ASN63410 (PRIVATESYSTEMS, US)

jocoreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 192.0.77.37 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

cdn2.lockerdomecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

jetpack.wordpress.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i2.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i1.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.154.142.214 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 214.142.154.104.bc.googleusercontent.com

lockerdome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c09::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

s0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

0.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::12 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

adsdk.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.1.108 (United States)

ASN54113 (FASTLY, US)

cdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2620:1ec:c11::200 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:d::c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.6 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

48 2a02:2638:3::10 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

imageproxy.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:2638:3::1a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.89.210.180 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ams3-ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
66	criteo.net static.criteo.net — Cisco Umbrella Rank: 668 imageproxy.eu.criteo.net — Cisco Umbrella Rank: 10986 csm.eu.criteo.net — Cisco Umbrella Rank: 10557	676 KB
54	jocoreport.com jocoreport.com — Cisco Umbrella Rank: 712947	2 MB
23	wp.com c0.wp.com — Cisco Umbrella Rank: 8386 stats.wp.com — Cisco Umbrella Rank: 2855 i2.wp.com — Cisco Umbrella Rank: 8766 i1.wp.com — Cisco Umbrella Rank: 8598 i0.wp.com — Cisco Umbrella Rank: 3823 pixel.wp.com — Cisco Umbrella Rank: 2799 s0.wp.com — Cisco Umbrella Rank: 8056	191 KB
20	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 tpc.googlesyndication.com — Cisco Umbrella Rank: 149	361 KB
12	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	72 KB
10	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	89 KB
6	criteo.com ads.eu.criteo.com — Cisco Umbrella Rank: 10450 rtb.fr3.eu.criteo.com — Cisco Umbrella Rank: 17732 cat.nl3.eu.criteo.com — Cisco Umbrella Rank: 11552	117 KB
5	bing.com 2 redirects www.bing.com — Cisco Umbrella Rank: 66	14 KB
5	adnxs.com cdn.adnxs.com — Cisco Umbrella Rank: 1682 ams3-ib.adnxs.com — Cisco Umbrella Rank: 6903	30 KB
4	gstatic.com fonts.gstatic.com	95 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 212	180 KB
3	google.com region1.analytics.google.com — Cisco Umbrella Rank: 3040 www.google.com — Cisco Umbrella Rank: 2	1 KB
2	gravatar.com 0.gravatar.com — Cisco Umbrella Rank: 8325	6 KB
1	microsoft.com adsdk.microsoft.com — Cisco Umbrella Rank: 4948	36 KB
1	google.de www.google.de — Cisco Umbrella Rank: 6862	408 B
1	lockerdome.com lockerdome.com — Cisco Umbrella Rank: 9348	2 KB
1	wordpress.com jetpack.wordpress.com — Cisco Umbrella Rank: 14663	6 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 110	2 KB
1	lockerdomecdn.com cdn2.lockerdomecdn.com — Cisco Umbrella Rank: 54713	3 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	1 KB
220	20

	Domain	Requested by
54	jocoreport.com	jocoreport.com
48	imageproxy.eu.criteo.net	ads.eu.criteo.com jocoreport.com
14	static.criteo.net	ads.eu.criteo.com
13	c0.wp.com	jocoreport.com
11	pagead2.googlesyndication.com	jocoreport.com pagead2.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com
10	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net jocoreport.com
10	www.googletagmanager.com	jocoreport.com
9	tpc.googlesyndication.com	googleads.g.doubleclick.net jocoreport.com pagead2.googlesyndication.com tpc.googlesyndication.com
5	www.bing.com	2 redirects googleads.g.doubleclick.net
5	s0.wp.com	jetpack.wordpress.com
4	ams3-ib.adnxs.com	googleads.g.doubleclick.net cdn.adnxs.com
4	csm.eu.criteo.net	ads.eu.criteo.com
4	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagservices.com	googleads.g.doubleclick.net jocoreport.com
2	cat.nl3.eu.criteo.com	ads.eu.criteo.com
2	rtb.fr3.eu.criteo.com	googleads.g.doubleclick.net jocoreport.com
2	ads.eu.criteo.com	googleads.g.doubleclick.net
2	0.gravatar.com	jetpack.wordpress.com 0.gravatar.com
2	stats.g.doubleclick.net	www.googletagmanager.com lockerdome.com
2	region1.analytics.google.com	www.googletagmanager.com
1	www.google.com	tpc.googlesyndication.com
1	cdn.adnxs.com	jocoreport.com
1	adsdk.microsoft.com	jocoreport.com
1	pixel.wp.com	jocoreport.com
1	www.google.de	jocoreport.com
1	lockerdome.com	cdn2.lockerdomecdn.com
1	i0.wp.com	jocoreport.com
1	i1.wp.com	jocoreport.com
1	i2.wp.com	jocoreport.com
1	jetpack.wordpress.com	jocoreport.com
1	www.facebook.com	jocoreport.com
1	cdn2.lockerdomecdn.com	jocoreport.com
1	stats.wp.com	jocoreport.com
1	fonts.googleapis.com	jocoreport.com
220	34

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
forecast.weather.gov
www.jocoreport.com
www.trianglepwh.com
www.cssjohnston.org
www.eyespecialistsofcarolina.com
www.sraconline.com
speakindeacon.com
www.governmentjobs.com
pinterest.com
api.whatsapp.com
reddit.com
consumer.ftc.gov

Subject Issuer	Validity	Valid
jocoreport.com cPanel, Inc. Certification Authority	`2023-10-28` - `2024-01-26`	3 months	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-14` - `2023-12-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
cdn2.lockerdomecdn.com R3	`2023-11-02` - `2024-01-31`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-08-17` - `2023-11-15`	3 months	crt.sh
*.wordpress.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.lockerdome.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-10-28`	a year	crt.sh
www.google.de GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
*.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-29` - `2023-12-23`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
adsdk.microsoft.com Microsoft Azure TLS Issuing CA 02	`2023-10-11` - `2024-04-08`	6 months	crt.sh
cdn.adnxs.com GeoTrust TLS RSA CA G1	`2023-03-27` - `2024-04-26`	a year	crt.sh
*.fr3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-07` - `2023-12-30`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-09` - `2024-01-06`	3 months	crt.sh
*.nl3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-30` - `2023-12-25`	3 months	crt.sh
*.eu.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-10-17` - `2024-01-18`	3 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 01	`2023-10-24` - `2024-04-21`	6 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh

This page contains 16 frames:

Primary Page: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Frame ID: 93868664837BB51FDF0806AC9F6D30E6
Requests: 103 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?href=https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/&layout=button_count&show_faces=false&width=105&action=like&colorscheme=light&height=21
Frame ID: B6225028383288EA5A015FC7C3CC8FB5
Requests: 1 HTTP requests in this frame

Frame: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Frame ID: 795609DABB060D47AF6A7C933031A073
Requests: 9 HTTP requests in this frame

Frame: https://lockerdome.com/lad/13412877050552934?pubid=ld-7876-5193&pubo=https%3A%2F%2Fjocoreport.com&rid=&width=696&path=%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F
Frame ID: 1F5BDB91EE9A083B5B399CB2BFBD0EF3
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20190131/zrt_lookup.html
Frame ID: 8A7A1991EFD7058070377FE9FA9B276B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9535448743609655&output=html&h=250&slotname=6455590121&adk=2182991139&adf=2133006309&pi=t.ma~as.6455590121&w=324&fwrn=4&fwrnh=100&lmt=1699391236&rafmt=1&format=324x250&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699391236648&bpp=4&bdt=823&idt=184&shv=r20231102&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&correlator=7123459135492&frm=20&pv=2&ga_vid=1793292123.1699391237&ga_sid=1699391237&ga_hid=1570003568&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1010&ady=2495&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079232%2C31079402%2C31079403%2C31079405%2C31079408%2C42532265%2C44806500%2C44807454%2C44807463%2C31078301%2C44808149&oid=2&pvsid=2368266610398721&tmod=1376857025&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=tXl0Z084bu&p=https%3A//jocoreport.com&dtd=199
Frame ID: 86DB680416F43DF3E41C4F92266CCC6A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9535448743609655&output=html&adk=1812271804&adf=3025194257&lmt=1699391236&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=236x810_l%7C236x810_r&format=0x0&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&ea=0&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&ascmds=1&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699391236877&bpp=2&bdt=1052&idt=2&shv=r20231102&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=324x250&nras=1&correlator=7123459135492&frm=20&pv=1&ga_vid=1793292123.1699391237&ga_sid=1699391237&ga_hid=1570003568&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079232%2C31079402%2C31079403%2C31079405%2C31079408%2C42532265%2C44806500%2C44807454%2C44807463%2C31078301%2C44808149&oid=2&pvsid=2368266610398721&tmod=1376857025&uas=0&nvt=1&fsapi=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=37
Frame ID: FA61346E2718DDE0F0E0AA69C54CBB91
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
Frame ID: 28C6DDCF003CCC35488695689BF660DF
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
Frame ID: 7DADDA8EB03204A7B6DE2CD72A776986
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
Frame ID: A636CAD418A674BFD92CD183C752D91B
Requests: 1 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZUqnBAAOp5YDog-WAAOWduIvFdP41yIRwe62fA&u=%7CsAtvhYYIvER3Vxa42Nv3cwjC1sjdvFAKjRYg0Xmo7c0%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z2MBXjcXbJi632UiAAo6A0UdjJ7Qpm4s7tehUJJ528QEFOLog6JV3lWny1Mw8cWd2Ar0QgcFpPebeK5VBIqk4CSIdRrRc8ebSjgxuyIDWLMkBszuiApxq-wAopVY13Gpn-2sMmG6GteKkaz0mSuj1QIvSfDIX1hJHYpv2xrwJml1_hJSFAD8j4cV7KxOc0gKWvFwhSnAyn_YWC_4CYNib397Hu-Nqz0f1HN-MKnMtfGUxCvYaj03vl1j_VQSCtfehQvIrqOpcdI76HQeftadjxb2n4eF7nvW8ijFAdKInyaCnV5L3U1cT1sFP6AUVt5h12PtsnbMz-kXXVI0x90lBMqVSSQLMIPMhWHc4PYy_ribZiPyy7rp2njjju-eUeDNlOPXCYMuwlNJDR-IUfXDA1XQcDljl2ByqWYMoH0p0aJ4o3P-x66wRukjGcxXZ92j_DOBvXC3G8bCDHi46sSpSpHZIMsFnH5RA6_afILtb8GR5-_IinUEwg1kBIVbinpws_RUJ4MUPeLhYUP8zp6EKqjo54TxBndq8HevCRHRYCpKpVtyBcyUU5faVDAmJUxjA0&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4aZwBKdKZZbPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSrAk_Qu2rqE3hHTlTFmNREINfEE_eJMQ-CTauFiemKRxFr3myYtseg70e5Zrg6JB4BlJj4L9bOdqxM847ndUNzPaNmIJKXwJYCyHur2OXzhuocw3xmHO98ejsPanc6lW2iAVBBIM8wV9x7bikeCKYaIIlZqvlvghyv3hJDSzNg2h7i6IVIVv3R5m1yaT3W-sw-l4n20pITDsVAGY8DkF7NtTxxpFlG6-mziQpJYpdQfwHgDx7O6Y5haaIat0UGiEanaGFW1gtos5h--AuqZg5z3ae0Jv9TASAn2XYPQiyVcXxShysNl6j7GC7JTvLFF84C-IuWPjPvIQN69eFHHW_GHKtTVZi2ioCaNU_5DI_lxyFNaz-tcQnljcwPDMemE1BYY6ixb_M8lx1mYQ3EgAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3CqF9m8MqM-iMnCVUwlDJCt0vh8A%26client%3Dca-pub-9535448743609655%26adurl%3D
Frame ID: 157914947F5C74F1524558114D024ABB
Requests: 15 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZUqnBAAOp5cDog-WAAOWduWZ4wAHC_H-CZLeeg&u=%7CsAtvhYYIvER%2FJ61tN3Whg3D%2FgYSTtkXbU%2F1RBHjoRmE%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgN28ygJ6EDhxYL4tGcGng8JDU2mC5yco3mYRoKdwO4uFFjnqECsJkw59anr33xBmzvFtJwx5jyXnNEVq7G3KuD7UzoNGK6B7gcMFIAXGcHdblJlLeikrUGCqaIdtMgBEHq7ozdN8PXbwbcwqR7ZRoE06tjRZeka_KGMxKNI8VGHJjfcNyD6xQiT4knkos39uJ3vjrYVn-0-27FpkdZQKdM9Vytqo5uR661YtChX47wuBbN9CY09RVzA17SmzpRlJC6JoQA2HCaDGt9agWK-HlgTgSh3LR7tHhGBGnMgA8o3e--nE_SahOOtBpU6Q1lTOlW6b879y4N150J30kYji5WRcJnh1VSP6-ib-PT1VXLkuxktlPmwI88Q-VkpRnR10YU-vaXgBYvIkLdmRd_HijZhKKP2UCwekLYvrOFi6FVratlqxuAitN1kCZhP7sKMi_U31L4NuFIY5k7EqtjhoQbr-qmPGDoKfxJO7oLuPmt8SuyxwuUH6OwjPQ2iwPzE6Ahcx20E1cz-qa54T_V8HeLDSEHXkKM4rclADqQqd3jBzuZU58JTraf6IRHjroRFHAc&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNg9ABKdKZZfPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSqAk_QtLKQNmSkT-vQz30JuXUOoXqjIRTDyvvbPtiea3ESZWUGzPxngGNt5YduDuP1j_pIzoth2P8ohjwqkgxoyzgE11ReMagv15SaZkEP87c4hO7SBEgEb7qqUAr5ObrKkDWXzkXAtpFW2vU1SqqrJBa39SShbHotBe9ZvL0lWIGFvL_U2iyr9m5pD03aCpJn6vbVKbRvLYh_NKU8Yrw7MGJaRQ3NGme2PD6uvKLe-ouNX_UgPn9FvTuG-Pf20nTnB2QXf6Od2BmnR-xzXRIc42JFY76Mdxa2FhEA0UFUqMJIzwW3pzVpALehpce648HbUAyk6q0s-GzSD6mBaLma4ntsJaKVLJ5JngAxlmOjadOy5Ubo3eum_KRqh3VB33PI4hvA7P9G395GpY2ABvWnnZCYlf64cKAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_09i3tqiM-hb_py06NHrGX4Ail6lQ%26client%3Dca-pub-9535448743609655%26adurl%3D
Frame ID: 8E46998E0E6240D503B1FD796DEB5673
Requests: 55 HTTP requests in this frame

Frame: https://adsdk.microsoft.com/native-to-display/sdk.js
Frame ID: 68717FC1A001F531F86897F6AB6A66BF
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9535448743609655&output=html&h=60&slotname=9717900006&adk=307472247&adf=4049190488&pi=t.ma~as.9717900006&w=468&lmt=1699391238&format=468x60&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699391238509&bpp=1&bdt=2684&idt=0&shv=r20231102&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D254ba367273a0f66%3AT%3D1699391236%3ART%3D1699391236%3AS%3DALNI_MZ0Z9gYYTd1RhrFgE2IH-VSCqEq3Q&gpic=UID%3D00000cbc14c6dc05%3AT%3D1699391236%3ART%3D1699391236%3AS%3DALNI_MZZXctcfMyJ5TydXjiC3NrRstYp5A&prev_fmts=324x250%2C0x0%2C1005x124%2C200x600%2C160x600&nras=4&correlator=7123459135492&frm=20&pv=1&ga_vid=1793292123.1699391237&ga_sid=1699391237&ga_hid=1570003568&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=380&ady=854&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079232%2C31079402%2C31079403%2C31079405%2C31079408%2C42532265%2C44806500%2C44807454%2C44807463%2C31078301%2C44808149&oid=2&psts=AOrYGsnxSN3Rbk3Gz8jlJxNvT059O9hQf88cAUfuqTrqJPhW-iCMq5YUdZzqFgSfS4FdcJjgwU_l1duxJBkprMatIZBgXVZs9EhTCS2R19M%2CAOrYGslYeJeVYeyraS-6v7C8SYh9ZyQzxW6TMf-Kl4EQPKayUapYHXrnqlk3AS8oFl5Ds2BuVTImiXor6EDw94fHR4wd68ujjgdqlLMSPOE&pvsid=2368266610398721&tmod=1376857025&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&xpc=JDbi1QFH2X&p=https%3A//jocoreport.com&dtd=4
Frame ID: 36CB6AB5559DB772B6E6A601C3C0BE75
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 7C3E9EE61631AB68856F9B160E0DA58E
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 333A3A0A930893718C7762FF647E38E5
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Man Loses $15,000 After Clicking On Fraudulent Website | JoCo Report

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
<link[^>]+s\d+\.wp\.com
/wp-(?:content|includes)/

Chart.js (JavaScript Graphics) Expand

Overall confidence: 75%
Detected patterns

/Chart(?:\.bundle)?(?:\.min)?\.js

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Underscore.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

underscore.*\.js(?:\?ver=([\d.]+))?

