ramadantoyoz2.pages.dev Open in urlscan Pro
172.66.44.207 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ramadantoyoz2.pages.dev/
Effective URL:
https://ramadantoyoz2.pages.dev/
Submission Tags: threatview.io malwar3ninja rule: suspected phishing scam automated-submission Search All
Submission: On November 23 via api (November 23rd 2024, 7:12:04 am UTC) from DE — Scanned from CA

Summary HTTP 34 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 13 domains to perform 34 HTTP transactions. The main IP is 172.66.44.207, located in United States and belongs to CLOUDFLARENET, US. The main domain is ramadantoyoz2.pages.dev.
TLS certificate: Issued by WE1 on November 19th 2024. Valid for: 3 months.

This is the only time ramadantoyoz2.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	172.66.44.207 172.66.44.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4004:c08::5f	15169 (GOOGLE) (GOOGLE)
11	199.232.192.193 199.232.192.193	54113 (FASTLY) (FASTLY)
2	185.66.200.222 185.66.200.222	201702 (SKHOSTING...) (SKHOSTING-EU skHosting.eu s.r.o.)
3 3	67.199.248.11 67.199.248.11	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2607:f8b0:400... 2607:f8b0:4004:c0b::61	15169 (GOOGLE) (GOOGLE)
2	64.233.180.94 64.233.180.94	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
2	2607:f8b0:400... 2607:f8b0:4004:c1f::64	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::181	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c17::9c	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c08::9a	15169 (GOOGLE) (GOOGLE)
1	142.251.16.94 142.251.16.94	15169 (GOOGLE) (GOOGLE)
34	13

7 172.66.44.207 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

ramadantoyoz2.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.11.207 (None, )

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c08::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 199.232.192.193 (United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.66.200.222 (Slovakia)

ASN201702 (SKHOSTING-EU skHosting.eu s.r.o., SK)
PTR: 185.66.200.222.skhosting.eu

cdn-server.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 67.199.248.11 (United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c0b::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.233.180.94 (United States)

ASN15169 (GOOGLE, US)
PTR: pe-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1f::64 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::9a (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.16.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bl-in-f94.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	imgur.com i.imgur.com — Cisco Umbrella Rank: 8961	773 B
7	pages.dev 1 redirects ramadantoyoz2.pages.dev	27 KB
3	bit.ly 3 redirects bit.ly — Cisco Umbrella Rank: 7701	845 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 135 td.doubleclick.net — Cisco Umbrella Rank: 182	559 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	22 KB
2	gstatic.com fonts.gstatic.com	48 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	187 KB
2	cdn-server.info cdn-server.info	998 B
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	1 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1255	83 KB
1	google.ca www.google.ca — Cisco Umbrella Rank: 11557	63 B
1	google.com analytics.google.com — Cisco Umbrella Rank: 142
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 847	33 KB
34	13

	Domain	Requested by
11	i.imgur.com	ramadantoyoz2.pages.dev
7	ramadantoyoz2.pages.dev	1 redirects ramadantoyoz2.pages.dev
3	bit.ly	3 redirects
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagmanager.com	ramadantoyoz2.pages.dev www.googletagmanager.com
2	cdn-server.info	ramadantoyoz2.pages.dev cdn-server.info
2	fonts.googleapis.com	ramadantoyoz2.pages.dev
2	maxcdn.bootstrapcdn.com	ramadantoyoz2.pages.dev maxcdn.bootstrapcdn.com
1	www.google.ca	ramadantoyoz2.pages.dev
1	td.doubleclick.net	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	code.jquery.com	ramadantoyoz2.pages.dev
34	14

This site contains no links.

