www.executiveplacements.com Open in urlscan Pro
50.28.79.140  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Candidate_Unsubscribe.asp Show response www.executiveplacements.com/	65 KB 66 KB	564ms 224ms	Document text/html	50.28.79.140 LIQUIDWEB
General Check archive.org Show headers Download Go to Full URL https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 50.28.79.140 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS jobplacements.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 2d2ac2588259299557e91f78472e1bd6316512d0fe69527b3ae2ce6e51c92942 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control private Content-Encoding gzip Content-Type text/html Date Tue, 12 Apr 2022 07:43:38 GMT Server Microsoft-IIS/8.5 Transfer-Encoding chunked Vary Accept-Encoding X-Powered-By ASP.NET X-Powered-By-Plesk PleskWin
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	127ms 40ms	Script text/javascript	2a00:1450:4001:829::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 5188 date Tue, 12 Apr 2022 06:17:11 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Tue, 12 Apr 2022 08:17:11 GMT
GET H/1.1	200 OK	logo-sml.png www.executiveplacements.com/images/	4 KB 5 KB	220ms 112ms	Image image/png	50.28.79.140 LIQUIDWEB
General Check archive.org Show headers Download Go to Show image Full URL https://www.executiveplacements.com/images/logo-sml.png Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 50.28.79.140 , United States, ASN32244 (LIQUIDWEB, US), Reverse DNS jobplacements.com Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 1fd043a39631898033e336f80a1631f21de6ed320b506c21521daf5339921bf1 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/Candidate_Unsubscribe.asp User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers X-Powered-By-Plesk PleskWin Date Tue, 12 Apr 2022 07:43:38 GMT Last-Modified Thu, 19 Oct 2017 10:17:57 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET ETag "622aac88c348d31:0" Content-Type image/png Accept-Ranges bytes Content-Length 4450
GET H2	200	js Show response www.googletagmanager.com/gtag/	149 KB 56 KB	138ms 52ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-1070794473 Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9f80adbe8e82b30ee067af256d1ab5deb723c448260d309478507b22596b4bfc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 12 Apr 2022 07:43:39 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 56394 x-xss-protection 0 last-modified Tue, 12 Apr 2022 06:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 12 Apr 2022 07:43:39 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	128ms 40ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 05 Apr 2022 17:46:42 GMT content-encoding gzip x-content-type-options nosniff age 568617 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30306 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 05 Apr 2023 17:46:42 GMT
GET H2	200	41f91209b5.js Show response use.fontawesome.com/	9 KB 4 KB	266ms 225ms	Script text/javascript	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/41f91209b5.js Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 115b39fb6522c53b88a5b67765d13552c757ef52287d8afd3d2c46a543e0a6b5 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 12 Apr 2022 07:43:40 GMT content-encoding br cf-cache-status REVALIDATED nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-request-id E6ZJ3NPRJ1NTTTDN alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-id-2 xQGmtHirs+cYl5H7xhdTR9jAWLw42TwD3ek4wCx5DvKzMchvJBPAdnhYwxABt295MseLq+/ylBo= last-modified Wed, 30 Jun 2021 18:40:32 GMT server cloudflare etag W/"0c650da5bfc0d7fba37b8226d07ff2ce" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5K6n%2BDKxVf6gBKpxbEYlB%2FhwIidHh7fqXtjBoT6Gkq6UG5jzjElMBCvTu%2B0btXrt%2BSO3gUah8dATqTEFe3nWeLnKIpmMMAjqEAU4rfiDket9z5Z5xNox8RrFwcNAmhoAYZKEbqjmkl9%2BE8P5VQPbQ%2Bn8"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control max-age=1800 cf-ray 6faa55129d519bdc-FRA