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

220
Requests

98 %
HTTPS

65 %
IPv6

20
Domains

34
Subdomains

32
IPs

5
Countries

3546 kB
Transfer

8058 kB
Size

6
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/johnstoncountyreport
Title: Facebook

Search URL Search Domain Scan URL

URL: http://twitter.com/jocoreport
Title: Twitter

Search URL Search Domain Scan URL

URL: http://forecast.weather.gov/MapClick.php?CityName=Smithfield&state=NC&site=RAH&textField1=35.5073&textField2=-78.3441&e=0
Title: Weather

Search URL Search Domain Scan URL

URL: http://www.jocoreport.com/
Title: Community

Search URL Search Domain Scan URL

URL: http://www.trianglepwh.com/

Search URL Search Domain Scan URL

URL: https://www.cssjohnston.org/shiip/

Search URL Search Domain Scan URL

URL: http://www.eyespecialistsofcarolina.com/

Search URL Search Domain Scan URL

URL: http://www.sraconline.com/

Search URL Search Domain Scan URL

URL: https://speakindeacon.com/

Search URL Search Domain Scan URL

URL: https://www.governmentjobs.com/careers/johnston/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Man+Loses+%2415%2C000+After+Clicking+On+Fraudulent+Website&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&via=jocoreport
Title: Twitter

Search URL Search Domain Scan URL

URL: https://pinterest.com/pin/create/button/?url=https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/&media=https://jocoreport.com/wp-content/uploads/2019/07/Updated-Fraud-Alert-FI-Image.jpg&description=Man+Loses+%2415%2C000+After+Clicking+On+Fraudulent+Website
Title: Pinterest

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=Man+Loses+%2415%2C000+After+Clicking+On+Fraudulent+Website%20%0A%0A%20https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Title: WhatsApp

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/&title=Man+Loses+%2415%2C000+After+Clicking+On+Fraudulent+Website
Title: ReddIt

Search URL Search Domain Scan URL

URL: https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams#:~:text=Two%20Things%20To%20Know%20To,or%20click%20on%20a%20link.
Title: Federal Trade Commission

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 126

https://www.bing.com/api/v1/mediation/tracking?adUnit=391466&auId=3dd65340-bf9e-4aef-b1f3-39ecba6eb82c&bidId=15000&bidderId=4&cmExpId=V5&oAdUnit=391466&publisherId=162645330&rId=4b8b88c2-2244-4978-b53e-b41595194fcb&rlink=https%3A%2F%2Fwww.bing.com%2Faes%2Fc.gif%3FDI%3D0%26DIS%3DSB_15000-1-0%3F%26RG%3De1925e0048924a6494f2525759aa2476%26SNR%3D1%26GV%3D2%26med%3D10&rtype=miFeedbackURL&tagId=6929499&trafficGroup=knaqe_3c&trafficSubGroup=fgnoyrvqcnff&aid=5741273846053489434 HTTP 303
https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=e1925e0048924a6494f2525759aa2476&SNR=1&GV=2&med=10

Request Chain 221

https://www.bing.com/api/v1/mediation/tracking?adUnit=391466&auId=3dd65340-bf9e-4aef-b1f3-39ecba6eb82c&bidId=15000&bidderId=4&cmExpId=V5&oAdUnit=391466&publisherId=162645330&rId=4b8b88c2-2244-4978-b53e-b41595194fcb&rlink=https%3A%2F%2Fwww.bing.com%2Faes%2Fc.gif%3Ftype%3Dmv%26reqver%3D1.0%26rg%3De1925e0048924a6494f2525759aa2476%26tids%3D15000%26med%3D10&rtype=mvFeedbackURL&tagId=6929499&trafficGroup=knaqe_3c&trafficSubGroup=fgnoyrvqcnff&aid=5741273846053489434 HTTP 303
https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=e1925e0048924a6494f2525759aa2476&tids=15000&med=10

220 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/ 175 KB
30 KB 1057ms
273ms Document
text/html 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 265fbae178ad2588b24a74bc696202921bad6a75d1ccbbad5e7973254dad1247

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 30088
content-type: text/html; charset=UTF-8
date: Tue, 07 Nov 2023 21:07:15 GMT
etag: "1136222-1699382833;br"
link: <https://jocoreport.com/wp-json/>; rel="https://api.w.org/" <https://jocoreport.com/wp-json/wp/v2/posts/164090>; rel="alternate"; type="application/json" <https://wp.me/p8IhE0-GGC>; rel=shortlink
server: LiteSpeed
vary: Accept-Encoding
x-litespeed-cache: hit

GET
H2 200 style.min.css
c0.wp.com/c/6.3.2/wp-includes/css/dist/block-library/ 102 KB
13 KB 83ms
23ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/css/dist/block-library/style.min.css

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Wed, 19 Jul 2023 11:13:55 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
c0.wp.com/c/6.3.2/wp-includes/js/mediaelement/ 11 KB
3 KB 83ms
23ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 wp-mediaelement.min.css
c0.wp.com/c/6.3.2/wp-includes/js/mediaelement/ 4 KB
1 KB 83ms
23ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/mediaelement/wp-mediaelement.min.css

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 blockstyles.css
jocoreport.com/wp-content/plugins/post-type-archive-mapping/dist/ 16 KB
2 KB 144ms
136ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/post-type-archive-mapping/dist/blockstyles.css?ver=all
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: d752b2f14caf7002e6f1bfcabeca1e7ca15741453ec1c631167778f14eba6223

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 27 Sep 2023 19:03:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 2256
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 style.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 32 KB
4 KB 144ms
137ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/style.css?v=4.3.22&ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ae49cdb646041a29468125dcba23a151c43da21996b3ae5fb87179255af52668

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 4424
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 user-panel.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 3 KB
702 B 145ms
138ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/user-panel.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: c10aa37ef938366c816705ca3a114fdc2eed926a4f48d963a32358d0e8be80af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 669
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 all.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/ 52 KB
5 KB 145ms
139ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/all.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: dd2d3b8d18bdbf9be075bb3195b6784877c69209e97c48ffa5d30120bea21215

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Tue, 07 Nov 2023 21:07:15 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 animate.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 124 KB
8 KB 146ms
139ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/animate.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ad96484d7d3a3193cfde0088f1e90a2c5904111ae96016b5bf952a5198281be9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 8362
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 chart.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 7 KB
878 B 146ms
139ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/chart.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: bf768039ec7c9b08b3971013138f995af3fc993606e6d42dc7389d01f6ee7a1f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 845
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 bsa.carousel.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 1 KB
509 B 146ms
140ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/bsa.carousel.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 0d0128fe46a93bd170b68b2dcb29a9ba93601d3730a3d2f01f8b716e7648cad7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 476
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 material-design.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 12 KB
2 KB 147ms
140ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/material-design.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 20d29d0ad14066db520559214845ba6c250aa4a12b53db633c932189e9a7a688

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 2073
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 ui-datapicker.css
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ 4 KB
677 B 148ms
142ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/css/asset/ui-datapicker.css?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: d00c867e4178b1482b25c185aaceb8ae071be2a1e7b91acc46d89c4e64b11fb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 644
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 style.css
jocoreport.com/wp-content/plugins/td-composer/td-multi-purpose/ 38 KB
4 KB 149ms
143ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/td-multi-purpose/style.css?ver=2542f6ebea260f8fc5fdc19a93688182
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 67e17eded48efd41da15c98b87275c8c4ef6a641859c4f253f0409219bdcad13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 4521
expires: Thu, 07 Dec 2023 21:07:15 GMT

GET
H2 200 css
fonts.googleapis.com/ 15 KB
1 KB 94ms
35ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C500%2C700&display=swap&ver=12.6.1

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

515fbfeb51a45e120dc53c8bfda86c38d3b8e7f3163ff22515437237ea3ea0f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 07 Nov 2023 20:22:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 07 Nov 2023 21:07:15 GMT

GET
H2 200 style.css
jocoreport.com/wp-content/themes/Newspaper/ 153 KB
24 KB 274ms
268ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/themes/Newspaper/style.css?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: e7926dc4d0147b1cf005939a3cef091028d810de29aae9eac958dd8ad4a09f2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:35 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 24820
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 js_composer.min.css
jocoreport.com/wp-content/plugins/js_composer/assets/css/ 454 KB
40 KB 275ms
270ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=7.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9caf317a3fad7fec391eda2d238ebeb2bf8d1127766a84f41b5464aabd76b79a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:16:45 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 40989
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 td_legacy_main.css
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/ 166 KB
23 KB 407ms
402ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/assets/css/td_legacy_main.css?ver=2542f6ebea260f8fc5fdc19a93688182
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: af3a01e20fbba9da6246a49945791e48be0a7014fbebd42b2f243507aeafd5ad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:42 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 23964
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 td_standard_pack_main.css
jocoreport.com/wp-content/plugins/td-standard-pack/Newspaper/assets/css/ 717 KB
57 KB 408ms
403ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-standard-pack/Newspaper/assets/css/td_standard_pack_main.css?ver=c9508b77873a9bade42bf83161789cd5
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 792180698e17019192621dfb6615fb58b7b158c5bcb9c8e08ee92d51bea79791

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:16:11 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 58572
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 tdb_main.css
jocoreport.com/wp-content/plugins/td-cloud-library/assets/css/ 47 KB
7 KB 543ms
538ms Stylesheet
text/css 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-cloud-library/assets/css/tdb_main.css?ver=58af2c94cc275a541409dcdc9b94a2b0
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 82932a8e8382473453096e4dfdd0223611789dafd09182838a79f8e34403b420

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:50 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 6990
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/12.6.2/css/ 98 KB
17 KB 81ms
24ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/12.6.2/css/jetpack.css

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

1170849a1f6deb911dc030011d8bcc57a6caaf659343e66114fb2f87369ed40e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Mon, 11 Sep 2023 22:30:19 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/jquery/ 85 KB
29 KB 81ms
24ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/jquery/jquery.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 26 May 2023 11:33:35 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/jquery/ 13 KB
5 KB 80ms
24ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 thickbox.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/thickbox/ 13 KB
4 KB 80ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/thickbox/thickbox.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

c0e09e793fb79507dc97ed702a4c2c9c00ab4d1677bd45bcd112e203c96dd661

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Mon, 30 May 2022 14:53:11 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 underscore.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/ 18 KB
7 KB 80ms
24ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/underscore.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Tue, 27 Sep 2022 15:18:25 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 shortcode.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/ 3 KB
1 KB 122ms
66ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/shortcode.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

88d22d83af1b6a5a266b51048004fb4ad7e2ca34bef788d61182a9108d658a1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 23 Sep 2022 19:55:30 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 media-upload.min.js Show response
c0.wp.com/c/6.3.2/wp-admin/js/ 1 KB
871 B 121ms
66ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-admin/js/media-upload.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

30cac3693b641b4c3ef678eacd92f8dc38ac68c498bd4f9d92e832471ada8b78

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:15 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Thu, 02 Feb 2023 16:36:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:15 GMT

GET
H2 200 script.js Show response
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/ 2 KB
616 B 542ms
539ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/script.js?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9b06f441b65c4299ee34eba83aca8c325b917b545c1a2e86583c386681d6960a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 566
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 jquery.viewportchecker.js Show response
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/ 5 KB
1 KB 542ms
539ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/jquery.viewportchecker.js?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 32f51e3b34ff3998b47132a01acb777cf636a2df90838b0e30617bf06ab46d7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 1490
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 chart.js Show response
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/ 100 KB
22 KB 542ms
540ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/chart.js?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 118240d079e9006dfd8328d78acabb9ad7011c432a9d665476453861701b79a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 22770
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 bsa.carousel.js Show response
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/ 52 KB
8 KB 542ms
540ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/bsa.carousel.js?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9221608a4df26c3a67d553a85ea42269235ca69d2ff47419148853830d5cea2d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 8455
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 jquery.simplyscroll.js Show response
jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/ 12 KB
3 KB 543ms
541ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/bsa-plugin-pro-scripteo/frontend/js/jquery.simplyscroll.js?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: b4f46f8fbddc011bd07448cdf7b2b1f9edd734b534677581f5c49a55984593df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 11 Mar 2020 12:39:41 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 3070
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 260 KB
88 KB 103ms
46ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-5NERW1W9PD

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

573736701009177204f284927ce78619b455a8571504efc199d487f83ae8b72f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 89820
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 07 Nov 2023 21:07:16 GMT

GET
H2 200 The-Johnston-CR-with-shadow.png
jocoreport.com/wp-content/uploads/2019/06/ 90 KB
90 KB 543ms
542ms Image
image/png 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2019/06/The-Johnston-CR-with-shadow.png
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9ea6aaf42186073ffcd53912f4cc93b997d050986223ee55ae0ab2661f2d2134

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Thu, 06 Jun 2019 03:20:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 91697
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 dxxyLK_triprehealth2_468x60.jpg
jocoreport.com/wp-content/uploads/2023/10/ 17 KB
17 KB 544ms
542ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2023/10/dxxyLK_triprehealth2_468x60.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: c258caf8b9e4f16d2333a394f14aa0a8a376e3c591412f91a2264bf440f6e2f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Sat, 21 Oct 2023 19:25:17 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 17078
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 Insurance-CSS-Banner.jpg
jocoreport.com/wp-content/uploads/2018/07/ 14 KB
14 KB 143ms
142ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2018/07/Insurance-CSS-Banner.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 6bf4dd03b427c54380c1d4faf18bf8f27884fd50f0d798a9b6520579c728c64d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Wed, 18 Jul 2018 15:20:59 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 14274
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 Eye-Specialists_WEB-ready.jpg
jocoreport.com/wp-content/uploads/2020/10/ 18 KB
18 KB 144ms
143ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2020/10/Eye-Specialists_WEB-ready.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ae4d865d44e906f3b7deb27e0e06f90b10340a50c04e7aa0a8d6d723afa6d2e9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Thu, 22 Oct 2020 11:17:37 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 18519
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 SRAC-Banner.jpg
jocoreport.com/wp-content/uploads/2022/11/ 51 KB
52 KB 150ms
145ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2022/11/SRAC-Banner.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: b853c94e04ed6ed68a68fb1cd7aad27cf4fce648c3cca7db5daad27df41f670c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Sat, 12 Nov 2022 18:54:53 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 52617
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 DJAG-JOCO-030722-468X60.jpg
jocoreport.com/wp-content/uploads/2022/03/ 20 KB
20 KB 319ms
316ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2022/03/DJAG-JOCO-030722-468X60.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: e688e2ec0740da10d3fe73ce5b3e6e27ac56097cf0cc8be84b668303e4823d9b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Tue, 08 Mar 2022 21:34:13 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 20589
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 JohnstonHiringJocoReportBanner-1.png
jocoreport.com/wp-content/uploads/2023/05/ 21 KB
21 KB 450ms
448ms Image
image/png 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2023/05/JohnstonHiringJocoReportBanner-1.png
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 49aab3654c0477abd8a4137c2e80f8ff473eb401ca56ee7e2b7cf3f1fa2b7ec4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Mon, 15 May 2023 20:03:42 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 21745
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 JoCo-New-Logo-Rounded-square.png
jocoreport.com/wp-content/uploads/2021/04/ 174 KB
174 KB 451ms
449ms Image
image/png 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2021/04/JoCo-New-Logo-Rounded-square.png
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 5da1617482eb179636908105424caee158524df7cf02f07a8d5feec5fadbd8b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Fri, 30 Apr 2021 02:27:01 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 177728
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
52 KB 136ms
74ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e098e2b3ea73499b2d72375cf5c9c691c5a81b6b8994c97e7e60a915dfcc7c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52496
x-xss-protection: 0
server: cafe
etag: 17624541295382131865
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:16 GMT

GET
H3 200 image-cdn.js Show response
jocoreport.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/ 701 B
388 B 194ms
189ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/jetpack/jetpack_vendor/automattic/jetpack-image-cdn/dist/image-cdn.js?minify=false&ver=132249e245926ae3e188
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 27 Sep 2023 19:03:46 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 330
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 jquery.adrotate.dyngroup.js Show response
jocoreport.com/wp-content/plugins/adrotate-pro/library/ 3 KB
1 KB 194ms
190ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/adrotate-pro/library/jquery.adrotate.dyngroup.js
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 10e1c97e5d8cf7ee6133ede9d27a66432777870640c099783d617d7cb4682c19

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Sun, 11 Aug 2019 14:09:54 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 1117
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 core.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/jquery/ui/ 21 KB
7 KB 28ms
22ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/jquery/ui/core.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Thu, 02 Feb 2023 16:36:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:16 GMT

GET
H2 200 datepicker.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/jquery/ui/ 36 KB
11 KB 28ms
23ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/jquery/ui/datepicker.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

db5ffd916dbeb4938cc236cb3a42e73a56987f28c5deb9f3beccbe2c4af19307

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Thu, 02 Feb 2023 16:36:32 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:16 GMT

GET
H3 200 js_posts_autoload.min.js Show response
jocoreport.com/wp-content/plugins/td-cloud-library/assets/js/ 5 KB
2 KB 261ms
258ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-cloud-library/assets/js/js_posts_autoload.min.js?ver=58af2c94cc275a541409dcdc9b94a2b0
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 2bd2cf513443967c84694435a79964881012973b858a062e51fe5ebb9714cdde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 10:02:19 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:50 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 1899
expires: Thu, 07 Dec 2023 10:02:19 GMT

GET
H3 200 tagdiv_theme.min.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 156 KB
37 KB 262ms
258ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tagdiv_theme.min.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: b885670b8d44a105a61e6d2d7ab91ce1069ba87c4bc94e33d2b65910efba0cbf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 37701
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdPostImages.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 2 KB
599 B 372ms
368ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdPostImages.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 78a137d5382f19aaea55e95b55e39a7829de05832714fc275d8a10312a3539d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 577
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdSocialSharing.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 3 KB
862 B 372ms
369ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdSocialSharing.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 8e81fcac714f76272bbeb4872fed3a4b84410ed89fe0243acf406986a7611b27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 840
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdModalPostImages.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 9 KB
1 KB 372ms
369ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdModalPostImages.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ed5724159a8f6ac6e42d3a8b66fdc874b0a197c53368a09579cd67fdd5fcc094

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 1286
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 comment-reply.min.js Show response
c0.wp.com/c/6.3.2/wp-includes/js/ 3 KB
2 KB 27ms
23ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/6.3.2/wp-includes/js/comment-reply.min.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
strict-transport-security: max-age=15552000
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 21:07:16 GMT

GET
H2 200 e-202345.js Show response
stats.wp.com/ 7 KB
3 KB 90ms
28ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202345.js
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/13576-1684464982353.1523
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Mon, 04 Nov 2024 07:34:58 GMT