Subject Issuer	Validity	Valid
ramadantoyoz2.pages.dev WE1	`2024-11-19` - `2025-02-17`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-11-18` - `2025-02-16`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-15` - `2025-02-14`	a year	crt.sh
banners.cdn-server.info R10	`2024-10-15` - `2025-01-13`	3 months	crt.sh
*.google-analytics.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
*.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.doubleclick.net WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
*.google.ca WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://ramadantoyoz2.pages.dev/
Frame ID: 212B475BF14FD48D9EC0A5E302C1767F
Requests: 32 HTTP requests in this frame

Frame: https://cdn-server.info/bnr_xload.php?section=General&pub=533889&format=300x250&ga=g&xt=173234591944257&xtt=3737541&dateStr=11/22/2024%2023:12:00
Frame ID: 80B5F2A579240C57CC27E45C3F035986
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-2H0WXCQSF6&gacid=157086895.1732345920&gtm=45je4bk0v881533750za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=670227207
Frame ID: 6902A76455D7628E7FBE6A720B6FB706
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

RAMADAN-TOYO

Page URL History Show full URLs

http://ramadantoyoz2.pages.dev/ HTTP 307
https://ramadantoyoz2.pages.dev/ Page URL
https://ramadantoyoz2.pages.dev/cdn-cgi/phish-bypass?atok=UM.oErzUfYXCfIAiWkfAmKAFE4xVXV9XJc7aSbabm_c-173234... HTTP 301
https://ramadantoyoz2.pages.dev/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

34
Requests

91 %
HTTPS

50 %
IPv6

13
Domains

14
Subdomains

13
IPs

3
Countries

403 kB
Transfer

956 kB
Size

11
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ramadantoyoz2.pages.dev/ HTTP 307
https://ramadantoyoz2.pages.dev/ Page URL
https://ramadantoyoz2.pages.dev/cdn-cgi/phish-bypass?atok=UM.oErzUfYXCfIAiWkfAmKAFE4xVXV9XJc7aSbabm_c-1732345913-0.0.1.1-%2F HTTP 301
https://ramadantoyoz2.pages.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://ramadantoyoz2.pages.dev/ HTTP 307
https://ramadantoyoz2.pages.dev/

Request Chain 12

https://bit.ly/3ZGgnEq HTTP 301
https://i.imgur.com/TU3rrWa.png

Request Chain 13

https://bit.ly/3ZGgCzk HTTP 301
https://i.imgur.com/gXBAvIR.png

Request Chain 14

https://bit.ly/3yskiJj HTTP 301
https://i.imgur.com/RQifdbu.png

34 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

403

/ Show response
ramadantoyoz2.pages.dev/
Redirect Chain

http://ramadantoyoz2.pages.dev/
https://ramadantoyoz2.pages.dev/

4 KB
2 KB

121ms
28ms

Document
text/html

172.66.44.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ramadantoyoz2.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8679ff0608f1b713ecd33d395679a63e37922ad0edcd92b1d5ab2c7c4491be2b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8e6f5908bb1436c0-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 23 Nov 2024 07:11:53 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bK%2BosSnd65ihk63jj7KOLDEVNvM6brlwKUsAEizw9kABiLgmlqQjFACV%2FvraYhbreo74cUS47WTCnKsUs2mmcmINQLeDM7nM%2BHdrOb6yfFJXv4FLcstPqMWZxeiFRvprQ9Aih77i18komA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://ramadantoyoz2.pages.dev/
Non-Authoritative-Reason: HSTS

GET
H3 200 cf.errors.css
ramadantoyoz2.pages.dev/cdn-cgi/styles/ 23 KB
5 KB 27ms
26ms Stylesheet
text/css 172.66.44.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ramadantoyoz2.pages.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"673dd3b7-5df3"
x-content-type-options: nosniff
cf-ray: 8e6f59092b4836c0-YYZ
expires: Sat, 23 Nov 2024 09:11:53 GMT
date: Sat, 23 Nov 2024 07:11:53 GMT
content-type: text/css
last-modified: Wed, 20 Nov 2024 12:19:03 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
ramadantoyoz2.pages.dev/cdn-cgi/images/ 452 B
635 B 25ms
25ms Image
image/png 172.66.44.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ramadantoyoz2.pages.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "673dd3b7-1c4"
x-content-type-options: nosniff
cf-ray: 8e6f59096b6736c0-YYZ
expires: Sat, 23 Nov 2024 09:11:53 GMT
accept-ranges: bytes
content-length: 452
date: Sat, 23 Nov 2024 07:11:53 GMT
content-type: image/png
last-modified: Wed, 20 Nov 2024 12:19:03 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 favicon.ico
ramadantoyoz2.pages.dev/ 26 KB
7 KB 141ms
140ms Other
text/html 172.66.44.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ramadantoyoz2.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a8b5db07de250ed5d716a53186acb99a480588053940ef47ef5c5a5a1851189