POST H2	200	collect Show response www.google-analytics.com/j/	4 B 217 B	47ms 46ms	XHR text/plain	2a00:1450:4001:829::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2120300544&t=pageview&_s=1&dl=https%3A%2F%2Fwww.executiveplacements.com%2FCandidate_Unsubscribe.asp&ul=en-us&de=UTF-8&dt=Executive%20Placements%20-%20Unsubscribe&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAAABAAAAAC~&jid=1518961654&gjid=941540921&cid=758218954.1649749420&tid=UA-47496343-1&_gid=1407920537.1649749420&_r=1&_slc=1&z=1650683544 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.executiveplacements.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 12 Apr 2022 07:43:39 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.executiveplacements.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 447 B	61ms 19ms	XHR text/plain	2a00:1450:400c:c06::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-47496343-1&cid=758218954.1649749420&jid=1518961654&gjid=941540921&_gid=1407920537.1649749420&_u=IEBAAAAAAAAAAC~&z=356120047 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.executiveplacements.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 12 Apr 2022 07:43:40 GMT content-type text/plain access-control-allow-origin https://www.executiveplacements.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	39 KB 15 KB	143ms 53ms	Script text/javascript	172.217.16.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-1070794473 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.16.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS zrh04s06-in-f130.1e100.net Software cafe / Resource Hash 7ce02e0f563c14e7fd2d3249c13317e74fef66108f27096bf04a04552aa0c99c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 12 Apr 2022 07:43:40 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14886 x-xss-protection 0 server cafe etag 11980861724045072707 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Tue, 12 Apr 2022 07:43:40 GMT
GET H3	200	41f91209b5.css use.fontawesome.com/	1 KB 1 KB	42ms 24ms	Stylesheet text/css	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/41f91209b5.css Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/41f91209b5.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd2dda4cb80d9cf7851db069f442cc5d7490518bb7e143651bbc27cc8ef46b29 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 12 Apr 2022 07:43:40 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4322 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-request-id SY5BP3Q5KQ6TMVV0 x-amz-id-2 NpkfNiMF3ZsIh5pxZIAFpawYYwxbCU8U9r+7P9PNhk/7KvJ3AhP3EGyFSVW/Tcl/yI2aogaoy/o= last-modified Wed, 30 Jun 2021 18:40:32 GMT server cloudflare etag W/"2922a87fa930292c3f6a594952fd11e4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fz%2BHrUin%2FwvFQJorzurWzHulpDkawGwNPWpMYD2bINMkw1%2FCg1zitwG1IwpsQQEJWPSM3ZosPdXeUdIHAqIxnhawtM8e7SWmlVYtZzVpDecUdQqHqCQLRy5RNXSW2Mkp%2B%2BJ7UNEw%2Fq2fUU0qCitOlRAp"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=1800 cf-ray 6faa55141f2468fe-FRA
GET H3	200	font-awesome-css.min.css use.fontawesome.com/releases/v4.7.0/css/	30 KB 7 KB	24ms 23ms	Stylesheet text/css	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/41f91209b5.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350 Request headers accept-language de-DE,de;q=0.9 Referer https://use.fontawesome.com/41f91209b5.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 12 Apr 2022 07:43:40 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3998012 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-amz-request-id YNYFYTJYPA8MFS91 x-amz-id-2 sk0zsUQrJCjoG8lf+ElTVxsm/JiXn1nFoZ4H8xBPrj/IT2ltsrQxcAFt6jCc8r1g35mkObEuS+Y= last-modified Wed, 30 Jun 2021 15:26:48 GMT server cloudflare etag W/"36082410df2ef7f83932219089dc1443" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y6EIieLkHSAmAGIJztCUGyWmKp9BQGdDE2AamS6q7t2prMxumA57YYH8K6ZPW5xq1Z%2F%2FW7GoqPhLeRiduUZnYXeJug%2FXYaXSgCnditaL%2Bg0K8UUAmNNk0%2FXtqps3U%2FhIIWRj7mU92z51YhOuqBVyqg1S"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=31556926 cf-ray 6faa55144f6c68fe-FRA
GET H3	200	fontawesome-webfont.woff2 use.fontawesome.com/releases/v4.7.0/fonts/	75 KB 76 KB	45ms 26ms	Font application/font-woff2	2a06:98c1:3121::7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://use.fontawesome.com/releases/v4.7.0/fonts/fontawesome-webfont.woff2 Requested by Host: use.fontawesome.com URL: https://use.fontawesome.com/41f91209b5.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe Request headers Referer https://use.fontawesome.com/41f91209b5.css Origin https://www.executiveplacements.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers date Tue, 12 Apr 2022 07:43:40 GMT access-control-allow-methods GET vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4548067 cf-ray 6faa551499075c4a-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 77160 x-amz-id-2 G/aVtn2WnEgU31h1pPjfVNgATL/0qI+jNRH9C9cssOJpoVNtvvMG00Fh5q1kjfn9u+pGXSwRe6E= last-modified Wed, 30 Jun 2021 15:26:48 GMT server cloudflare etag "af7ae505a9eed503f8b8e6982036873e" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kze0D88DVI3vexKmSzMnwhNEmH0GRcMwSPTQp7r%2B8740hnr5cloKQ6AZ82adjUYIuf37lfWMzEHONgs8pWIUU7ELEvMY4oTRMahKT9io0vamq%2FK3bi5uIsh600UWWXggB%2F2Nvcy9n4OrmyYobwOsStVy"}],"group":"cf-nel","max_age":604800} x-amz-request-id WPF5G635FP99ARS6 access-control-allow-origin * cache-control max-age=31556926 accept-ranges bytes content-type application/font-woff2