GET
H3 200 js_files_for_front.min.js Show response
jocoreport.com/wp-content/plugins/td-cloud-library/assets/js/ 29 KB
6 KB 376ms
373ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-cloud-library/assets/js/js_files_for_front.min.js?ver=58af2c94cc275a541409dcdc9b94a2b0
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9d51ffab743363599c622d663c66dc987b6538e1342eabb0ede175dbb6863478

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:50 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 5883
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 akismet-frontend.js Show response
jocoreport.com/wp-content/plugins/akismet/_inc/ 10 KB
3 KB 392ms
390ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/akismet/_inc/akismet-frontend.js?ver=1694642873
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Wed, 13 Sep 2023 22:07:53 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 2819
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdLoadingBox.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 3 KB
611 B 384ms
381ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdLoadingBox.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: a51003115e6640ac72b7a1c6525250bd66ff3cb60f207168c9aef0369c484098

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 589
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdDatei18n.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 2 KB
951 B 384ms
381ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdDatei18n.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 801b3a26f4f89ae50c0501d3d1a6064dbf9ebc4660ba75e8de40f15bfc0b6f74

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 929
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdAjaxSearch.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 6 KB
1 KB 384ms
381ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdAjaxSearch.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: ced232c8b6b165ef0cb92272d25f07dc37d0a37b54932735a0bc3e5113132d85

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 1358
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdLogin.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 13 KB
3 KB 385ms
383ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdLogin.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 336a25d31d729ad4223f664f1c0e4f82778979cb5ca97edd303d40241d6b272c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 2556
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdMenu.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 4 KB
1 KB 393ms
390ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdMenu.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 3d97c7a354ee5666e22c59498be5331a0edee5d6f7527a58a5744f323173bc8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 1219
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 tdInfiniteLoader.js Show response
jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/ 2 KB
628 B 393ms
390ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/plugins/td-composer/legacy/Newspaper/js/tdInfiniteLoader.js?ver=12.6.1
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: f2be0d99588fd30f81f9d519e27422142ecb0af1d4ed5bc7e81d4eb32fe99978

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Thu, 05 Oct 2023 18:15:43 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 606
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
BLOB 200
OK e7425986-d2bf-4723-9011-acddda17bbed
https://jocoreport.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://jocoreport.com/e7425986-d2bf-4723-9011-acddda17bbed
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H3 200 The-Johnston-CR-with-shadow.png
jocoreport.com/wp-content/uploads/2019/06/ 90 KB
90 KB 454ms
452ms Image
image/png 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/2019/06/The-Johnston-CR-with-shadow.png
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9ea6aaf42186073ffcd53912f4cc93b997d050986223ee55ae0ab2661f2d2134

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:57:36 GMT
last-modified: Thu, 06 Jun 2019 03:20:44 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 91697
expires: Thu, 07 Dec 2023 20:57:36 GMT

GET
H/1.1 200
OK ajs.js Show response
cdn2.lockerdomecdn.com/_js/ 7 KB
3 KB 135ms
29ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: /
Resource Hash: 3dffa84e13fbc367c907ff31e293923484de18c4c06cac97109e4b9a1b19752c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Date: Tue, 07 Nov 2023 21:07:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 30 Oct 2023 23:51:31 GMT
ETag: W/"1a71-18b82ffe89d"
X-HW: 1699391236.cds336.fr8.hn,1699391236.cds136.fr8.c
Content-Type: application/javascript; charset=UTF-8
Cache-Control: public, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2973

GET
DATA 200
OK truncated
/ 121 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 newspaper.woff
jocoreport.com/wp-content/themes/Newspaper/images/icons/ 33 KB
33 KB 250ms
249ms Font
font/woff 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-content/themes/Newspaper/images/icons/newspaper.woff?23
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/wp-content/themes/Newspaper/style.css?ver=12.6.1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 84ff5956551fc72f1de653dbcc731847e839614696a06b6fb65bc900993b6c9c

Request headers

Referer: https://jocoreport.com/wp-content/themes/Newspaper/style.css?ver=12.6.1
Origin: https://jocoreport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Thu, 05 Oct 2023 18:15:35 GMT
server: LiteSpeed
content-type: font/woff
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 33384
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
47 KB 131ms
68ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C500%2C700&display=swap&ver=12.6.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jocoreport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Thu, 02 Nov 2023 18:16:19 GMT
x-content-type-options: nosniff
age: 442257
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Nov 2024 18:16:19 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 103ms
41ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C500%2C700&display=swap&ver=12.6.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jocoreport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 17:26:14 GMT
x-content-type-options: nosniff
age: 13262
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Nov 2024 17:26:14 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 97ms
35ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C500%2C700&display=swap&ver=12.6.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jocoreport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 19:40:17 GMT
x-content-type-options: nosniff
age: 91619
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 19:40:17 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 87ms
62ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans%3A400%2C600%2C700%7CRoboto%3A400%2C500%2C700&display=swap&ver=12.6.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://jocoreport.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 18:18:43 GMT
x-content-type-options: nosniff
age: 96513
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 05 Nov 2024 18:18:43 GMT

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame B622 0
2 KB 127ms
53ms Document
text/html 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?href=https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/&layout=button_count&show_faces=false&width=105&action=like&colorscheme=light&height=21

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 07 Nov 2023 21:07:16 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
x-content-type-options: nosniff
x-fb-debug: yZgXbC+lJMS9gOYtKWgDhlI3iSdjrsZH+DKRNQgpdgKVNgTplu9X1+FDTgGxqFmaA0r3npYhhS55X9L80w42Iw==
x-xss-protection: 0

GET
H2 200 / Show response
jetpack.wordpress.com/jetpack-comment/ Frame 7956 17 KB
6 KB 336ms
253ms Document
text/html 192.0.78.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

66621c8bcb04970172781f7d4f84a671b6f8b100a741d2bef4b6b8da6b6b1404

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 07 Nov 2023 21:07:16 GMT
host-header: WordPress.com
server: nginx
strict-transport-security: max-age=31536000
vary: Accept-Encoding accept, content-type
x-ac: 2.hhn _dca MISS
x-hacker: Want root? Visit join.a8c.com/hacker and mention this header.

GET
DATA 200
OK truncated
/ 111 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ae5b52b01b37efb4547c3493f75abf51dc034326bb6f1ff6fc97348065716ba

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 101 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c9a612722eed86936463bc8772a9d4509e0c24f22485221beaa583a60079fef2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
51 KB 126ms
126ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fcc77a69f0cac24091c193d08f2e3e591ef2e6e3b2b1f7afcae7f4fdce0afdbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52494
x-xss-protection: 0
server: cafe
etag: 10150716594722606051
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:16 GMT

GET
H2 200 Widbee-Banner-330x120.gif
i2.wp.com/jocoreport.com/wp-content/uploads/2017/03/ 20 KB
20 KB 92ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i2.wp.com/jocoreport.com/wp-content/uploads/2017/03/Widbee-Banner-330x120.gif

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

a11c7a846c9d7f1b4989494cfa26ff2495baa2f0b2dfaca4723cd0432077ce87

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 20104
x-nc: HIT hhn 4
last-modified: Sat, 07 Oct 2023 01:05:16 GMT
server: nginx
etag: "bdff835cc37abe98"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://jocoreport.com/wp-content/uploads/2017/03/Widbee-Banner-330x120.gif>; rel="canonical"
expires: Mon, 06 Oct 2025 13:05:16 GMT

GET
H2 200 jackson_324x236.jpg
i1.wp.com/jocoreport.com/wp-content/uploads/2018/01/ 12 KB
12 KB 89ms
25ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i1.wp.com/jocoreport.com/wp-content/uploads/2018/01/jackson_324x236.jpg

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

05a8d6c5577f0ce383fbf0b787eae9683a166a5aae7bca27fc6d59c53b413f02

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 12216
x-nc: HIT hhn 3
last-modified: Sun, 06 Nov 2022 13:08:36 GMT
server: nginx
etag: "dd685c5b30dc07ba"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://jocoreport.com/wp-content/uploads/2018/01/jackson_324x236.jpg>; rel="canonical"
expires: Wed, 06 Nov 2024 01:08:36 GMT

GET
H3 200 1686961823-djag-side-banner-current.jpg
jocoreport.com/wp-content/uploads/bsa-pro-upload/ 18 KB
18 KB 369ms
368ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/bsa-pro-upload/1686961823-djag-side-banner-current.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 557241f266bd000f857b9a60391814932edc82f99323995a792bf865c1462f75

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Sat, 17 Jun 2023 00:30:22 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 18326
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H2 200 2020-CSS-HealthProg324x110ad.jpg
i0.wp.com/jocoreport.com/wp-content/uploads/2020/06/ 12 KB
12 KB 85ms
24ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/jocoreport.com/wp-content/uploads/2020/06/2020-CSS-HealthProg324x110ad.jpg

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

7b245536cb06c2a98a0b4afa4cde3671854c5c348cc2af396592e2cfb9e18cec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 11962
x-nc: HIT hhn 4
last-modified: Sat, 13 Nov 2021 14:24:24 GMT
server: nginx
etag: "1614cc21dd95f8e4"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://jocoreport.com/wp-content/uploads/2020/06/2020-CSS-HealthProg324x110ad.jpg>; rel="canonical"
expires: Tue, 14 Nov 2023 02:24:24 GMT

GET
H3 200 1698837118-november%202023-11.jpg
jocoreport.com/wp-content/uploads/bsa-pro-upload/ 394 KB
394 KB 369ms
364ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/bsa-pro-upload/1698837118-november%202023-11.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 8b9bc0eb5aeb3ca989deb2a2775eea2a1a57cc613c34e0dab2224c53fbafefc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Wed, 01 Nov 2023 11:11:56 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 403417
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 1698065805-clayton%20center%20regular%20ad%20324x236.png
jocoreport.com/wp-content/uploads/bsa-pro-upload/ 138 KB
138 KB 370ms
364ms Image
image/png 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/bsa-pro-upload/1698065805-clayton%20center%20regular%20ad%20324x236.png
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 1b94aece6b9354c2d4d36ce463717c06be5a9038fa0586667b7bca3a8811f588

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Mon, 23 Oct 2023 12:56:42 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 141336
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 1696067008-_joco%20comm%20promise%20daniels%20%20324x236%20runs%20sept15-sept21%20sept29-sept31.jpg
jocoreport.com/wp-content/uploads/bsa-pro-upload/ 24 KB
24 KB 369ms
363ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/bsa-pro-upload/1696067008-_joco%20comm%20promise%20daniels%20%20324x236%20runs%20sept15-sept21%20sept29-sept31.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 659571034a0a88285c936208b32203bb7750fe111a145b97cadbf2992aeaff6e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Sat, 30 Sep 2023 09:43:27 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 24764
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 1697026022-WN.JoCoAd.jpg
jocoreport.com/wp-content/uploads/bsa-pro-upload/ 100 KB
100 KB 367ms
363ms Image
image/jpeg 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/bsa-pro-upload/1697026022-WN.JoCoAd.jpg
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 2cb1ad7e345218027837856c6102daf12bf6142556dbea4a8c38499582044930

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Wed, 11 Oct 2023 12:06:59 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 102456
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 1698797456-Revel%20Nov%20ad%20for%20joco%20report.png
jocoreport.com/wp-content/uploads/bsa-pro-upload/ 136 KB
137 KB 367ms
363ms Image
image/png 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-content/uploads/bsa-pro-upload/1698797456-Revel%20Nov%20ad%20for%20joco%20report.png
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 4c00c1ad243d13703486c1ec45b38775badc4008634ea23a0889b8ef670c2a70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Wed, 01 Nov 2023 00:10:43 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 139763
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H/1.1 200
OK 13412877050552934 Show response
lockerdome.com/lad/ Frame 1F5B 1 KB
2 KB 999ms
183ms Document
text/html 104.154.142.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/lad/13412877050552934?pubid=ld-7876-5193&pubo=https%3A%2F%2Fjocoreport.com&rid=&width=696&path=%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F
Requested by: Host: cdn2.lockerdomecdn.com
URL: https://cdn2.lockerdomecdn.com/_js/ajs.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Content-Length: 1376
Content-Type: text/html; charset=utf-8
Date: Tue, 07 Nov 2023 21:07:17 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
253 B 93ms
30ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-5NERW1W9PD&gtm=45je3b60v875062412&_p=1699391236404&_gaz=1&gcd=11l1l1l1l1&cid=1793292123.1699391237&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1699391236&sct=1&seg=0&dl=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&dt=Man%20Loses%20%2415%2C000%20After%20Clicking%20On%20Fraudulent%20Website%20%7C%20JoCo%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1990
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5NERW1W9PD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://jocoreport.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
253 B 99ms
31ms Ping
text/plain 2a00:1450:400c:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-5NERW1W9PD&cid=1793292123.1699391237&gtm=45je3b60v875062412&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5NERW1W9PD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c09::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://jocoreport.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a
www.googletagmanager.com/ 0
59 B 41ms
38ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&es=1&e=gtm.init_consent&eid=-1&u=AAAAAAAAAAAAAACA&h=Ag&dl=jocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&tdp=G-5NERW1W9PD;75062412;0;0;0&z=0

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 204 td
www.googletagmanager.com/ 0
128 B 146ms
144ms Image
image/gif 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&es=1&e=gtm.init_consent&eid=-1&u=AAAAAAAAAAAAAACA&h=Ag&dl=jocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&tdp=G-5NERW1W9PD;75062412;0;0;0&z=0
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:16 GMT
server: Golfe2
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 51ms
49ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&es=1&e=gtm.init&eid=0&u=AAAAAAAAAAAAAACA&h=Ag&tr=1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ogtgagamlink.1ogtgooglesignals.1ccdgaregscope.1ccdemdownload.1ccdemoutboundclick.1ccdempageview.1ccdemscroll.1ccdemsitesearch.1ccdemvideo.1ccdconversionmarking.1ccdautoredact.1ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ogtgagamlink.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemoutboundclick.2ccdempageview.2ccdemscroll.2ccdemsitesearch.2ccdemvideo.2ccdconversionmarking.2ccdautoredact.2ccdgalast&z=0

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 51ms
50ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&es=1&e=gtm.js&eid=1&u=AAAAAAAAAAAAAACA&h=Ag&tr=1gct&ti=1gct&z=0

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 110ms
48ms Image
image/gif 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-5NERW1W9PD&cid=1793292123.1699391237&gtm=45je3b60v875062412&aip=1&z=160441673

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 58ms
57ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&es=1&e=gtag.config&eid=7&u=AAAAAAAAAAAAACCA&h=Ag&epr=1G.2G&z=0

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 37ms
32ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&e=gtm.init&eid=0&u=AAAAAAAAAAAAACCA&h=Ag&tr=5ogt1pdatav2.5ccdgafirst.5setproductsettings.5ogtgagamlink.5ogtgooglesignals.5ccdgaregscope.5ccdemdownload.5ccdemoutboundclick.5ccdempageview.5ccdemscroll.5ccdemsitesearch.5ccdemvideo.5ccdconversionmarking.5ccdautoredact.5ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ogtgagamlink.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemoutboundclick.2ccdempageview.2ccdemscroll.2ccdemsitesearch.2ccdemvideo.2ccdconversionmarking.2ccdautoredact.2ccdgalast&z=0

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/ 400 KB
135 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9535448743609655&plah=jocoreport.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0fe693d9fbaa62ba105f120d1e341474c4f1bdcc00f358c6afbd02c0f98b584b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138484
x-xss-protection: 0
server: cafe
etag: 16629289386990193740
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:16 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231102/r20190131/ Frame 8A7A 10 KB
5 KB 78ms
21ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231102/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76842
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 06 Nov 2023 23:46:34 GMT
etag: 251720774729838433
expires: Mon, 20 Nov 2023 23:46:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 g.gif
pixel.wp.com/ 50 B
153 B 30ms
23ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=128764948&post=164090&tz=-5&srv=jocoreport.com&j=1%3A12.6.2&host=jocoreport.com&ref=&fcp=1880&rand=0.4491484550324081
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 07 Nov 2023 21:07:16 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 86DB 724 B
581 B 470ms
462ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9535448743609655&output=html&h=250&slotname=6455590121&adk=2182991139&adf=2133006309&pi=t.ma~as.6455590121&w=324&fwrn=4&fwrnh=100&lmt=1699391236&rafmt=1&format=324x250&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699391236648&bpp=4&bdt=823&idt=184&shv=r20231102&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&correlator=7123459135492&frm=20&pv=2&ga_vid=1793292123.1699391237&ga_sid=1699391237&ga_hid=1570003568&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1010&ady=2495&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079232%2C31079402%2C31079403%2C31079405%2C31079408%2C42532265%2C44806500%2C44807454%2C44807463%2C31078301%2C44808149&oid=2&pvsid=2368266610398721&tmod=1376857025&uas=0&nvt=1&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleoEbr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=tXl0Z084bu&p=https%3A//jocoreport.com&dtd=199

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9535448743609655&plah=jocoreport.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0f438d116de93f199b940462e19c48603fe8839c608ab9ab29b06a72632a0068

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 360
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:07:17 GMT
expires: Tue, 07 Nov 2023 21:07:17 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
s0.wp.com/_static/ Frame 7956 149 KB
21 KB 109ms
27ms Stylesheet
text/css 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJyljjsOwjAQRC+EvQREIAXiLP6szIa1ifwJ+PaYIiJUFJSjN/M08JiEuYeMIcPExVFI4EqLGqNrJCLMXS8HuQVdiC1ovpubYNJRxQopV0ZpUtrAf6J8Rf8RUTBcLCYYE3i0pJAbbuZ1mFhVjILRKVOlp/B73tg6f42W876I5f+MURcPllIGChaf7/LFn7t+GPbH3eHUjS8h2HWR&cssminify=yes
Requested by: Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: b2016e1b13b47ba8ab2e20527303ba20c08405b627f1340b8a956d801279c447