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ojsqpbk27Ql4KiwXV2dd9IYko9EnHkCKTxCpFDRNmQ5Ayioz6RKfMLaTcI4BVrKYkWswZC9Nm8EQS8Zh1M7zJB7hzKuhkPyi9wUQ%2BIyr%2BHkjE%2FBPHg2NgQyIGCij1ezFoqNv3OcZJS98cQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e6f5909ab8c36c0-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=23969&sent=24&recv=19&lost=1&retrans=1&sent_bytes=13208&recv_bytes=5844&delivery_rate=46989&cwnd=8400&unsent_bytes=0&cid=08925c90ae833003&ts=288&x=1", cfHdrFlush;dur=0
date: Sat, 23 Nov 2024 07:11:53 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H3

200

Primary Request / Show response
ramadantoyoz2.pages.dev/
Redirect Chain

https://ramadantoyoz2.pages.dev/cdn-cgi/phish-bypass?atok=UM.oErzUfYXCfIAiWkfAmKAFE4xVXV9XJc7aSbabm_c-1732345913-0.0.1.1-%2F
https://ramadantoyoz2.pages.dev/

26 KB
7 KB

40ms
40ms

Document
text/html

172.66.44.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ramadantoyoz2.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a8b5db07de250ed5d716a53186acb99a480588053940ef47ef5c5a5a1851189

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://ramadantoyoz2.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8e6f5928fcd636c0-YYZ
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 23 Nov 2024 07:11:58 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5daKUlgLackxGCRtbtPYgw%2FNqhwEz9ESrf5bEFYmzXte4uGx6zEMAq5v8tyb00%2BvBQLZiVIBI3afpqzCLODfUhldchIRIACC98uCR35j%2B2ePQmk8OAm6UDZ10pS7WfMap5O827D8B3WeJw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=24053&sent=36&recv=28&lost=1&retrans=1&sent_bytes=20665&recv_bytes=7100&delivery_rate=16523&cwnd=8400&unsent_bytes=0&cid=08925c90ae833003&ts=5201&x=1" cfHdrFlush;dur=0
vary: Accept-Encoding
x-content-type-options: nosniff

Redirect headers

cache-control: private, no-cache
cf-ray: 8e6f5928ccb736c0-YYZ
content-length: 167
content-type: text/html
date: Sat, 23 Nov 2024 07:11:58 GMT
location: https://ramadantoyoz2.pages.dev/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 64ms
32ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cdn-status: 200
content-encoding: br
cf-cache-status: HIT
etag: "269550530cc127b6aa5a35925a7de6ce"
age: 2163400
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Sat, 23 Nov 2024 07:11:58 GMT
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 10/06/2024 01:22:44
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-requesttime: 0
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 925ce50056c053a76028b17f3f524940
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.04
cf-ray: 8e6f592979c0ab45-YYZ
access-control-allow-origin: *
cdn-edgestorageid: 871
server: cloudflare
cdn-requestcountrycode: US

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
602 B 123ms
56ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:wght@500;700&display=swap

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fd0a80fb92bb60cf3c28a03ed20fcc0e9f3a77f470e06fd233b28feba1902c57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 23 Nov 2024 07:11:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:11:59 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 23 Nov 2024 07:00:08 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 droidarabicnaskh.css
fonts.googleapis.com/earlyaccess/ 1 KB
660 B 116ms
49ms Stylesheet
text/css 2607:f8b0:4004:c08::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/earlyaccess/droidarabicnaskh.css

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0facd387627530907acc0b41d7076a1313a748ba84d37983618c04f2e66f1849