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1070794473/	2 KB 2 KB	144ms 57ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070794473/?random=1649749420245&cv=9&fst=1649749420245&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa460&sendb=1&ig=1&data=event%3Dgtag.config%3B%20allow_enhanced_conversions%3Dtrue&frm=0&url=https%3A%2F%2Fwww.executiveplacements.com%2FCandidate_Unsubscribe.asp&tiba=Executive%20Placements%20-%20Unsubscribe&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e7eadff72ef5ecb07c348e1fc9880161ca2b551cc38037cd0d50e269bfb02ee3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers pragma no-cache date Tue, 12 Apr 2022 07:43:40 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1080 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/1070794473/	42 B 548 B	140ms 51ms	Image image/gif	2a00:1450:4001:80e::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1070794473/?random=1649749420245&cv=9&fst=1649746800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa460&sendb=1&data=event%3Dgtag.config%3B%20allow_enhanced_conversions%3Dtrue&frm=0&url=https%3A%2F%2Fwww.executiveplacements.com%2FCandidate_Unsubscribe.asp&tiba=Executive%20Placements%20-%20Unsubscribe&async=1&fmt=3&is_vtc=1&random=3977379577&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers pragma no-cache date Tue, 12 Apr 2022 07:43:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1070794473/	42 B 548 B	141ms 53ms	Image image/gif	2a00:1450:4001:811::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1070794473/?random=1649749420245&cv=9&fst=1649746800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa460&sendb=1&data=event%3Dgtag.config%3B%20allow_enhanced_conversions%3Dtrue&frm=0&url=https%3A%2F%2Fwww.executiveplacements.com%2FCandidate_Unsubscribe.asp&tiba=Executive%20Placements%20-%20Unsubscribe&async=1&fmt=3&is_vtc=1&random=3977379577&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: www.executiveplacements.com URL: https://www.executiveplacements.com/Candidate_Unsubscribe.asp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.executiveplacements.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Response headers pragma no-cache date Tue, 12 Apr 2022 07:43:40 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails string| GoogleAnalyticsObject function| ga function| gtag object| dataLayer object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery object| google_tag_manager object| FontAwesomeCdnConfig string| cssUrl function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.executiveplacements.com/	1969-12-31 23:59:59	Name: ASPSESSIONIDSWTAQQSR Value: OONJMKHCHFNIIABBKNCJGLDD
			.executiveplacements.com/	1970-01-20 19:47:01	Name: _ga Value: GA1.2.758218954.1649749420
			.executiveplacements.com/	1970-01-20 02:17:15	Name: _gid Value: GA1.2.1407920537.1649749420
			.executiveplacements.com/	1970-01-20 02:15:49	Name: _gat Value: 1
			.executiveplacements.com/	1970-01-20 04:25:25	Name: _gcl_au Value: 1.1.1101194737.1649749420
			.doubleclick.net/	1970-01-20 02:15:50	Name: test_cookie Value: CheckForPermission

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
googleads.g.doubleclick.net
stats.g.doubleclick.net
use.fontawesome.com
www.executiveplacements.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
172.217.16.130
2a00:1450:4001:80e::2004
2a00:1450:4001:80f::2002
2a00:1450:4001:811::2003
2a00:1450:4001:829::200e
2a00:1450:4001:82b::200a
2a00:1450:4001:830::2008
2a00:1450:400c:c06::9d
2a06:98c1:3121::7
50.28.79.140
115b39fb6522c53b88a5b67765d13552c757ef52287d8afd3d2c46a543e0a6b5
1fd043a39631898033e336f80a1631f21de6ed320b506c21521daf5339921bf1
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2d2ac2588259299557e91f78472e1bd6316512d0fe69527b3ae2ce6e51c92942
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7ce02e0f563c14e7fd2d3249c13317e74fef66108f27096bf04a04552aa0c99c
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9f80adbe8e82b30ee067af256d1ab5deb723c448260d309478507b22596b4bfc
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
dd2dda4cb80d9cf7851db069f442cc5d7490518bb7e143651bbc27cc8ef46b29
e7eadff72ef5ecb07c348e1fc9880161ca2b551cc38037cd0d50e269bfb02ee3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629