Request headers

Referer: https://jetpack.wordpress.com/
Origin: https://jetpack.wordpress.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Tue, 07 Nov 2023 15:56:29 GMT
server: nginx
etag: W/"654a5e2d-253c9"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 15:56:33 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame 7956 29 KB
8 KB 138ms
57ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJxdjUsOwjAMBS9EMD8BXSCOUiWNqZwmdpQ4BW5PF4AEyzdvpIF7NoOwIiuECkkcRTStYrHjwgzxTdahruDXK1FNLvJ4/n+pmRzbSFwhoGY7TO8NtfEH9TOylwK2qSSrSsNXnsmj5IK1gmsUPURyoDIhG1fIj7gEr+myPXbd/rw5HXbhBQA5SCY=
Requested by: Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: c84b33ef039cfde382df32d6736dc00281d42d092dc9157cea29359f1a988a5c

Request headers

Referer: https://jetpack.wordpress.com/
Origin: https://jetpack.wordpress.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Tue, 07 Nov 2023 18:12:32 GMT
server: nginx
etag: W/"654a7e10-736f"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Wed, 06 Nov 2024 18:22:45 GMT

GET
H2 200 hovercards.min.js Show response
0.gravatar.com/js/hovercards/ Frame 7956 13 KB
5 KB 106ms
26ms Script
application/javascript 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202345aeb24331352c11f5446dd670d75325a3c4e3b8a6bd7f92ee1c88f8b8636d4d9c

Requested by

Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

aeb24331352c11f5446dd670d75325a3c4e3b8a6bd7f92ee1c88f8b8636d4d9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jetpack.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
last-modified: Tue, 15 Aug 2023 17:32:05 GMT
server: nginx
etag: W/"64dbb695-32aa"
content-type: application/javascript
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Tue, 14 Nov 2023 21:07:16 GMT

GET
H2 200 wpgroho.js Show response
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ Frame 7956 655 B
703 B 106ms
27ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240i
Requested by: Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8

Request headers

Referer: https://jetpack.wordpress.com/
Origin: https://jetpack.wordpress.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-minify-cache: hit
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
x-minify: t
alt-svc: h3=":443"; ma=86400
x-nc: HIT hhn 2
server: nginx
etag: W/1125-1684460931415.6394
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
expires: Thu, 30 May 2024 20:22:44 GMT

GET
H2 200 / Show response
s0.wp.com/_static/ Frame 7956 24 KB
7 KB 134ms
58ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/_static/??-eJx9y0EOgjAQQNELUaaGpOrCeBRS2wEHOgO0HY2317hwRdz+vA/P1YRFKkoFVrMmHUkKJJqxwKaoePcSE+Z2Kg3s4wfmmzLEl3imYNLi41/vZyqM1XSthZ4k/MKQvzh+3itfDu58dJ09OTu9AXH2PJM=
Requested by: Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 44723d4b4e3bc036d2b57a4e90e9f2aa18ec7b0ebed064c63280eb56cbcb3858

Request headers

Referer: https://jetpack.wordpress.com/
Origin: https://jetpack.wordpress.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
x-ac: 2.hhn _dfw BYPASS
last-modified: Wed, 18 Oct 2023 12:07:48 GMT
server: nginx
etag: W/"652fca94-6163"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Thu, 31 Oct 2024 21:44:07 GMT

GET
H3 200 wp-emoji-release.min.js Show response
jocoreport.com/wp-includes/js/ 18 KB
5 KB 156ms
146ms Script
application/javascript 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://jocoreport.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3.2
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
content-encoding: br
last-modified: Fri, 22 Sep 2023 18:56:26 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 4651
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FA61 198 KB
36 KB 629ms
625ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9535448743609655&output=html&adk=1812271804&adf=3025194257&lmt=1699391236&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=236x810_l%7C236x810_r&format=0x0&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&ea=0&pra=7&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&ascmds=1&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699391236877&bpp=2&bdt=1052&idt=2&shv=r20231102&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&prev_fmts=324x250&nras=1&correlator=7123459135492&frm=20&pv=1&ga_vid=1793292123.1699391237&ga_sid=1699391237&ga_hid=1570003568&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079232%2C31079402%2C31079403%2C31079405%2C31079408%2C42532265%2C44806500%2C44807454%2C44807463%2C31078301%2C44808149&oid=2&pvsid=2368266610398721&tmod=1376857025&uas=0&nvt=1&fsapi=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=37

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2582b168b13462f23994921b6666f9f41d3bd8fe09b92e159cdb6c4a8fbbfa17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 36991
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:07:17 GMT
expires: Tue, 07 Nov 2023 21:07:17 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 loadingAnimation.gif
jocoreport.com/wp-includes/js/thickbox/ 15 KB
15 KB 141ms
141ms Image
image/gif 158.106.132.162
PRIVATESYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jocoreport.com/wp-includes/js/thickbox/loadingAnimation.gif
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 158.106.132.162 , United States, ASN63410 (PRIVATESYSTEMS, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 6a486bb6036ea984d293ab009566e99e522abc19f8833c5fd49630be7eba0135

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:16 GMT
last-modified: Wed, 14 Sep 2016 22:02:29 GMT
server: LiteSpeed
content-type: image/gif
cache-control: public, max-age=2592000
accept-ranges: bytes
content-length: 15238
expires: Thu, 07 Dec 2023 21:07:16 GMT

GET
BLOB 200
OK 2b865d78-3faf-40ee-867f-cf500e0782dd
https://jetpack.wordpress.com/ Frame 7956 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://jetpack.wordpress.com/2b865d78-3faf-40ee-867f-cf500e0782dd
Requested by: Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H3 200 wp-emoji-release.min.js Show response
s0.wp.com/wp-includes/js/ Frame 7956 18 KB
5 KB 138ms
31ms Script
application/javascript 192.0.77.32
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1677072837i&ver=6.4-beta3-56827
Requested by: Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=128764948&postid=164090&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Reply&jetpack_comments_nonce=5384909d91&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=12.6.2&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=34aea761a0fe92132c77089c29107db13dacc84f
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS: wordpress.com
Software: nginx /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jetpack.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-nc: HIT hhn 1
date: Tue, 07 Nov 2023 21:07:17 GMT
content-encoding: br
x-ac: 2.hhn _dca MISS
last-modified: Fri, 19 May 2023 01:53:28 GMT
server: nginx
etag: W/"6466d698-4904"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400
expires: Fri, 01 Nov 2024 21:27:48 GMT

GET
H2 200 hovercards.min.css
0.gravatar.com/js/hovercards/ Frame 7956 3 KB
1 KB 29ms
29ms Stylesheet
text/css 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://0.gravatar.com/js/hovercards/hovercards.min.css?ver=202345aeb24331352c11f5446dd670d75325a3c4e3b8a6bd7f92ee1c88f8b8636d4d9c

Requested by

Host: 0.gravatar.com
URL: https://0.gravatar.com/js/hovercards/hovercards.min.js?ver=202345aeb24331352c11f5446dd670d75325a3c4e3b8a6bd7f92ee1c88f8b8636d4d9c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jetpack.wordpress.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; includeSubdomains; preload
content-encoding: br
last-modified: Wed, 11 Oct 2023 03:50:13 GMT
server: nginx
etag: W/"65261b75-d5d"
content-type: text/css
cache-control: max-age=604800
alt-svc: h3=":443"; ma=86400
expires: Tue, 14 Nov 2023 21:07:17 GMT

GET
H2 200 dc.js Show response
stats.g.doubleclick.net/ Frame 1F5B 45 KB
17 KB 38ms
31ms Script
text/javascript 2a00:1450:400c:c09::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/dc.js

Requested by

Host: lockerdome.com
URL: https://lockerdome.com/lad/13412877050552934?pubid=ld-7876-5193&pubo=https%3A%2F%2Fjocoreport.com&rid=&width=696&path=%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c09::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://lockerdome.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 07 Nov 2023 19:51:10 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4567
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17093
expires: Tue, 07 Nov 2023 21:51:10 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/ 160 KB
55 KB 77ms
72ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311020101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

836c031b3c77e7ef012f80443145eaf2945f585fd9ac4e2c78571ef27da00670

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55825
x-xss-protection: 0
server: cafe
etag: 5295876731774971054
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:17 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/ Frame 28C6 10 KB
4 KB 23ms
22ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 44016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 08:53:41 GMT
etag: 251720774729838433
expires: Tue, 21 Nov 2023 08:53:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/ Frame 7DAD 10 KB
4 KB 24ms
23ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 44016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 08:53:41 GMT
etag: 251720774729838433
expires: Tue, 21 Nov 2023 08:53:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/ Frame A636 10 KB
4 KB 27ms
21ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 44016
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4502
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 08:53:41 GMT
etag: 251720774729838433
expires: Tue, 21 Nov 2023 08:53:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 1579 139 KB
47 KB 178ms
96ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZUqnBAAOp5YDog-WAAOWduIvFdP41yIRwe62fA&u=%7CsAtvhYYIvER3Vxa42Nv3cwjC1sjdvFAKjRYg0Xmo7c0%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z2MBXjcXbJi632UiAAo6A0UdjJ7Qpm4s7tehUJJ528QEFOLog6JV3lWny1Mw8cWd2Ar0QgcFpPebeK5VBIqk4CSIdRrRc8ebSjgxuyIDWLMkBszuiApxq-wAopVY13Gpn-2sMmG6GteKkaz0mSuj1QIvSfDIX1hJHYpv2xrwJml1_hJSFAD8j4cV7KxOc0gKWvFwhSnAyn_YWC_4CYNib397Hu-Nqz0f1HN-MKnMtfGUxCvYaj03vl1j_VQSCtfehQvIrqOpcdI76HQeftadjxb2n4eF7nvW8ijFAdKInyaCnV5L3U1cT1sFP6AUVt5h12PtsnbMz-kXXVI0x90lBMqVSSQLMIPMhWHc4PYy_ribZiPyy7rp2njjju-eUeDNlOPXCYMuwlNJDR-IUfXDA1XQcDljl2ByqWYMoH0p0aJ4o3P-x66wRukjGcxXZ92j_DOBvXC3G8bCDHi46sSpSpHZIMsFnH5RA6_afILtb8GR5-_IinUEwg1kBIVbinpws_RUJ4MUPeLhYUP8zp6EKqjo54TxBndq8HevCRHRYCpKpVtyBcyUU5faVDAmJUxjA0&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4aZwBKdKZZbPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSrAk_Qu2rqE3hHTlTFmNREINfEE_eJMQ-CTauFiemKRxFr3myYtseg70e5Zrg6JB4BlJj4L9bOdqxM847ndUNzPaNmIJKXwJYCyHur2OXzhuocw3xmHO98ejsPanc6lW2iAVBBIM8wV9x7bikeCKYaIIlZqvlvghyv3hJDSzNg2h7i6IVIVv3R5m1yaT3W-sw-l4n20pITDsVAGY8DkF7NtTxxpFlG6-mziQpJYpdQfwHgDx7O6Y5haaIat0UGiEanaGFW1gtos5h--AuqZg5z3ae0Jv9TASAn2XYPQiyVcXxShysNl6j7GC7JTvLFF84C-IuWPjPvIQN69eFHHW_GHKtTVZi2ioCaNU_5DI_lxyFNaz-tcQnljcwPDMemE1BYY6ixb_M8lx1mYQ3EgAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3CqF9m8MqM-iMnCVUwlDJCt0vh8A%26client%3Dca-pub-9535448743609655%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7765ed486c4b940f73d3f6036f93742ae0e9e31b89f53d61278c58691b68c0aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:07:17 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=R-qA1SFwcJrJYGtbOiQG8s0nM8p5SeIw2YkS86XNia03PS7vyApPBu4a6d8p4HaFagFK2ZWNNchaEDMuihGh805RNydu2os6NfF8zfDh8cIxplhseqjhDUd0kiCTFSmnf0Zmc0EAe_5iMPU7k7fCM4DOEXYCIxP7BS8tUeANHjbotlpDduy2av8gdyJID5V97pbV_ARtDURkTAsssM1BBBvrhVs57Y3xjaYCudDAQlnrddNMVLbdFRu0Z3l2GTg0BotfVQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 50214985
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/ Frame 28C6 3 KB
1 KB 107ms
46ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:54:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:54:27 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/ Frame 28C6 20 KB
9 KB 83ms
23ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 13:56:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 13:56:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 28C6 190 KB
60 KB 103ms
40ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:17 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 8E46 300 KB
69 KB 221ms
154ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZUqnBAAOp5cDog-WAAOWduWZ4wAHC_H-CZLeeg&u=%7CsAtvhYYIvER%2FJ61tN3Whg3D%2FgYSTtkXbU%2F1RBHjoRmE%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgN28ygJ6EDhxYL4tGcGng8JDU2mC5yco3mYRoKdwO4uFFjnqECsJkw59anr33xBmzvFtJwx5jyXnNEVq7G3KuD7UzoNGK6B7gcMFIAXGcHdblJlLeikrUGCqaIdtMgBEHq7ozdN8PXbwbcwqR7ZRoE06tjRZeka_KGMxKNI8VGHJjfcNyD6xQiT4knkos39uJ3vjrYVn-0-27FpkdZQKdM9Vytqo5uR661YtChX47wuBbN9CY09RVzA17SmzpRlJC6JoQA2HCaDGt9agWK-HlgTgSh3LR7tHhGBGnMgA8o3e--nE_SahOOtBpU6Q1lTOlW6b879y4N150J30kYji5WRcJnh1VSP6-ib-PT1VXLkuxktlPmwI88Q-VkpRnR10YU-vaXgBYvIkLdmRd_HijZhKKP2UCwekLYvrOFi6FVratlqxuAitN1kCZhP7sKMi_U31L4NuFIY5k7EqtjhoQbr-qmPGDoKfxJO7oLuPmt8SuyxwuUH6OwjPQ2iwPzE6Ahcx20E1cz-qa54T_V8HeLDSEHXkKM4rclADqQqd3jBzuZU58JTraf6IRHjroRFHAc&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNg9ABKdKZZfPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSqAk_QtLKQNmSkT-vQz30JuXUOoXqjIRTDyvvbPtiea3ESZWUGzPxngGNt5YduDuP1j_pIzoth2P8ohjwqkgxoyzgE11ReMagv15SaZkEP87c4hO7SBEgEb7qqUAr5ObrKkDWXzkXAtpFW2vU1SqqrJBa39SShbHotBe9ZvL0lWIGFvL_U2iyr9m5pD03aCpJn6vbVKbRvLYh_NKU8Yrw7MGJaRQ3NGme2PD6uvKLe-ouNX_UgPn9FvTuG-Pf20nTnB2QXf6Od2BmnR-xzXRIc42JFY76Mdxa2FhEA0UFUqMJIzwW3pzVpALehpce648HbUAyk6q0s-GzSD6mBaLma4ntsJaKVLJ5JngAxlmOjadOy5Ubo3eum_KRqh3VB33PI4hvA7P9G395GpY2ABvWnnZCYlf64cKAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_09i3tqiM-hb_py06NHrGX4Ail6lQ%26client%3Dca-pub-9535448743609655%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

89c9b263ca1f64b9056ef53582f36aed087d04f120a497a2bbc4d7aec11285a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:07:17 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=mD5S7iFwcJrJYGtbRtXhqw8OcGjcGeZQijS5nd2M3a6Q-sUpHWBH-i7pD1Z1f6EtRjLyOGOQBK0mhIFhdfOyDIA2g4JmPxhjBV5dDctwr0RlbZb02jw5iWaPb5-aIncnnNOKNnRj1LX3fzL-PvTOrcW_YeBIAUx5KbglYICBE4HyuqbwFCuXmkyf8kHksL4W1vehgtURvNUuvwh1Ii0F560sJl-IwMPyOu6n7D5TQ-OOwqItIWtCe-MfB3MvqBwGBT9uRg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 90196743
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/ Frame 7DAD 3 KB
1 KB 90ms
45ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:54:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:54:27 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/ Frame 7DAD 20 KB
8 KB 72ms
28ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 13:56:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 13:56:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7DAD 190 KB
60 KB 125ms
78ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:17 GMT

GET
H2 200 sdk.js Show response
adsdk.microsoft.com/native-to-display/ Frame 6871 91 KB
36 KB 373ms
51ms Script
application/javascript 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://adsdk.microsoft.com/native-to-display/sdk.js
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 882b0276c78312143b52c67c7bf0c6d335efc5ab5613b9f83ac35fc3e28a1dbb

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: br
last-modified: Thu, 02 Nov 2023 22:53:11 GMT
vary: Accept-Encoding
x-azure-ref: 20231107T210718Z-55s1dyk45h0prfy28zc17vt5p400000000kg00000002ag2c
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 3cb67edf-601e-010d-38a3-10ea79000000
cache-control: private, max-age=3600
x-cache: TCP_HIT
x-ms-version: 2009-09-19

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/239/ Frame 6871 80 KB
28 KB 363ms
45ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/239/trk.js
Requested by: Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a9c49f9f526c232731b2ff9aa3e31b686b8b339bdd246bbf74f804c802f9755d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Expires: Wed, 10 Jul 2024 11:56:20 GMT
Date: Tue, 07 Nov 2023 21:07:18 GMT
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Age: 10314659
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 27646
X-Served-By: cache-lga21944-LGA, cache-cph2320058-CPH
Last-Modified: Tue, 11 Jul 2023 11:56:12 GMT
Server: AkamaiNetStorage
X-Timer: S1699391238.161934,VS0,VE0
ETag: "615fd4ad24a409f4de5416b603f042c1:1689076572.555276"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 23, 1084535