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cache-control: private, max-age=86400
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Sat, 23 Nov 2024 07:11:59 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:11:59 GMT
x-xss-protection: 0
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 429 7dsjrMv.png
i.imgur.com/ 0
51 B 99ms
21ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/7dsjrMv.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.997490,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:58 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 O8Lzf4x.png
i.imgur.com/ 0
52 B 96ms
18ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/O8Lzf4x.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.997477,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:58 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 00TAAp6.png
i.imgur.com/ 0
51 B 83ms
21ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/00TAAp6.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.997469,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:58 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 xf7AvB8.png
i.imgur.com/ 0
238 B 79ms
17ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/xf7AvB8.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.997098,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:58 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 200 bnr.php Show response
cdn-server.info/ 744 B
998 B 1079ms
128ms Script
application/javascript 185.66.200.222
SKHOSTING-EU skHo...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-server.info/bnr.php?section=General&pub=533889&format=300x250&ga=g
Requested by: Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.66.200.222 , Slovakia, ASN201702 (SKHOSTING-EU skHosting.eu s.r.o., SK),
Reverse DNS: 185.66.200.222.skhosting.eu
Software: nginx /
Resource Hash: 9a83335a2182ecdc00f41037895e2df0dd5c27ac5acfac39251f11ca26e45b36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

x-robots-tag: noindex, nofollow, noarchive, nosnippet
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Sat, 23 Nov 2024 07:11:59 GMT
date: Sat, 23 Nov 2024 07:11:59 GMT
content-type: application/javascript
last-modified: Sat, 23 Nov 2024 07:11:59 GMT
server: nginx

GET
H2

429

TU3rrWa.png
i.imgur.com/
Redirect Chain

https://bit.ly/3ZGgnEq
https://i.imgur.com/TU3rrWa.png

0
51 B

18ms
17ms

Image
text/plain

199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/TU3rrWa.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.046038,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:59 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

Redirect headers

content-security-policy: referrer always;
cache-control: private, max-age=90
location: https://i.imgur.com/TU3rrWa.png
referrer-policy: unsafe-url
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84
date: Sat, 23 Nov 2024 07:11:59 GMT
content-type: text/html; charset=utf-8
server: nginx

GET
H2

429

gXBAvIR.png
i.imgur.com/
Redirect Chain

https://bit.ly/3ZGgCzk
https://i.imgur.com/gXBAvIR.png

0
51 B

19ms
18ms

Image
text/plain

199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/gXBAvIR.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.046181,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:59 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

Redirect headers

content-security-policy: referrer always;
cache-control: private, max-age=90
location: https://i.imgur.com/gXBAvIR.png
referrer-policy: unsafe-url
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84
date: Sat, 23 Nov 2024 07:11:59 GMT
content-type: text/html; charset=utf-8
server: nginx

GET
H2

429

RQifdbu.png
i.imgur.com/
Redirect Chain

https://bit.ly/3yskiJj
https://i.imgur.com/RQifdbu.png

0
51 B

20ms
20ms

Image
text/plain

199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/RQifdbu.png

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.046218,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:59 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

Redirect headers

content-security-policy: referrer always;
cache-control: private, max-age=90
location: https://i.imgur.com/RQifdbu.png
referrer-policy: unsafe-url
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84
date: Sat, 23 Nov 2024 07:11:59 GMT
content-type: text/html; charset=utf-8
server: nginx

GET
H2 429 kxvv6e2.jpg
i.imgur.com/ 0
51 B 79ms
19ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/kxvv6e2.jpg

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.997434,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:58 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 7pPsqXV.jpg
i.imgur.com/ 0
51 B 82ms
22ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/7pPsqXV.jpg

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.997416,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:58 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 dik62Au.jpg
i.imgur.com/ 0
51 B 22ms
19ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/dik62Au.jpg

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.020450,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:59 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 hDBSzIL.jpg
i.imgur.com/ 0
75 B 21ms
18ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/hDBSzIL.jpg

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1732345919.020426,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Sat, 23 Nov 2024 07:11:59 GMT
x-served-by: cache-yul1970028-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 213 KB
77 KB 153ms
48ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-152330835-1

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b54bcfd98bda018299a2ed4e2dced93aed94b196623cd935f778a1d07537cdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 23 Nov 2024 07:11:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:11:59 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 78455
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 8 KB
8 KB 95ms
33ms Font
font/woff2 64.233.180.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:wght@500;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f94.1e100.net

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ramadantoyoz2.pages.dev
Referer: https://fonts.googleapis.com/

Response headers

age: 149473
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 21 Nov 2025 13:40:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 21 Nov 2024 13:40:46 GMT
last-modified: Fri, 22 Mar 2024 00:00:32 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7816
x-xss-protection: 0
server: sffe

GET
H3 200 DroidNaskh-Bold.woff2
fonts.gstatic.com/ea/droidarabicnaskh/v7/ 40 KB
40 KB 98ms
37ms Font
font/woff2 64.233.180.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/ea/droidarabicnaskh/v7/DroidNaskh-Bold.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/earlyaccess/droidarabicnaskh.css

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f94.1e100.net

Software

sffe /

Resource Hash

0a6b3b2583f0b9ea7da829409bcde3dc1641adb9092100bf2e1415d61cde46d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ramadantoyoz2.pages.dev
Referer: https://fonts.googleapis.com/

Response headers

content-encoding: gzip
age: 152082
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Fri, 21 Nov 2025 12:57:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 21 Nov 2024 12:57:17 GMT
last-modified: Wed, 13 Aug 2014 16:50:04 GMT
content-type: font/woff2
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41271
x-xss-protection: 0
server: sffe

GET
H2 200 bnr_xload.php
cdn-server.info/ Frame 80B5 0
0 477ms
233ms Document
text/html 185.66.200.222
SKHOSTING-EU skHo...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-server.info/bnr_xload.php?section=General&pub=533889&format=300x250&ga=g&xt=173234591944257&xtt=3737541&dateStr=11/22/2024%2023:12:00
Requested by: Host: cdn-server.info
URL: https://cdn-server.info/bnr.php?section=General&pub=533889&format=300x250&ga=g
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.66.200.222 , Slovakia, ASN201702 (SKHOSTING-EU skHosting.eu s.r.o., SK),
Reverse DNS: 185.66.200.222.skhosting.eu
Software: nginx /
Resource Hash

Request headers

Referer: https://ramadantoyoz2.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate post-check=0, pre-check=0
content-type: text/html; charset=UTF-8
date: Sat, 23 Nov 2024 07:12:00 GMT
expires: Sat, 23 Nov 2024 07:12:00 GMT
last-modified: Sat, 23 Nov 2024 07:12:00 GMT
pragma: no-cache
server: nginx
x-robots-tag: noindex, nofollow, noarchive, nosnippet

GET
H2 200 jquery-latest.min.js Show response
code.jquery.com/ 94 KB
33 KB 101ms
17ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-latest.min.js
Requested by: Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://ramadantoyoz2.pages.dev/

Response headers

content-encoding: gzip
etag: W/"28feccc0-1762a"
age: 3347156
x-cache: HIT, HIT
date: Sat, 23 Nov 2024 07:12:00 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 16808, 36359
x-served-by: cache-lga21983-LGA, cache-yul1970029-YUL
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1732345920.115869,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33202
server: nginx

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 76ms
75ms Font
font/woff2 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ramadantoyoz2.pages.dev
Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Response headers

cdn-status: 200
cf-cache-status: MISS
etag: "af7ae505a9eed503f8b8e6982036873e"
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Sat, 23 Nov 2024 07:12:00 GMT
content-type: font/woff2
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
cdn-cachedat: 11/18/2024 16:59:19
cdn-cache: HIT
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-requesttime: 0
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: bf88271e1fd0cc417187b39706db331f
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.06
cf-ray: 8e6f59308eb3ac60-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 77160
cdn-edgestorageid: 1029
server: cloudflare
cdn-requestcountrycode: US

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 334 KB
110 KB 54ms
53ms Script
application/javascript 2607:f8b0:4004:c0b::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2H0WXCQSF6&l=dataLayer&cx=c&gtm=457e4bk0za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-152330835-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

be5acd132beabf5f27b447658d24d0467d3538e47a95624695fdedb6f5d329e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sat, 23 Nov 2024 07:12:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:12:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 112283
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 408ms
33ms Script
text/javascript 2607:f8b0:4004:c1f::64
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-152330835-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

content-encoding: gzip
age: 1984
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sat, 23 Nov 2024 08:38:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 06:38:56 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