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/ Frame 6871 3 KB
1 KB 60ms
47ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/window_focus_fy2021.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:54:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 770
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 20:54:27 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/ Frame 6871 20 KB
8 KB 47ms
34ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231102/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 13:56:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25841
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8543
x-xss-protection: 0
server: cafe
etag: 18034338113832500900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 13:56:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6871 190 KB
60 KB 100ms
85ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61127
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1699274420466708"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Nov 2023 21:07:17 GMT

GET
H2

200

c.gif
www.bing.com/aes/ Frame 6871
Redirect Chain

https://www.bing.com/api/v1/mediation/tracking?adUnit=391466&auId=3dd65340-bf9e-4aef-b1f3-39ecba6eb82c&bidId=15000&bidderId=4&cmExpId=V5&oAdUnit=391466&publisherId=162645330&rId=4b8b88c2-2244-4978-...
https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=e1925e0048924a6494f2525759aa2476&SNR=1&GV=2&med=10

0
243 B

50ms
49ms

Image
text/plain

2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=e1925e0048924a6494f2525759aa2476&SNR=1&GV=2&med=10
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:17 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8949A1F8E2F44939B23F60BA7B023E55 Ref B: FRA31EDGE0720 Ref C: 2023-11-07T21:07:18Z
vary: Origin
x-cache: CONFIG_NOCACHE
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
cache-control: private,no-store
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
date: Tue, 07 Nov 2023 21:07:17 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6A39B1A496A143B697CFD0A009D316B3 Ref B: FRA31EDGE0720 Ref C: 2023-11-07T21:07:18Z
vary: Origin
x-cache: CONFIG_NOCACHE
content-type: text/html; charset=utf-8
location: https://www.bing.com/aes/c.gif?DI=0&DIS=SB_15000-1-0?&RG=e1925e0048924a6494f2525759aa2476&SNR=1&GV=2&med=10
cache-control: no-cache, no-store, must-revalidate
content-length: 154
expires: 0

GET
DATA 200
OK truncated
/ Frame 28C6 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 96e4b189a5cd571d605ca141ffdee7bf110cbb07dc17287058fa6f7b0cfb8900

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 28C6 0
23 B 67ms
67ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C5-YMBKdKZZbPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSoAk_Qu2rqE3hHTlTFmNREINfEE_eJMQ-CTauFiemKRxFr3myYtseg70e5Zrg6JB4BlJj4L9bOdqxM847ndUNzPaNmIJKXwJYCyHur2OXzhuocw3xmHO98ejsPanc6lW2iAVBBIM8wV9x7bikeCKYaIIlZqvlvghyv3hJDSzNg2h7i6IVIVv3R5m1yaT3W-sw-l4n20pITDsVAGY8DkF7NtTxxpFlG6-mziQpJYpdQfwHgDx7O6Y5haaIat0UGiEanaGFW1gtos5h--AuqZg5z3ae0Jv9TASAn2XYPQiyVcXxShysNl6j7GC7JTvLFF84C-IuWPjPvIQN69eFHHW_GHKtTVdq0qxIapp_Eql_CHa1tgpujVgNTh-IXjnNuLvaq3Ladd2v2Az2PgAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTqACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItOTUzNTQ0ODc0MzYwOTY1NRgA&sigh=B4cexf4uQnw&uach_m=[UACH]&cid=CAQSTgDICaaNRQhhsWhlXbq7EDI-IwHkAMQ070pKvDRv99e8l5Ev85diJKYANt2XqJqY207Oqk6GE9aqs-8bcn0TBWa_AQAFky48PfOHDs4XxhgB&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 07 Nov 2023 21:07:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 07 Nov 2023 21:07:18 GMT

GET
H2 200 notify
rtb.fr3.eu.criteo.com/google/auction/ Frame 28C6 0
126 B 199ms
35ms Image
text/plain 2a02:2638:d::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr3.eu.criteo.com/google/auction/notify?profile=14&payload=k47EGMz6RO0HfJ2DYgICAAAA0U5yiFVsUBJpXOou3o1dixAEp0plzyN8Rw36JMloLgAAEgAACgpBUVVCRHdFQkR3&wp=ZUqnBAAOp5YDog-WAAOWduIvFdP41yIRwe62fA&cbvp=2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 153456
server: Kestrel
content-length: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 1579 2 KB
1 KB 113ms
37ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZUqnBAAOp5YDog-WAAOWduIvFdP41yIRwe62fA&u=%7CsAtvhYYIvER3Vxa42Nv3cwjC1sjdvFAKjRYg0Xmo7c0%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z2MBXjcXbJi632UiAAo6A0UdjJ7Qpm4s7tehUJJ528QEFOLog6JV3lWny1Mw8cWd2Ar0QgcFpPebeK5VBIqk4CSIdRrRc8ebSjgxuyIDWLMkBszuiApxq-wAopVY13Gpn-2sMmG6GteKkaz0mSuj1QIvSfDIX1hJHYpv2xrwJml1_hJSFAD8j4cV7KxOc0gKWvFwhSnAyn_YWC_4CYNib397Hu-Nqz0f1HN-MKnMtfGUxCvYaj03vl1j_VQSCtfehQvIrqOpcdI76HQeftadjxb2n4eF7nvW8ijFAdKInyaCnV5L3U1cT1sFP6AUVt5h12PtsnbMz-kXXVI0x90lBMqVSSQLMIPMhWHc4PYy_ribZiPyy7rp2njjju-eUeDNlOPXCYMuwlNJDR-IUfXDA1XQcDljl2ByqWYMoH0p0aJ4o3P-x66wRukjGcxXZ92j_DOBvXC3G8bCDHi46sSpSpHZIMsFnH5RA6_afILtb8GR5-_IinUEwg1kBIVbinpws_RUJ4MUPeLhYUP8zp6EKqjo54TxBndq8HevCRHRYCpKpVtyBcyUU5faVDAmJUxjA0&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4aZwBKdKZZbPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSrAk_Qu2rqE3hHTlTFmNREINfEE_eJMQ-CTauFiemKRxFr3myYtseg70e5Zrg6JB4BlJj4L9bOdqxM847ndUNzPaNmIJKXwJYCyHur2OXzhuocw3xmHO98ejsPanc6lW2iAVBBIM8wV9x7bikeCKYaIIlZqvlvghyv3hJDSzNg2h7i6IVIVv3R5m1yaT3W-sw-l4n20pITDsVAGY8DkF7NtTxxpFlG6-mziQpJYpdQfwHgDx7O6Y5haaIat0UGiEanaGFW1gtos5h--AuqZg5z3ae0Jv9TASAn2XYPQiyVcXxShysNl6j7GC7JTvLFF84C-IuWPjPvIQN69eFHHW_GHKtTVZi2ioCaNU_5DI_lxyFNaz-tcQnljcwPDMemE1BYY6ixb_M8lx1mYQ3EgAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggUCIDhgBAQATICqgI6AoBASL39wTr6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3CqF9m8MqM-iMnCVUwlDJCt0vh8A%26client%3Dca-pub-9535448743609655%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 1579 2 KB
1 KB 116ms
41ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 1579 308 B
637 B 99ms
36ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 1579 293 B
621 B 102ms
39ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 1579 43 B
347 B 126ms
34ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=DVwpHd7_owfTsP22XiXvkUAGKfnjImESZhg8qob2vyf1GegqpkJxc6ZG58FdydiJ3764gzj4iuwDwyraDw43qeaSeCAxyx977ZglYMdWrgOCMOjN0WA4kyxzkol9YgsGaIB8wAm0AlDb500V7t-XlZ3-_WZ9SMTEs3CJhGBVgKmzXL0_iJyoI-jhmSJU4kKhY7i8VrMnAjMR8LmfTwh_X6ApjmTBy_r_ON3yhh7vUbVcUvguzYbSri4jSi42KehfoOa7ofA_kp-nWZFvG1CoS39xqbyUthLYyscuZpltoQKhUgmn9jLYhilcYSDuQqkYEZFmfgf92IA_v1tRv0YwJzqf6VERPke4_CRj5Zh3H4zEED9tbR9WPqx_oWflMmnIYjSOSoNHdHZgS2oIkmvej7d21KYfxGBRDJ-f6Q9uhzLwL274

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1794142
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 8E46 2 KB
1 KB 103ms
40ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZUqnBAAOp5cDog-WAAOWduWZ4wAHC_H-CZLeeg&u=%7CsAtvhYYIvER%2FJ61tN3Whg3D%2FgYSTtkXbU%2F1RBHjoRmE%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgN28ygJ6EDhxYL4tGcGng8JDU2mC5yco3mYRoKdwO4uFFjnqECsJkw59anr33xBmzvFtJwx5jyXnNEVq7G3KuD7UzoNGK6B7gcMFIAXGcHdblJlLeikrUGCqaIdtMgBEHq7ozdN8PXbwbcwqR7ZRoE06tjRZeka_KGMxKNI8VGHJjfcNyD6xQiT4knkos39uJ3vjrYVn-0-27FpkdZQKdM9Vytqo5uR661YtChX47wuBbN9CY09RVzA17SmzpRlJC6JoQA2HCaDGt9agWK-HlgTgSh3LR7tHhGBGnMgA8o3e--nE_SahOOtBpU6Q1lTOlW6b879y4N150J30kYji5WRcJnh1VSP6-ib-PT1VXLkuxktlPmwI88Q-VkpRnR10YU-vaXgBYvIkLdmRd_HijZhKKP2UCwekLYvrOFi6FVratlqxuAitN1kCZhP7sKMi_U31L4NuFIY5k7EqtjhoQbr-qmPGDoKfxJO7oLuPmt8SuyxwuUH6OwjPQ2iwPzE6Ahcx20E1cz-qa54T_V8HeLDSEHXkKM4rclADqQqd3jBzuZU58JTraf6IRHjroRFHAc&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCNg9ABKdKZZfPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSqAk_QtLKQNmSkT-vQz30JuXUOoXqjIRTDyvvbPtiea3ESZWUGzPxngGNt5YduDuP1j_pIzoth2P8ohjwqkgxoyzgE11ReMagv15SaZkEP87c4hO7SBEgEb7qqUAr5ObrKkDWXzkXAtpFW2vU1SqqrJBa39SShbHotBe9ZvL0lWIGFvL_U2iyr9m5pD03aCpJn6vbVKbRvLYh_NKU8Yrw7MGJaRQ3NGme2PD6uvKLe-ouNX_UgPn9FvTuG-Pf20nTnB2QXf6Od2BmnR-xzXRIc42JFY76Mdxa2FhEA0UFUqMJIzwW3pzVpALehpce648HbUAyk6q0s-GzSD6mBaLma4ntsJaKVLJ5JngAxlmOjadOy5Ubo3eum_KRqh3VB33PI4hvA7P9G395GpY2ABvWnnZCYlf64cKAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_09i3tqiM-hb_py06NHrGX4Ail6lQ%26client%3Dca-pub-9535448743609655%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 8E46 2 KB
1 KB 103ms
39ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 8E46 308 B
636 B 88ms
38ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 8E46 293 B
621 B 87ms
37ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 8E46 43 B
348 B 111ms
33ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=cJQ2md6CE6D-1zVCyUDLT1rTLHSywd-syuS7IUL55OlqZDhO-tncH13ykqVfCR2fJEkX3GaOPA0T1nItbGGG5tGRJ-xQww-BI1seuuPq3qTxffEna81pIq-LnAMD0XwgnwQS9kYEi48FJ67lH1b_B1EbL4ofS_IASAtmu3Iedxr4WHITuO-7s5W7uZ1VJRMBStNfRJw8vu7sgmzP_npvZZZhbogyqJPab3v7QweCvf_DC7Y1hEC5x7ynxK4929obDY3hD31h9kBPS7wBN9qGul5Bt2AHHVh01J6W8oOMeaK7rEopTsWJQZemADrlWPrTfD7zsG226VDJpxsft_xszcWwHnjpoa8MAhvLjCVi5e2eMLm2pZ5blSrLn0LJmrrVs2mbmoF7uHNQCjY9OA2pHJSNG9A3R1ZEc3VM4NAx_2LrpNBH

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1473281
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 1579 12 KB
6 KB 142ms
86ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 8E46 12 KB
6 KB 116ms
78ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 1579 21 KB
21 KB 187ms
72ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=244&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F105623%2F5022139%2F2ad0250af6b64105b12172cc0682064c_eu_oveckarna_vertikalni_hneda.png&v=3&w=464&rid=4&s=c_cOnFQ3mQ-lq2sDUSwtdDCf

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bc98677b8fc84565b57a5c326dba02188b03fa3005be24110c6caf9c7aadca21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 21291
expires: Thu, 03 Oct 2024 11:24:52 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 1579 4 KB
4 KB 236ms
121ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F4%2F3984_102.jpg%3F1635951174_2&v=3&w=400&rid=4&s=qha8S_p0EyJ8g6mGfoHFedeB&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

47d28f2d8e65dc2ee8bf14064d39a5915f75fca7c1c91b922f6955fe7fc02f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4054
expires: Tue, 05 Dec 2023 04:57:19 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 1579 8 KB
9 KB 229ms
115ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F10289_102.jpg%3F1635951174_2&v=3&w=400&rid=4&s=N2-N3FEOfepReAgBnHPPF5ZX&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

37f81dfa473e551ebde3be297dee64b41c2c3d67707ad27c2ea238c37764d8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 8586
expires: Mon, 04 Dec 2023 12:47:18 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 1579 24 KB
24 KB 207ms
93ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F9759_102.jpg%3F1635951174_2&v=3&w=400&rid=4&s=3_rRX1cv2EqG181tzIIwEs36&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

abc3e5b7c4f477ff2289ebccbba4d30443495451f9a51c7cb7bd5fca87fbfc4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 24196
expires: Mon, 04 Dec 2023 12:06:44 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 1579 0
127 B 127ms
40ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=R-qA1SFwcJrJYGtbOiQG8s0nM8p5SeIw2YkS86XNia03PS7vyApPBu4a6d8p4HaFagFK2ZWNNchaEDMuihGh805RNydu2os6NfF8zfDh8cIxplhseqjhDUd0kiCTFSmnf0Zmc0EAe_5iMPU7k7fCM4DOEXYCIxP7BS8tUeANHjbotlpDduy2av8gdyJID5V97pbV_ARtDURkTAsssM1BBBvrhVs57Y3xjaYCudDAQlnrddNMVLbdFRu0Z3l2GTg0BotfVQ&sds=2&rev=89232&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 1579 2 KB
1 KB 99ms
73ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 1579 2 KB
1 KB 46ms
46ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 8E46 0
128 B 118ms
40ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=mD5S7iFwcJrJYGtbRtXhqw8OcGjcGeZQijS5nd2M3a6Q-sUpHWBH-i7pD1Z1f6EtRjLyOGOQBK0mhIFhdfOyDIA2g4JmPxhjBV5dDctwr0RlbZb02jw5iWaPb5-aIncnnNOKNnRj1LX3fzL-PvTOrcW_YeBIAUx5KbglYICBE4HyuqbwFCuXmkyf8kHksL4W1vehgtURvNUuvwh1Ii0F560sJl-IwMPyOu6n7D5TQ-OOwqItIWtCe-MfB3MvqBwGBT9uRg&sds=2&rev=89232&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 8E46 2 KB
1 KB 100ms
82ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 8E46 2 KB
1 KB 48ms
48ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 01 Nov 2024 21:07:18 GMT

GET
H2 200 th
www.bing.com/ Frame 6871 12 KB
13 KB 28ms
26ms Image
image/jpeg 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bing.com/th?id=OADD2.10239328756917_1WD24WKJ48FKLQGUN&pid=21.2&c=3&w=180&h=180&qlt=90
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d77be55832a4204c8750784a2a853b3f7c33fdd8beb2cd0e39fad71c48d3e6e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1ABEC0319FE842049C15AF57FA3B2ECA Ref B: FRA31EDGE0720 Ref C: 2023-11-07T21:07:18Z
access-control-allow-methods: GET, POST, OPTIONS
x-cache: TCP_HIT
access-control-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
content-type: image/jpeg
cache-control: public, max-age=2592000
timing-allow-origin: *
access-control-allow-headers: *
content-length: 12377

GET
H2 200 rd_log Show response
ams3-ib.adnxs.com/ Frame 6871 0
533 B 147ms
40ms Script
text/html 185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website&e=wqT_3QKiBMgiAgAAAwDWAAUBCIXOqqoGEJqWicLPxMbWTxgAKjYJNNxzyHYrsz8R_GaL6uyosj8ZAAABAgzoPyH8DRIAKREk0DEAAACgmZmpPzDb-KYDOLUBQLVeSOMDULqJirYBWMexPWAAaJ-kVHjW9AWAAQGKAQNVU0SSBQbw_ZgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2ALwBuACoqgx6gJLaHR0cHM6Ly9qb2NvcmVwb3J0LmNvbS9tYW4tbG9zZXMtMTUwMDAtYWZ0ZXItY2xpY2tpbmctb24tZnJhdWR1bGVudC13ZWJzaXRlgAMAiAMBkAMAmAMJoAMBqgMAwAPYBMgDANgD_aqqAeADAOgDAPgDA4AEAJIEBC91YXCYBACoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAfAEuomKtgGIBQGYBQCgBfTo-evOiZGVBsAFAMkFAAAAAAAA8D_SBQkJAAAAIVB0ANgFAeAFAfAF-dpL-gUECAAQAJAGAJgGALgGAMEGBSIwAPA_0AbCjQTaBhYKEAkSGQEBi2TgBgHyBgIIAIAHAYgHAKAHAcgH1vQF0gcNCREoASYM2gcGCAUJnOAHAOoHAggA8AfRogSKCAIQAJUIAACAP5gIAcAI8AbSCAYIABAAGAA.&s=5c1d97ec2320134c0814a41575833104f21607e2&bdref=https%3A%2F%2Fjocoreport.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fjocoreport.com%2F,https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231102%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1%23RS-2-%26adk%3D1812271804%26client%3Dca-pub-9535448743609655%26fa%3D4%26ifi%3D5%26uci%3Da!5%26btvi%3D4%26xpc%3DBPp6b6ICjx%26p%3Dhttps%253A%2F%2Fjocoreport.com,https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fhtml%2Fr20231102%2Fr20110914%2Fzrt_lookup.html%3Ffsb%3D1&