POST
H2 204 collect
analytics.google.com/g/ 0
0 281ms
43ms Fetch
text/plain 2001:4860:4802:32::181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-2H0WXCQSF6&gtm=45je4bk0v881533750za200&_p=1732345920153&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&cid=157086895.1732345920&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AAAI&_s=1&sid=1732345920&sct=1&seg=0&dl=https%3A%2F%2Framadantoyoz2.pages.dev%2F&dr=https%3A%2F%2Framadantoyoz2.pages.dev%2F&dt=RAMADAN-TOYO&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1486
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2H0WXCQSF6&l=dataLayer&cx=c&gtm=457e4bk0za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://ramadantoyoz2.pages.dev
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:12:00 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
559 B 278ms
41ms Ping
text/plain 2607:f8b0:4004:c17::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-2H0WXCQSF6&cid=157086895.1732345920&gtm=45je4bk0v881533750za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2H0WXCQSF6&l=dataLayer&cx=c&gtm=457e4bk0za200
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://ramadantoyoz2.pages.dev
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:12:00 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 6902 0
0 118ms
49ms Document
text/html 2607:f8b0:4004:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-2H0WXCQSF6&gacid=157086895.1732345920&gtm=45je4bk0v881533750za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&z=670227207

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2H0WXCQSF6&l=dataLayer&cx=c&gtm=457e4bk0za200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ramadantoyoz2.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 23 Nov 2024 07:12:00 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 274ms
43ms Image
image/gif 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-2H0WXCQSF6&cid=157086895.1732345920&gtm=45je4bk0v881533750za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102077855~102081485&tag_exp=101925629~102067555~102067808~102077855~102081485&z=758312806

Requested by

Host: ramadantoyoz2.pages.dev
URL: https://ramadantoyoz2.pages.dev/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 23 Nov 2024 07:12:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
424 B 41ms
41ms XHR
text/plain 2607:f8b0:4004:c1f::64
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1844231995&t=pageview&_s=1&dl=https%3A%2F%2Framadantoyoz2.pages.dev%2F&ul=en-ca&de=UTF-8&dt=RAMADAN-TOYO&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1978870423&gjid=1938515414&cid=157086895.1732345920&tid=UA-152330835-1&_gid=1478039952.1732345921&_r=1&gtm=457e4bk0za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102077855~102081485&jsscut=1&z=1000970043

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://ramadantoyoz2.pages.dev/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 23 Nov 2024 07:12:00 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://ramadantoyoz2.pages.dev
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 1
server: Golfe2

GET
H3 200 favicon.ico
ramadantoyoz2.pages.dev/ 26 KB
7 KB 51ms
51ms Other
text/html 172.66.44.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ramadantoyoz2.pages.dev/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.207 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a8b5db07de250ed5d716a53186acb99a480588053940ef47ef5c5a5a1851189

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ramadantoyoz2.pages.dev/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kI8PmzTbQMVhX10aY8GwPkE2J8E610NeBzJziN8JoDPcZFnDvx85UERWquDoehvBSDemUobD4goAMsTjOCleDWdkJvla9CbIkWcnZy4Smb%2BzR9VsG%2BsAB7%2FCDwX84JX6jg5TYxVp2P%2FZfw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8e6f593aee5c36c0-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=31626&sent=45&recv=35&lost=1&retrans=1&sent_bytes=27642&recv_bytes=7889&delivery_rate=105013&cwnd=8400&unsent_bytes=0&cid=08925c90ae833003&ts=8083&x=1", cfHdrFlush;dur=0
date: Sat, 23 Nov 2024 07:12:01 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