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:18 GMT
an-x-request-uuid: 8d228316-09b3-42ef-b492-43f632cb460f
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.20; 217.114.218.20; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 7DAD 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b29471c4f0292332854ad3e0db49474877f79dcb807ae943ee6a616e939fcb11

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7DAD 0
19 B 68ms
67ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CH83vBKdKZZfPOpafiM0P9qyOoArJntKxXKX8k_dwwI23ARABIABglYKAgKAHggEXY2EtcHViLTk1MzU0NDg3NDM2MDk2NTXIAQmpAmqMlzy-57E-qAMByAMCqgSnAk_QtLKQNmSkT-vQz30JuXUOoXqjIRTDyvvbPtiea3ESZWUGzPxngGNt5YduDuP1j_pIzoth2P8ohjwqkgxoyzgE11ReMagv15SaZkEP87c4hO7SBEgEb7qqUAr5ObrKkDWXzkXAtpFW2vU1SqqrJBa39SShbHotBe9ZvL0lWIGFvL_U2iyr9m5pD03aCpJn6vbVKbRvLYh_NKU8Yrw7MGJaRQ3NGme2PD6uvKLe-ouNX_UgPn9FvTuG-Pf20nTnB2QXf6Od2BmnR-xzXRIc42JFY76Mdxa2FhEA0UFUqMJIzwW3pzVpALehpce648HbUAyk6q0s-GzSD6mBaLma4ntsZ6C0vh7aTj2XRkR55fNbQUjP112s0rzoM718eYF3_DfYdDXS_zeABvWnnZCYlf64cKAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOoAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi05NTM1NDQ4NzQzNjA5NjU1GAA&sigh=51YF4lMQtnQ&uach_m=[UACH]&cid=CAQSTgDICaaNRQhhsWhlXbq7EDI-IwHkAMQ070pKvDRv99e8l5Ev85diJKYANt2XqJqY207Oqk6GE9aqs-8bcn0TBWa_AQAFky48PfOHDs4XxhgB&cbvp=2&vis=1

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 07 Nov 2023 21:07:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr3.eu.criteo.com/google/auction/ Frame 7DAD 0
125 B 35ms
35ms Image
text/plain 2a02:2638:d::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr3.eu.criteo.com/google/auction/notify?profile=14&payload=k47EGMz6RMgB2ASdg2ICAgAAANFOcohVbFASaVzqLt6NXYsQBadKZcfJ24V-VHkrpbUAABIAAAoKQVFVQkR3RUJEdw&wp=ZUqnBAAOp5cDog-WAAOWduWZ4wAHC_H-CZLeeg&cbvp=2

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 159679
server: Kestrel
content-length: 0

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 25 KB
25 KB 58ms
44ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=276&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F105623%2F5022139%2F2ad0250af6b64105b12172cc0682064c_eu_oveckarna_vertikalni_hneda.png&v=3&w=396&rid=4&s=85uwGOnOTLaX9OEBd-NNWFvK

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5b45b15ad23f0a8229998fd0fcd1b36835c99cc71367e32dadb50458bf3bf648

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 25342
expires: Thu, 03 Oct 2024 11:24:52 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 8 KB
9 KB 116ms
102ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F10289_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=8FTw8xYojgkpP_qJ47L5XP6V&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

37f81dfa473e551ebde3be297dee64b41c2c3d67707ad27c2ea238c37764d8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 8586
expires: Mon, 04 Dec 2023 12:47:18 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 13 KB
13 KB 116ms
103ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F7319_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=m4AqIPT6vKtBi04DUEvAa_5I&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

76ee0961e6fc5fe6be30f86e379b24c011ada622f43d9bf323548cc656d6cb28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 12824
expires: Mon, 04 Dec 2023 22:56:22 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 4 KB
4 KB 57ms
44ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F11129_102.jpg%3F1636111187_2&v=3&w=800&rid=4&s=aXMKJPSZvpYJHB8wxWoi76_3&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

98a2fbbfdf666c4b875ed5d04436b77dc3890b85788f085967b51bb0305bbee8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 3748
expires: Mon, 04 Dec 2023 22:15:20 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 34 KB
34 KB 78ms
65ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F8%2F3988_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=Rpo6PMsxElZFcHXS78kByXvu&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

85b7284c4d8e54216be4082addda18358f663a0ec0bbeddfeebffe2a45fc9b27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 34510
expires: Mon, 04 Dec 2023 22:38:10 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 24 KB
24 KB 69ms
56ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F9759_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=DQE5zF_suhnNTq68_gj2IktV&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

abc3e5b7c4f477ff2289ebccbba4d30443495451f9a51c7cb7bd5fca87fbfc4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 24196
expires: Mon, 04 Dec 2023 12:06:44 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 9 KB
9 KB 93ms
80ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F3%2F4123_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=EMf7Q7icODySE6pGeqSq5Vg9&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fe541d5a8862d0ee4f0ae66b9b3c5640d3131f0e2551608fd78a9b92f4cf48c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 9014
expires: Mon, 04 Dec 2023 21:55:51 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 3 KB
4 KB 77ms
65ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F4%2F14484_102.jpg%3F1661517606_2&v=3&w=800&rid=4&s=enNU2VPPv6Hq8xMwWNNi-LhB&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e61982666f8e828ba57941c43933eb441d35a92113c597d977c236e846b4463b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 3432
expires: Mon, 04 Dec 2023 12:22:45 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 4 KB
4 KB 94ms
86ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F4%2F3984_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=LvSGp77XHYM3aCxBW33Fot_a&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

47d28f2d8e65dc2ee8bf14064d39a5915f75fca7c1c91b922f6955fe7fc02f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4054
expires: Tue, 05 Dec 2023 04:57:19 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 18 KB
18 KB 107ms
99ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F5%2F7205_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=I5HXE70agGaBgMSqWI5tWVER&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f9c8796516af78ee9f53c91aaeeb28cd54e33dee0fb377e7a65be204558df0da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 18698
expires: Mon, 04 Dec 2023 22:38:11 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 7 KB
8 KB 100ms
92ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F1%2F20311_102.jpg%3F1689323926_2&v=3&w=800&rid=4&s=6j-txq3EI6lOzk5tQhxK4d9n&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f59697a502ea192bdf7199349d0858e55bf837a622a36dbe7d190c6a67348282

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 7502
expires: Wed, 15 Nov 2023 16:43:06 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 9 KB
9 KB 101ms
93ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F7329_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=kgi79_BEoc4xGz3iaowVOHmK&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f99614276cd149735ac9e7ec10cfde1c872ac9b870f517415dff3caadbb31db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 9280
expires: Tue, 05 Dec 2023 03:43:58 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 5 KB
5 KB 115ms
108ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F6%2F7966_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=bcZm-K1wNfU0gWmBhz2Tvb9y&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

14392c9baa0d1e691f861f1bfa0cda3caf6d3080edfabda0a2c276dfa13f2afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 5320
expires: Tue, 05 Dec 2023 12:41:01 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 15 KB
15 KB 119ms
112ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F1%2F11461_102.jpg%3F1637921114_2&v=3&w=800&rid=4&s=nK4TKOFBzfHIIkA2nAKvp5i6&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ee87e6547702fb6ef8a6f9d5ef54c46594c7481654f383a9ba9c17867932172c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 15494
expires: Tue, 05 Dec 2023 04:35:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 12 KB
12 KB 124ms
118ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F13169_102.jpg%3F1651141873_2&v=3&w=800&rid=4&s=AobX1Qv_ObHguTYCgE7G-bHU&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ef035731dc7446c59956b57dc3dd713fd3f7d56b4ed8ab6c8f3c113acb9bdeb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 12160
expires: Wed, 06 Dec 2023 05:27:30 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 16 KB
16 KB 125ms
118ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F4%2F2204_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=owQ2WY3CxCFUf4ETDUw4IY-t&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bc531edb737131beee262d805228188423b842a23009de519fb84005ef60fcd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 16076
expires: Mon, 04 Dec 2023 21:55:51 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 22 KB
22 KB 117ms
112ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F3%2F11463_102.jpg%3F1637921162_2&v=3&w=800&rid=4&s=roh5iC6wcuNgIZlqL0AhDz-j&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5fd058e8362e305341a3ff93766fd9e3863bd93e79ef24e04089564e528c5a1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 22540
expires: Tue, 05 Dec 2023 04:28:06 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 4 KB
4 KB 122ms
117ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F1%2F7251_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=UcMb0hTRBPetSdYXEmqKQOqb&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

9d7858fcf072cca6ec23f9b871b0ea6f8c03f0ebda25bfa8e5f19ed9b62c082e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4022
expires: Mon, 04 Dec 2023 15:15:48 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 17 KB
17 KB 127ms
123ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F9%2F9459_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=CT-xFLIGuENhW0-zN4keSXES&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8a160afe51c9194fdfcd317cfab7677c85ff00fd893739da00f2a0b8dc3df9f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 17024
expires: Mon, 04 Dec 2023 12:30:56 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 8 KB
8 KB 137ms
132ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F4%2F19614_102.jpg%3F1685603625_2&v=3&w=800&rid=4&s=3QsTLlgBzu28NEfwWKKSkEW_&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

01de188d8151eae8b160df72abc95e572da11e65689c36cdbdf50e0169b02876

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 8052
expires: Tue, 05 Dec 2023 01:27:24 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 16 KB
16 KB 135ms
131ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F0%2F19470_102.jpg%3F1684141495_2&v=3&w=800&rid=4&s=iG9da8aYoMwsx9nrBMZ1cb_9&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

610256df7d1d883c3680fc08210f370bcbedfa42b0264657970b24f7d1fa445d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 15978
expires: Mon, 04 Dec 2023 12:15:25 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 21 KB
21 KB 133ms
129ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F6%2F3636_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=niRvobj897OScdbgMBBYolxL&b=400

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8ab79ac24ee68309d1d0d72893e2c80e6c083fe51092a3a9dbff8ba5edc0eac0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 21318
expires: Tue, 05 Dec 2023 06:41:32 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 38ms
37ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&e=*&eid=0&u=AgAAAAAAAAAAACCA&h=Ag&epr=1G.2G.1G.2G&z=0

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 vevent
ams3-ib.adnxs.com/ Frame 6871 0
557 B 42ms
41ms Ping
text/html 185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website&e=wqT_3QLEB8jEAwAAAwDWAAUBCIXOqqoGEJqWicLPxMbWTxgAKjYJNNxzyHYrsz8R_GaL6uyosj8ZAAABAgzoPyH8DRIAKREk0DEAAACgmZmpPzDb-KYDOLUBQLVeSOMDULqJirYBWMexPWAAaJ-kVHjW9AWAAQGKAQNVU0SSBQbwn5gBoAGgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2ALwBuACoqgx6gJLaHR0cHM6Ly9qb2NvcmVwb3J0LmNvbS9tYW4tbG9zZXMtMTUwMDAtYWZ0ZXItY2xpY2tpbmctb24tZnJhdWR1bGVudC13ZWJzaXRlgAMAiAMBkAMAmAMJoAMBqgOeAwq0Amh0dHBzOi8vd3d3LmJpbmcFX0xhcGkvdjEvbWVkaWF0aW9uL3RyYQVa8D4_YWRVbml0PTM5MTQ2NiZhdUlkPTRiOGI4OGMyLTIyNDQtNDk3OC1iNTNlLWI0MTU5NTE5NGZjYiZiaWRJZD0FrRgmYmlkZGVyATo0JmNtRXhwSWQ9VjUmb0EyWwAYcHVibGlzaAUoJDE2MjY0NTMzMCYFNo5wALhydHlwZT1udXJsJnRhZ0lkPTY5Mjk0OTkmdHJhZmZpY0dyb3VwPWtuYXFlXzNjJg0WCFN1YgkZ9CoBZmdub3lydnFjbmZmJmFpZD0ke0FVQ1RJT05fSUR9EgUxMjA4NRoTNTc0MTI3Mzg0NjA1MzQ4OTQzNCIJMzgxODQ2NzE0KgRiaW5nOjhVMlZoY21Ob1FXUWpPRFF6TVRrek5EQXlOamMwTWpVak1qTXpOakV4T0RZeE1qRTBOVEF3T1E9PcAD2ATIAwDYA_2qqgHgAwDoAwD4AwOABACSBAQvdWFwmAQAqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBAHwBLqJirYBiAUBmAUAoAX06PnrzomRlQbABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AX52kv6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGwo0E2gYWChAJNRkBdBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH1vQF0gcNCREoASYM2gcGCAUJqOAHAOoHAggA8AfRogSKCAIQAJUIAACAP5gIAcAI8AbSCAkI____PxACGAA.&s=5066061e5c52e66f562fae91b927435a7869ad4b&type=nv&nvt=5&jm=1003&px=0&py=0&bw=180&bh=180&sid=7222536061741228660&vd=ct~0|rr~0&sv=239&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=6929499&sw=1600&sh=1200&pw=0&ph=0&ww=0&wh=0&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:18 GMT
an-x-request-uuid: 28cafd2e-bef8-4dd4-8996-8895d367c546
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.20; 217.114.218.20; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 4 KB
4 KB 70ms
69ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

98a2fbbfdf666c4b875ed5d04436b77dc3890b85788f085967b51bb0305bbee8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 3748
expires: Mon, 04 Dec 2023 22:15:20 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 25 KB
25 KB 72ms
72ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5b45b15ad23f0a8229998fd0fcd1b36835c99cc71367e32dadb50458bf3bf648

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 25342
expires: Thu, 03 Oct 2024 11:24:52 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 24 KB
24 KB 80ms
80ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: jocoreport.com
URL: https://jocoreport.com/man-loses-15000-after-clicking-on-fraudulent-website/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

abc3e5b7c4f477ff2289ebccbba4d30443495451f9a51c7cb7bd5fca87fbfc4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 24196
expires: Mon, 04 Dec 2023 12:06:44 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 36CB 436 B
234 B 202ms
201ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9535448743609655&output=html&h=60&slotname=9717900006&adk=307472247&adf=4049190488&pi=t.ma~as.9717900006&w=468&lmt=1699391238&format=468x60&url=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1699391238509&bpp=1&bdt=2684&idt=0&shv=r20231102&mjsv=m202311020101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D254ba367273a0f66%3AT%3D1699391236%3ART%3D1699391236%3AS%3DALNI_MZ0Z9gYYTd1RhrFgE2IH-VSCqEq3Q&gpic=UID%3D00000cbc14c6dc05%3AT%3D1699391236%3ART%3D1699391236%3AS%3DALNI_MZZXctcfMyJ5TydXjiC3NrRstYp5A&prev_fmts=324x250%2C0x0%2C1005x124%2C200x600%2C160x600&nras=4&correlator=7123459135492&frm=20&pv=1&ga_vid=1793292123.1699391237&ga_sid=1699391237&ga_hid=1570003568&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=380&ady=854&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079232%2C31079402%2C31079403%2C31079405%2C31079408%2C42532265%2C44806500%2C44807454%2C44807463%2C31078301%2C44808149&oid=2&psts=AOrYGsnxSN3Rbk3Gz8jlJxNvT059O9hQf88cAUfuqTrqJPhW-iCMq5YUdZzqFgSfS4FdcJjgwU_l1duxJBkprMatIZBgXVZs9EhTCS2R19M%2CAOrYGslYeJeVYeyraS-6v7C8SYh9ZyQzxW6TMf-Kl4EQPKayUapYHXrnqlk3AS8oFl5Ds2BuVTImiXor6EDw94fHR4wd68ujjgdqlLMSPOE&pvsid=2368266610398721&tmod=1376857025&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CoeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&xpc=JDbi1QFH2X&p=https%3A//jocoreport.com&dtd=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7296e6186ef6ea7b67c6a0b487cec47c3b327cc8e8212909b1c85c65a743c3be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 213
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:07:18 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 136ms
79ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231102&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e572528ad2f7d09b31fdfbb8cb68f9b0f9fe3b99d22ad4b95f4bd2d1352ae8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12339
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6871 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aeaa5b402ff7742df6f985960c56526cb6f2856c55eb1ddc079ef9ad01293a93

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 43ms
42ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&e=*&eid=0&u=AgAAAAAAAAAAACCA&h=Ag&epr=1G.2G&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 3 KB
4 KB 42ms
41ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e61982666f8e828ba57941c43933eb441d35a92113c597d977c236e846b4463b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 3432
expires: Mon, 04 Dec 2023 12:22:45 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 34 KB
34 KB 42ms
38ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

85b7284c4d8e54216be4082addda18358f663a0ec0bbeddfeebffe2a45fc9b27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 34510
expires: Mon, 04 Dec 2023 22:38:10 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 9 KB
9 KB 40ms
38ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fe541d5a8862d0ee4f0ae66b9b3c5640d3131f0e2551608fd78a9b92f4cf48c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 9014
expires: Mon, 04 Dec 2023 21:55:51 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 4 KB
4 KB 55ms
53ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

47d28f2d8e65dc2ee8bf14064d39a5915f75fca7c1c91b922f6955fe7fc02f68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4054
expires: Tue, 05 Dec 2023 04:57:19 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 7 KB
8 KB 58ms
55ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f59697a502ea192bdf7199349d0858e55bf837a622a36dbe7d190c6a67348282

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 7502
expires: Wed, 15 Nov 2023 16:43:06 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 9 KB
9 KB 56ms
54ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f99614276cd149735ac9e7ec10cfde1c872ac9b870f517415dff3caadbb31db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 9280
expires: Tue, 05 Dec 2023 03:43:58 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 18 KB
18 KB 56ms
55ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f9c8796516af78ee9f53c91aaeeb28cd54e33dee0fb377e7a65be204558df0da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 18698
expires: Mon, 04 Dec 2023 22:38:11 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 8 KB
9 KB 58ms
56ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