11 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
vmghh.space/148bcf03fc/bb6bac9292	1970-01-21 01:13:44	Name: total_impressions Value: 1
.ramadantoyoz2.pages.dev/	1970-01-21 01:13:52	Name: __cf_mw_byp Value: UM.oErzUfYXCfIAiWkfAmKAFE4xVXV9XJc7aSbabm_c-1732345913-0.0.1.1-/
.ramadantoyoz2.pages.dev/	1970-01-21 10:48:25	Name: _ga_2H0WXCQSF6 Value: GS1.1.1732345920.1.0.1732345920.60.0.0
.cdn-server.info/	1970-01-21 01:13:44	Name: used_ad2937745 Value: 1
.cdn-server.info/	1970-01-21 01:13:44	Name: total_impressions Value: 1
.cdn-server.info/	1970-01-21 01:55:37	Name: cpa_673873 Value: 300x250_873243532_0
.ramadantoyoz2.pages.dev/	1970-01-21 10:48:25	Name: _ga Value: GA1.3.157086895.1732345920
.ramadantoyoz2.pages.dev/	1970-01-21 01:13:52	Name: _gid Value: GA1.3.1478039952.1732345921
.ramadantoyoz2.pages.dev/	1970-01-21 01:12:25	Name: _gat_gtag_UA_152330835_1 Value: 1
.doubleclick.net/	1970-01-21 01:12:26	Name: test_cookie Value: CheckForPermission
vmghh.space/	1970-01-21 01:13:44	Name: used_ad2937745 Value: 1

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ramadantoyoz2.pages.dev/ Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://i.imgur.com/xf7AvB8.png Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/O8Lzf4x.png Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/kxvv6e2.jpg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/7dsjrMv.png Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/00TAAp6.png Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/7pPsqXV.jpg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/hDBSzIL.jpg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/dik62Au.jpg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/TU3rrWa.png Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/gXBAvIR.png Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/RQifdbu.png Message: Failed to load resource: the server responded with a status of 429 ()
javascript	warning	URL: https://ramadantoyoz2.pages.dev/(Line 400) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-latest.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://ramadantoyoz2.pages.dev/(Line 400) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-latest.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.google.com
bit.ly
cdn-server.info
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
i.imgur.com
maxcdn.bootstrapcdn.com
ramadantoyoz2.pages.dev
stats.g.doubleclick.net
td.doubleclick.net
www.google-analytics.com
www.google.ca
www.googletagmanager.com
104.18.11.207
142.251.16.94
172.66.44.207
185.66.200.222
199.232.192.193
2001:4860:4802:32::181
2607:f8b0:4004:c08::5f
2607:f8b0:4004:c08::9a
2607:f8b0:4004:c0b::61
2607:f8b0:4004:c17::9c
2607:f8b0:4004:c1f::64
2a04:4e42::649
64.233.180.94
67.199.248.11
0a6b3b2583f0b9ea7da829409bcde3dc1641adb9092100bf2e1415d61cde46d6
0facd387627530907acc0b41d7076a1313a748ba84d37983618c04f2e66f1849
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5a8b5db07de250ed5d716a53186acb99a480588053940ef47ef5c5a5a1851189
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8679ff0608f1b713ecd33d395679a63e37922ad0edcd92b1d5ab2c7c4491be2b
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
9a83335a2182ecdc00f41037895e2df0dd5c27ac5acfac39251f11ca26e45b36
b54bcfd98bda018299a2ed4e2dced93aed94b196623cd935f778a1d07537cdb0
be5acd132beabf5f27b447658d24d0467d3538e47a95624695fdedb6f5d329e0
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
fd0a80fb92bb60cf3c28a03ed20fcc0e9f3a77f470e06fd233b28feba1902c57

ramadantoyoz2.pages.dev Open in urlscan Pro 172.66.44.207 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

34 Requests

91 %HTTPS

50 %IPv6

13 Domains

14 Subdomains

13 IPs

3 Countries

403 kBTransfer

956 kBSize

11 Cookies

0 Outgoing links

Page URL History

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ramadantoyoz2.pages.dev Open in urlscan Pro
172.66.44.207 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

91 %
HTTPS

50 %
IPv6

13
Domains

14
Subdomains

13
IPs

3
Countries

403 kB
Transfer

956 kB
Size

11
Cookies

34 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!