37f81dfa473e551ebde3be297dee64b41c2c3d67707ad27c2ea238c37764d8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 8586
expires: Mon, 04 Dec 2023 12:47:18 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 13 KB
13 KB 54ms
54ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

76ee0961e6fc5fe6be30f86e379b24c011ada622f43d9bf323548cc656d6cb28

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 12824
expires: Mon, 04 Dec 2023 22:56:22 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 5 KB
5 KB 54ms
53ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

14392c9baa0d1e691f861f1bfa0cda3caf6d3080edfabda0a2c276dfa13f2afe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 5320
expires: Tue, 05 Dec 2023 12:41:01 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 15 KB
15 KB 55ms
53ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ee87e6547702fb6ef8a6f9d5ef54c46594c7481654f383a9ba9c17867932172c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 15494
expires: Tue, 05 Dec 2023 04:35:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 4 KB
4 KB 56ms
55ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

9d7858fcf072cca6ec23f9b871b0ea6f8c03f0ebda25bfa8e5f19ed9b62c082e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4022
expires: Mon, 04 Dec 2023 15:15:48 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 12 KB
12 KB 55ms
55ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ef035731dc7446c59956b57dc3dd713fd3f7d56b4ed8ab6c8f3c113acb9bdeb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 12160
expires: Wed, 06 Dec 2023 05:27:30 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 16 KB
16 KB 56ms
55ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bc531edb737131beee262d805228188423b842a23009de519fb84005ef60fcd4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 16076
expires: Mon, 04 Dec 2023 21:55:51 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6871 0
19 B 79ms
78ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CaRVyBKdKZZjPOpafiM0P9qyOoArS4Nfgbo-ktpOTCsCNtwEQASAAYJWCgICgB4IBF2NhLXB1Yi05NTM1NDQ4NzQzNjA5NjU1yAEJqAMByAMCqgSjAk_QTYnd4c-STzusY6DdwEzykwkuc8tgPD7X7ZmnD-LVC9-hhSfD0ehnn1TSmT6-JW07hxiO1zftyQyi4f4EPxWa1kzwxTSJFBiWj9cRjxQ-vUabrhMxtQGh_5gMd5po2Mk_7QZTSfGaRLdXvd5CFYsH8rC3yYD-43VESGE02jTP1OtTPD8XqBpTDn0aFVf2HQaw_AStkEfQYf3P45spuUUKhK_BLD82oxtpFiXYn_P48--clq6X7NZ-ofOFUt2oUSauNYqV9tYY1fY18ljMYakaIug_h5Cf68C7PfjsEPVxVgdU0ApP4QPNWQJ3MILiLLIMia9VGm1ZWC5EVP1nJZh8svQ4wVylGJnKI4CePmRCK5XyQxTPRf03IcpFyqlOG67PwIAGwNKfhsi4sfjxAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOoAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi05NTM1NDQ4NzQzNjA5NjU1GAA&sigh=sW555JvVnf0&uach_m=[UACH]&cid=CAQSTgDICaaNRQhhsWhlXbq7EDI-IwHkAMQ070pKvDRv99e8l5Ev85diJKYANt2XqJqY207Oqk6GE9aqs-8bcn0TBWa_AQAFky48PfOHDs4XxhgB&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 07 Nov 2023 21:07:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 it
ams3-ib.adnxs.com/ Frame 6871 0
532 B 62ms
60ms Image
text/html 185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams3-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website&e=wqT_3QLEB8jEAwAAAwDWAAUBCIXOqqoGEJqWicLPxMbWTxgAKjYJNNxzyHYrsz8R_GaL6uyosj8ZAAABAgzoPyH8DRIAKREk0DEAAACgmZmpPzDb-KYDOLUBQLVeSOMDULqJirYBWMexPWAAaJ-kVHjW9AWAAQGKAQNVU0SSBQbwn5gBoAGgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2ALwBuACoqgx6gJLaHR0cHM6Ly9qb2NvcmVwb3J0LmNvbS9tYW4tbG9zZXMtMTUwMDAtYWZ0ZXItY2xpY2tpbmctb24tZnJhdWR1bGVudC13ZWJzaXRlgAMAiAMBkAMAmAMJoAMBqgOeAwq0Amh0dHBzOi8vd3d3LmJpbmcFX0xhcGkvdjEvbWVkaWF0aW9uL3RyYQVa8D4_YWRVbml0PTM5MTQ2NiZhdUlkPTRiOGI4OGMyLTIyNDQtNDk3OC1iNTNlLWI0MTU5NTE5NGZjYiZiaWRJZD0FrRgmYmlkZGVyATo0JmNtRXhwSWQ9VjUmb0EyWwAYcHVibGlzaAUoJDE2MjY0NTMzMCYFNo5wALhydHlwZT1udXJsJnRhZ0lkPTY5Mjk0OTkmdHJhZmZpY0dyb3VwPWtuYXFlXzNjJg0WCFN1YgkZ9CoBZmdub3lydnFjbmZmJmFpZD0ke0FVQ1RJT05fSUR9EgUxMjA4NRoTNTc0MTI3Mzg0NjA1MzQ4OTQzNCIJMzgxODQ2NzE0KgRiaW5nOjhVMlZoY21Ob1FXUWpPRFF6TVRrek5EQXlOamMwTWpVak1qTXpOakV4T0RZeE1qRTBOVEF3T1E9PcAD2ATIAwDYA_2qqgHgAwDoAwD4AwOABACSBAQvdWFwmAQAqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBAHwBLqJirYBiAUBmAUAoAX06PnrzomRlQbABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AX52kv6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGwo0E2gYWChAJNRkBdBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH1vQF0gcNCREoASYM2gcGCAUJqOAHAOoHAggA8AfRogSKCAIQAJUIAACAP5gIAcAI8AbSCAkI____PxACGAA.&s=5066061e5c52e66f562fae91b927435a7869ad4b&pp=ZUqnBAAOp5gDog-WAAOWdmRarJWL_kJXsZsRIw&ppt=1&pubclick=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCWdaeBKdKZZjPOpafiM0P9qyOoArS4Nfgbo-ktpOTCsCNtwEQASAAYJWCgICgB4IBF2NhLXB1Yi05NTM1NDQ4NzQzNjA5NjU1yAEJqAMByAMCqgSmAk_QTYnd4c-STzusY6DdwEzykwkuc8tgPD7X7ZmnD-LVC9-hhSfD0ehnn1TSmT6-JW07hxiO1zftyQyi4f4EPxWa1kzwxTSJFBiWj9cRjxQ-vUabrhMxtQGh_5gMd5po2Mk_7QZTSfGaRLdXvd5CFYsH8rC3yYD-43VESGE02jTP1OtTPD8XqBpTDn0aFVf2HQaw_AStkEfQYf3P45spuUUKhK_BLD82oxtpFiXYn_P48--clq6X7NZ-ofOFUt2oUSauNYqV9tYY1fY18ljMYakaIug_h5Cf68C7PfjsEPVxVgdU0ApP4QPNWQJ3MILiLLIMia9VGm1ZWC5EVP0lJ7nucFDCrMhfbCxUegQoOkdIr5zcW81tw6SznUpv5rGOmkyiVNMY8YAGwNKfhsi4sfjxAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBQIgOGAEBABMgKqAjoCgEBIvf3BOvoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1Ad1PX_UULMZai4z94olbLjQCC_w%26client%3Dca-pub-9535448743609655%26adurl%3D&cbvp=2

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:18 GMT
an-x-request-uuid: b7367d6d-8a20-419f-84da-6a238ca3e6a5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.20; 217.114.218.20; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 17 KB
17 KB 64ms
62ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8a160afe51c9194fdfcd317cfab7677c85ff00fd893739da00f2a0b8dc3df9f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 17024
expires: Mon, 04 Dec 2023 12:30:56 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 22 KB
22 KB 62ms
60ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5fd058e8362e305341a3ff93766fd9e3863bd93e79ef24e04089564e528c5a1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:17 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 22540
expires: Tue, 05 Dec 2023 04:28:06 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 21 KB
21 KB 61ms
59ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

8ab79ac24ee68309d1d0d72893e2c80e6c083fe51092a3a9dbff8ba5edc0eac0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 21318
expires: Tue, 05 Dec 2023 06:41:32 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 16 KB
16 KB 64ms
62ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

610256df7d1d883c3680fc08210f370bcbedfa42b0264657970b24f7d1fa445d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 15978
expires: Mon, 04 Dec 2023 12:15:25 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 8E46 8 KB
8 KB 64ms
63ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

01de188d8151eae8b160df72abc95e572da11e65689c36cdbdf50e0169b02876

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 8052
expires: Tue, 05 Dec 2023 01:27:24 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 07 Nov 2023 21:07:18 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7C3E 13 KB
5 KB 23ms
21ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 725
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 20:55:13 GMT
expires: Wed, 06 Nov 2024 20:55:13 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 333A 829 B
1 KB 85ms
33ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

bc2ef718518a618850126d5c719e25f3dee9ab3d49f4af88c4414fd3e405b213

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LrzEKabpcTUFZpn77ZlwBA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://jocoreport.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-LrzEKabpcTUFZpn77ZlwBA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 07 Nov 2023 21:07:18 GMT
expires: Tue, 07 Nov 2023 21:07:18 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js Show response
pagead2.googlesyndication.com/bg/ Frame 7C3E 38 KB
15 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/4WwaGfWzeDAeGvs0ZrtmWMJUG7fu6zGPBJzQt4duOkA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 20:48:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1135
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15096
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 13:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 06 Nov 2024 20:48:23 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 333A 0
0 57ms
56ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231102&jk=2368266610398721&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7C3E 0
10 B 22ms
22ms Image
text/plain 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?RgJCXA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 34ms
34ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-5NERW1W9PD&v=3&t=t&pid=14758924&cv=1&rv=3b60&tc=16&es=1&e=gtm.load&eid=9&u=AgAAAAAAAAAAACCA&h=Ag&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

date: Tue, 07 Nov 2023 21:07:19 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 28C6 42 B
64 B 61ms
60ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuHxQ0IXNZmoFinSTEW5UDsZLVCs_TJiZrh3oBoOXXNeY5tncCRctQKMUUQdMRTfm56TzO79R76hyJu0cHLsr28pj7LvJluQHTlsOCUs1-Cda_E--9O&sig=Cg0ArKJSzMDbaaLJ3aBeEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=86,771,1000,1113,1116&tos=86,685,229,113,3&v=20231106&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699391237702&rpt=258&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 1579 0
127 B 39ms
39ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7DAD 42 B
64 B 62ms
62ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuLb_pxJBaGXntmdunUyUdU27H1TfoVxTqj8Hh_V2OOheRBRAshGI8JldR5fE_gWSw9Xcpfm2iXl9dtNvwmXkr0fCAg8ak8gUfc7AcM5NPU_HH5JoGT&sig=Cg0ArKJSzC0V89R6sDQcEAE&id=lidar2&mcvt=1000&p=0,0,600,200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231106&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699391237724&rpt=275&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 8E46 0
127 B 39ms
39ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 07 Nov 2023 21:07:18 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 60ms
60ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231102&jk=2368266610398721&bg=!tbaltvnNAAb4oU7C2KE7ADQBe5WfOFA3B-p_v7EfXnHdXMg8bbruKiOytd2sNefIwg37sGSRo_ShbMEHdUlfSjCFsoJjAgAAAFxSAAAABmgBB5kC98yXbkeq0XAJT-sK8MuzGo_s9aN88Mpe_qDAXiIV4R3my5_6YmeLCFHX1n3_KqTpVubBnR5yoLmV6ckJi-IvkKtuwCu8PPwcs2FxXeTfXV3D84EFp51ctyFBAazO9veTFY-UDwXPDpLetZPKr2UX3evWcw5y7eNMsdtpJV1Z0V33KsRG06NGfi-JcXxTDkFdZ5Yt6Ji7MkFmVwysJLx1gCORCjXZDEM-L4Vy89NoawNuT4sKRGAg-iKYlFkWr64AUqqTBfRfBnk7sdFMxv1N28IlzvXk5-hMUVCq9f3ZvV3ulc1bDtMd4WoCCI-mRnRll1rr0j9doCx6I-u-oI5btqT6zP137OClpw-MINBksoJQ4NcBoMT5dfZA8LrgT9gl-n2ibyqiJ0hneqM-i3mO_Ddj03Y-oiH1fJPjuymvWAPrHr3soYHkEnlnqN8OaIzFA09GrWrsfUM2aLX3U0bcodHGjHj_zJGp7ZSaddI1qtLAYhRyQpaBD04a4GBbC6dmch0eR56ML7BzsFedmD2pUCc0BMukYISyJDdNKwgLugsoja9PGHeSw2rUgAgnmkGlRqyJijZomerX1y9dDEwfRiJzFQH3mALo9cQCWb1QkEKo9kX3FjiXWKcCHQTS90VGoDImZ-AfgwhMk5uNX0iLqBS7tiFjnlmTU_3-hwB2s6uWZX6HDz20lBXKKLSfqtUG7njZgLpBaIy2wraVAl-qL0NYHjy_e1Rv7LiYKaMVdSIVNAHkbg8PSo4vM5w2xACa-SKr_034mPOO402fGt3gJtg-mvlyNIq9700V_2mjaQ1C0zXxntburfFoDUz8ScujV9RJrr3A4--UkN_Wm5MiQA9PoozqwQEMe5bChapf5DTqlLFWYvH7W_UfcWqXTGqczgDWIWEtBBlFA6ZCTptFLPbcn8vwHty_DcvT9NRu1nn6uRpZvmhwz5-DjJczxZ3r9YSg1GSyt9Dgo_5Xs1dWUEWhmMyF4kijrxL5F2zUtFdEdujXSTtPkA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://jocoreport.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

GET
H2

200

c.gif
www.bing.com/aes/ Frame 6871
Redirect Chain

https://www.bing.com/api/v1/mediation/tracking?adUnit=391466&auId=3dd65340-bf9e-4aef-b1f3-39ecba6eb82c&bidId=15000&bidderId=4&cmExpId=V5&oAdUnit=391466&publisherId=162645330&rId=4b8b88c2-2244-4978-...
https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=e1925e0048924a6494f2525759aa2476&tids=15000&med=10

0
185 B

48ms
48ms

Image
text/plain

2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=e1925e0048924a6494f2525759aa2476&tids=15000&med=10
Protocol: H2
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:18 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6CBE39D97C3E4CBE8B37ECD28CD4F142 Ref B: FRA31EDGE0720 Ref C: 2023-11-07T21:07:19Z
vary: Origin
x-cache: CONFIG_NOCACHE
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
cache-control: private,no-store
content-length: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
date: Tue, 07 Nov 2023 21:07:18 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AF0CC7B3778242FD9F48B9F22E7FEE04 Ref B: FRA31EDGE0720 Ref C: 2023-11-07T21:07:19Z
vary: Origin
x-cache: CONFIG_NOCACHE
content-type: text/html; charset=utf-8
location: https://www.bing.com/aes/c.gif?type=mv&reqver=1.0&rg=e1925e0048924a6494f2525759aa2476&tids=15000&med=10
cache-control: no-cache, no-store, must-revalidate
content-length: 146
expires: 0

POST
H2 200 vevent
ams3-ib.adnxs.com/ Frame 6871 0
556 B 44ms
42ms Ping
text/html 185.89.210.180
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams3-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website&e=wqT_3QLEB8jEAwAAAwDWAAUBCIXOqqoGEJqWicLPxMbWTxgAKjYJNNxzyHYrsz8R_GaL6uyosj8ZAAABAgzoPyH8DRIAKREk0DEAAACgmZmpPzDb-KYDOLUBQLVeSOMDULqJirYBWMexPWAAaJ-kVHjW9AWAAQGKAQNVU0SSBQbwn5gBoAGgAdgEqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2ALwBuACoqgx6gJLaHR0cHM6Ly9qb2NvcmVwb3J0LmNvbS9tYW4tbG9zZXMtMTUwMDAtYWZ0ZXItY2xpY2tpbmctb24tZnJhdWR1bGVudC13ZWJzaXRlgAMAiAMBkAMAmAMJoAMBqgOeAwq0Amh0dHBzOi8vd3d3LmJpbmcFX0xhcGkvdjEvbWVkaWF0aW9uL3RyYQVa8D4_YWRVbml0PTM5MTQ2NiZhdUlkPTRiOGI4OGMyLTIyNDQtNDk3OC1iNTNlLWI0MTU5NTE5NGZjYiZiaWRJZD0FrRgmYmlkZGVyATo0JmNtRXhwSWQ9VjUmb0EyWwAYcHVibGlzaAUoJDE2MjY0NTMzMCYFNo5wALhydHlwZT1udXJsJnRhZ0lkPTY5Mjk0OTkmdHJhZmZpY0dyb3VwPWtuYXFlXzNjJg0WCFN1YgkZ9CoBZmdub3lydnFjbmZmJmFpZD0ke0FVQ1RJT05fSUR9EgUxMjA4NRoTNTc0MTI3Mzg0NjA1MzQ4OTQzNCIJMzgxODQ2NzE0KgRiaW5nOjhVMlZoY21Ob1FXUWpPRFF6TVRrek5EQXlOamMwTWpVak1qTXpOakV4T0RZeE1qRTBOVEF3T1E9PcAD2ATIAwDYA_2qqgHgAwDoAwD4AwOABACSBAQvdWFwmAQAqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBAHwBLqJirYBiAUBmAUAoAX06PnrzomRlQbABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AX52kv6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGwo0E2gYWChAJNRkBdBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH1vQF0gcNCREoASYM2gcGCAUJqOAHAOoHAggA8AfRogSKCAIQAJUIAACAP5gIAcAI8AbSCAkI____PxACGAA.&s=5066061e5c52e66f562fae91b927435a7869ad4b&type=pv&jm=1003&px=0&py=0&bw=180&bh=180&sf=1&sid=7222536061741228660&vd=ct~0|rr~5&sv=239&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=6929499&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:19 GMT
an-x-request-uuid: 3bad9c4b-867c-47e8-816f-a216f406af26
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 217.114.218.20; 217.114.218.20; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6871 42 B
64 B 60ms
60ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsusF6W1UsIjA3BOV9suBWFFBWr1PRcXCLqXQtk0YWi7JsRj6yfBjxbXbDnUZexVMVCGQOwZwbrXqVUwThjocgTiQBeRvbJltUECmyI3lmQ2JcsTreWM-A&sig=Cg0ArKJSzPRf8P_NZReeEAE&id=lidar2&mcvt=1001&p=0,0,600,160&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231106&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1699391237814&rpt=677&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 29ms
28ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-5NERW1W9PD&gtm=45je3b60v875062412&_p=1699391236404&gcd=11l1l1l1l1&cid=1793292123.1699391237&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&sid=1699391236&sct=1&seg=0&dl=https%3A%2F%2Fjocoreport.com%2Fman-loses-15000-after-clicking-on-fraudulent-website%2F&dt=Man%20Loses%20%2415%2C000%20After%20Clicking%20On%20Fraudulent%20Website%20%7C%20JoCo%20Report&_s=2&tfd=8257
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-5NERW1W9PD
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://jocoreport.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.105 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 07 Nov 2023 21:07:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://jocoreport.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

174 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.jocoreport.com/	1970-01-21 01:39:11	Name: _ga Value: GA1.1.1793292123.1699391237
.jocoreport.com/	1970-01-21 01:24:47	Name: __gads Value: ID=254ba367273a0f66:T=1699391236:RT=1699391236:S=ALNI_MZ0Z9gYYTd1RhrFgE2IH-VSCqEq3Q
.jocoreport.com/	1970-01-21 01:24:47	Name: __gpi Value: UID=00000cbc14c6dc05:T=1699391236:RT=1699391236:S=ALNI_MZZXctcfMyJ5TydXjiC3NrRstYp5A
.doubleclick.net/	1970-01-21 01:24:47	Name: IDE Value: AHWqTUlruthRXVj3441RamDUuALGJIj-kfMOcVAbSE6czZlQbvzfzTQbY6-ApuqPwbo
.bing.com/	1970-01-21 01:24:47	Name: MUID Value: 364BA862C640631109A7BBA0C7EC62A2
.jocoreport.com/	1970-01-21 01:39:11	Name: _ga_5NERW1W9PD Value: GS1.1.1699391236.1.0.1699391238.58.0.0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://googleads.g.doubleclick.net/pagead/html/r20231102/r20110914/zrt_lookup.html?fsb=1(Line 19) Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
ads.eu.criteo.com
adsdk.microsoft.com
ams3-ib.adnxs.com
c0.wp.com
cat.nl3.eu.criteo.com
cdn.adnxs.com
cdn2.lockerdomecdn.com
csm.eu.criteo.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i0.wp.com
i1.wp.com
i2.wp.com
imageproxy.eu.criteo.net
jetpack.wordpress.com
jocoreport.com
lockerdome.com
pagead2.googlesyndication.com
pixel.wp.com
region1.analytics.google.com
rtb.fr3.eu.criteo.com
s0.wp.com
static.criteo.net
stats.g.doubleclick.net
stats.wp.com
tpc.googlesyndication.com
www.bing.com
www.facebook.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
104.154.142.214
151.101.1.108
151.139.128.10
158.106.132.162
178.250.1.6
185.89.210.180
192.0.76.3
192.0.77.2
192.0.77.32
192.0.77.37
192.0.78.32
2001:4860:4802:32::36
2620:1ec:46::45
2620:1ec:c11::200
2a00:1450:4001:80b::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:812::2002
2a00:1450:4001:813::200a
2a00:1450:4001:827::2002
2a00:1450:4001:828::2001
2a00:1450:4001:82b::2004
2a00:1450:4001:830::2003
2a00:1450:4001:831::2003
2a00:1450:400c:c09::9a
2a02:2638:3::10
2a02:2638:3::12
2a02:2638:3::1a
2a02:2638:3::3
2a02:2638:d::c
2a03:2880:f176:84:face:b00c:0:25de
2a04:fa87:fffe::c000:4902
01de188d8151eae8b160df72abc95e572da11e65689c36cdbdf50e0169b02876
05a8d6c5577f0ce383fbf0b787eae9683a166a5aae7bca27fc6d59c53b413f02
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0d0128fe46a93bd170b68b2dcb29a9ba93601d3730a3d2f01f8b716e7648cad7
0f438d116de93f199b940462e19c48603fe8839c608ab9ab29b06a72632a0068
0fe693d9fbaa62ba105f120d1e341474c4f1bdcc00f358c6afbd02c0f98b584b
10e1c97e5d8cf7ee6133ede9d27a66432777870640c099783d617d7cb4682c19
1170849a1f6deb911dc030011d8bcc57a6caaf659343e66114fb2f87369ed40e
118240d079e9006dfd8328d78acabb9ad7011c432a9d665476453861701b79a8
14392c9baa0d1e691f861f1bfa0cda3caf6d3080edfabda0a2c276dfa13f2afe
1b94aece6b9354c2d4d36ce463717c06be5a9038fa0586667b7bca3a8811f588
20d29d0ad14066db520559214845ba6c250aa4a12b53db633c932189e9a7a688
2582b168b13462f23994921b6666f9f41d3bd8fe09b92e159cdb6c4a8fbbfa17
265fbae178ad2588b24a74bc696202921bad6a75d1ccbbad5e7973254dad1247
27dd9b075cc59cf5f3c0f6ee075f4bd113782d81ce30a4f16aac669ecfdc4fa2
2bca0dae15027898dd6a7536d5b041014f928fbc60d9ce04dd2fa4c5d37d36ad
2bd2cf513443967c84694435a79964881012973b858a062e51fe5ebb9714cdde
2cb1ad7e345218027837856c6102daf12bf6142556dbea4a8c38499582044930
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
30cac3693b641b4c3ef678eacd92f8dc38ac68c498bd4f9d92e832471ada8b78
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32f51e3b34ff3998b47132a01acb777cf636a2df90838b0e30617bf06ab46d7d
336a25d31d729ad4223f664f1c0e4f82778979cb5ca97edd303d40241d6b272c
37f81dfa473e551ebde3be297dee64b41c2c3d67707ad27c2ea238c37764d8bb
3d97c7a354ee5666e22c59498be5331a0edee5d6f7527a58a5744f323173bc8d
3dffa84e13fbc367c907ff31e293923484de18c4c06cac97109e4b9a1b19752c
44723d4b4e3bc036d2b57a4e90e9f2aa18ec7b0ebed064c63280eb56cbcb3858
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
47d28f2d8e65dc2ee8bf14064d39a5915f75fca7c1c91b922f6955fe7fc02f68
49aab3654c0477abd8a4137c2e80f8ff473eb401ca56ee7e2b7cf3f1fa2b7ec4
4c00c1ad243d13703486c1ec45b38775badc4008634ea23a0889b8ef670c2a70
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
515fbfeb51a45e120dc53c8bfda86c38d3b8e7f3163ff22515437237ea3ea0f3
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
557241f266bd000f857b9a60391814932edc82f99323995a792bf865c1462f75
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527
573736701009177204f284927ce78619b455a8571504efc199d487f83ae8b72f
5b45b15ad23f0a8229998fd0fcd1b36835c99cc71367e32dadb50458bf3bf648
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
5da1617482eb179636908105424caee158524df7cf02f07a8d5feec5fadbd8b9
5fd058e8362e305341a3ff93766fd9e3863bd93e79ef24e04089564e528c5a1c
610256df7d1d883c3680fc08210f370bcbedfa42b0264657970b24f7d1fa445d
6181cd98fe270c2826d416574446841f86778bc45a0ab0bdd0c667b4e70fd6e8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
626c65063bcb00fcc4574cffc418820fc209794a0519ec1e65931896c79a6ee1
659571034a0a88285c936208b32203bb7750fe111a145b97cadbf2992aeaff6e
66621c8bcb04970172781f7d4f84a671b6f8b100a741d2bef4b6b8da6b6b1404
67447c3656caad630373253691f3e8f64467eafd6e7305c9b0e98111b0b41694
67e17eded48efd41da15c98b87275c8c4ef6a641859c4f253f0409219bdcad13
6a486bb6036ea984d293ab009566e99e522abc19f8833c5fd49630be7eba0135
6a67d82954e869f63863c01de1404e74d89722d7774b105176d253292b75b6aa
6bf4dd03b427c54380c1d4faf18bf8f27884fd50f0d798a9b6520579c728c64d
6e098e2b3ea73499b2d72375cf5c9c691c5a81b6b8994c97e7e60a915dfcc7c9
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a
7296e6186ef6ea7b67c6a0b487cec47c3b327cc8e8212909b1c85c65a743c3be
76ee0961e6fc5fe6be30f86e379b24c011ada622f43d9bf323548cc656d6cb28
7765ed486c4b940f73d3f6036f93742ae0e9e31b89f53d61278c58691b68c0aa
78a137d5382f19aaea55e95b55e39a7829de05832714fc275d8a10312a3539d6
792180698e17019192621dfb6615fb58b7b158c5bcb9c8e08ee92d51bea79791
7ae5b52b01b37efb4547c3493f75abf51dc034326bb6f1ff6fc97348065716ba
7b245536cb06c2a98a0b4afa4cde3671854c5c348cc2af396592e2cfb9e18cec
7e572528ad2f7d09b31fdfbb8cb68f9b0f9fe3b99d22ad4b95f4bd2d1352ae8a
801b3a26f4f89ae50c0501d3d1a6064dbf9ebc4660ba75e8de40f15bfc0b6f74
82932a8e8382473453096e4dfdd0223611789dafd09182838a79f8e34403b420
836c031b3c77e7ef012f80443145eaf2945f585fd9ac4e2c78571ef27da00670
84ff5956551fc72f1de653dbcc731847e839614696a06b6fb65bc900993b6c9c
85b7284c4d8e54216be4082addda18358f663a0ec0bbeddfeebffe2a45fc9b27
882b0276c78312143b52c67c7bf0c6d335efc5ab5613b9f83ac35fc3e28a1dbb
88d22d83af1b6a5a266b51048004fb4ad7e2ca34bef788d61182a9108d658a1d
89c9b263ca1f64b9056ef53582f36aed087d04f120a497a2bbc4d7aec11285a7
8a160afe51c9194fdfcd317cfab7677c85ff00fd893739da00f2a0b8dc3df9f5
8ab79ac24ee68309d1d0d72893e2c80e6c083fe51092a3a9dbff8ba5edc0eac0
8b9bc0eb5aeb3ca989deb2a2775eea2a1a57cc613c34e0dab2224c53fbafefc1
8e81fcac714f76272bbeb4872fed3a4b84410ed89fe0243acf406986a7611b27
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
9221608a4df26c3a67d553a85ea42269235ca69d2ff47419148853830d5cea2d
96e4b189a5cd571d605ca141ffdee7bf110cbb07dc17287058fa6f7b0cfb8900
98a2fbbfdf666c4b875ed5d04436b77dc3890b85788f085967b51bb0305bbee8
9b06f441b65c4299ee34eba83aca8c325b917b545c1a2e86583c386681d6960a
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
9caf317a3fad7fec391eda2d238ebeb2bf8d1127766a84f41b5464aabd76b79a
9d51ffab743363599c622d663c66dc987b6538e1342eabb0ede175dbb6863478
9d7858fcf072cca6ec23f9b871b0ea6f8c03f0ebda25bfa8e5f19ed9b62c082e
9ea6aaf42186073ffcd53912f4cc93b997d050986223ee55ae0ab2661f2d2134
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a11c7a846c9d7f1b4989494cfa26ff2495baa2f0b2dfaca4723cd0432077ce87
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a4b423bd3e84385d2bb624a55cddfaafe863235df9791628cb4fc0a9472d3f76
a51003115e6640ac72b7a1c6525250bd66ff3cb60f207168c9aef0369c484098
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a9c49f9f526c232731b2ff9aa3e31b686b8b339bdd246bbf74f804c802f9755d
abc3e5b7c4f477ff2289ebccbba4d30443495451f9a51c7cb7bd5fca87fbfc4f
ad96484d7d3a3193cfde0088f1e90a2c5904111ae96016b5bf952a5198281be9
ae49cdb646041a29468125dcba23a151c43da21996b3ae5fb87179255af52668
ae4d865d44e906f3b7deb27e0e06f90b10340a50c04e7aa0a8d6d723afa6d2e9
aeaa5b402ff7742df6f985960c56526cb6f2856c55eb1ddc079ef9ad01293a93
aeb24331352c11f5446dd670d75325a3c4e3b8a6bd7f92ee1c88f8b8636d4d9c
af3a01e20fbba9da6246a49945791e48be0a7014fbebd42b2f243507aeafd5ad
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b2016e1b13b47ba8ab2e20527303ba20c08405b627f1340b8a956d801279c447
b29471c4f0292332854ad3e0db49474877f79dcb807ae943ee6a616e939fcb11
b4f46f8fbddc011bd07448cdf7b2b1f9edd734b534677581f5c49a55984593df
b6e4492d3b8358a81b80908b1f84e6bd2f64a7a46d48793af99d27bf29f4c2e8
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b853c94e04ed6ed68a68fb1cd7aad27cf4fce648c3cca7db5daad27df41f670c
b885670b8d44a105a61e6d2d7ab91ce1069ba87c4bc94e33d2b65910efba0cbf
ba2d293f01789ef093b5b67ca430d9d1a95a5782e7f72e9b961163f4ba56f43b
bc2ef718518a618850126d5c719e25f3dee9ab3d49f4af88c4414fd3e405b213
bc531edb737131beee262d805228188423b842a23009de519fb84005ef60fcd4
bc98677b8fc84565b57a5c326dba02188b03fa3005be24110c6caf9c7aadca21
bf768039ec7c9b08b3971013138f995af3fc993606e6d42dc7389d01f6ee7a1f
c0e09e793fb79507dc97ed702a4c2c9c00ab4d1677bd45bcd112e203c96dd661
c10aa37ef938366c816705ca3a114fdc2eed926a4f48d963a32358d0e8be80af
c258caf8b9e4f16d2333a394f14aa0a8a376e3c591412f91a2264bf440f6e2f2
c84b33ef039cfde382df32d6736dc00281d42d092dc9157cea29359f1a988a5c
c9a612722eed86936463bc8772a9d4509e0c24f22485221beaa583a60079fef2
ca7752fb33cf3a98c0f29bc4eec563112025da4109a0dcc69dabf5f861751258
ca7dce2391845e8aec7da135f33fabd10f74eed28a532ac66fd01f761fcfb42f
ced232c8b6b165ef0cb92272d25f07dc37d0a37b54932735a0bc3e5113132d85
d00c867e4178b1482b25c185aaceb8ae071be2a1e7b91acc46d89c4e64b11fb8
d752b2f14caf7002e6f1bfcabeca1e7ca15741453ec1c631167778f14eba6223
d77be55832a4204c8750784a2a853b3f7c33fdd8beb2cd0e39fad71c48d3e6e1
db5ffd916dbeb4938cc236cb3a42e73a56987f28c5deb9f3beccbe2c4af19307
dd2d3b8d18bdbf9be075bb3195b6784877c69209e97c48ffa5d30120bea21215
e16c1a19f5b378301e1afb3466bb6658c2541bb7eeeb318f049cd0b7876e3a40
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e61982666f8e828ba57941c43933eb441d35a92113c597d977c236e846b4463b
e688e2ec0740da10d3fe73ce5b3e6e27ac56097cf0cc8be84b668303e4823d9b
e7926dc4d0147b1cf005939a3cef091028d810de29aae9eac958dd8ad4a09f2a
ed5724159a8f6ac6e42d3a8b66fdc874b0a197c53368a09579cd67fdd5fcc094
ee46bdadc83beb5e76bce18bc7cc3d169c7f0490901f6be96ec41ee2c14d3776
ee87e6547702fb6ef8a6f9d5ef54c46594c7481654f383a9ba9c17867932172c
ef035731dc7446c59956b57dc3dd713fd3f7d56b4ed8ab6c8f3c113acb9bdeb2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2be0d99588fd30f81f9d519e27422142ecb0af1d4ed5bc7e81d4eb32fe99978
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f59697a502ea192bdf7199349d0858e55bf837a622a36dbe7d190c6a67348282
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f99614276cd149735ac9e7ec10cfde1c872ac9b870f517415dff3caadbb31db8
f9c8796516af78ee9f53c91aaeeb28cd54e33dee0fb377e7a65be204558df0da
fcc77a69f0cac24091c193d08f2e3e591ef2e6e3b2b1f7afcae7f4fdce0afdbf
fe541d5a8862d0ee4f0ae66b9b3c5640d3131f0e2551608fd78a9b92f4cf48c1

jocoreport.com Open in urlscan Pro 158.106.132.162 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

220 Requests

98 %HTTPS

65 %IPv6

20 Domains

34 Subdomains

32 IPs

5 Countries

3546 kBTransfer

8058 kBSize

6 Cookies

16 Outgoing links

Redirected requests

220 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

jocoreport.com Open in urlscan Pro
158.106.132.162 Public Scan

Screenshot
Live screenshot

Full Image

220
Requests

98 %
HTTPS

65 %
IPv6

20
Domains

34
Subdomains

32
IPs

5
Countries

3546 kB
Transfer

8058 kB
Size

6
Cookies

220 HTTP transactions
6 data transactions