www.bagborroworsteal.com Open in urlscan Pro
162.242.193.45 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_16&ems_l=8697087&i=1&d=NDIzMDExNDgw%7CWlRXRFo1Tko0OA%3D%3...
Effective URL:
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Submission: On July 06 via api (July 6th 2021, 12:33:43 pm UTC) from US

Summary HTTP 51 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 20 IPs in 6 countries across 15 domains to perform 51 HTTP transactions. The main IP is 162.242.193.45, located in United States and belongs to RACKSPACE, US. The main domain is www.bagborroworsteal.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on May 26th 2020. Valid for: 2 years.

This is the only time www.bagborroworsteal.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	217.175.192.21 217.175.192.21	1764 (NEXTLAYER-AS) (NEXTLAYER-AS)
2 4	162.242.193.45 162.242.193.45	27357 (RACKSPACE) (RACKSPACE)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
10	93.184.220.20 93.184.220.20	15133 (EDGECAST) (EDGECAST)
1	13.224.193.85 13.224.193.85	16509 (AMAZON-02) (AMAZON-02)
2	2a0b:4d07:101::1 2a0b:4d07:101::1	44239 (PROINITY ...) (PROINITY PROINITY)
2	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9d	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
10	185.32.241.65 185.32.241.65	30286 (THM) (THM)
1	2600:9000:20e... 2600:9000:20eb:2c00:0:43cc:80:93a1	16509 (AMAZON-02) (AMAZON-02)
5	13.225.87.112 13.225.87.112	16509 (AMAZON-02) (AMAZON-02)
1	52.202.92.254 52.202.92.254	14618 (AMAZON-AES) (AMAZON-AES)
1 3	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM)
51	20

1 217.175.192.21 (Austria)

ASN1764 (NEXTLAYER-AS, AT)

visit.bagborroworsteal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 162.242.193.45 (United States) 2 redirects

ASN27357 (RACKSPACE, US)

www.bagborroworsteal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 93.184.220.20 (London, United Kingdom)

ASN15133 (EDGECAST, US)

secure.avelleassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.193.85 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-193-85.fra2.r.cloudfront.net

cdn-scripts.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a0b:4d07:101::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

seal-alaskaoregonwesternwashington.bbb.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 185.32.241.65 (United States)

ASN30286 (THM, US)

imgs.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:2c00:0:43cc:80:93a1 (United States)

ASN16509 (AMAZON-02, US)

iprecon.iglobalstores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.225.87.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-112.fra2.r.cloudfront.net

d1vyngmisxigjx.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.202.92.254 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-92-254.compute-1.amazonaws.com

checkout.iglobalstores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (United States)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (United States)

ASN30286 (THM, US)

w2txo5aapmdfyskhvkjljdcrhrixyo4vjbbclw5s2cc3d1942a77ba4bam1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	signifyd.com cdn-scripts.signifyd.com imgs.signifyd.com	81 KB
10	avelleassets.com secure.avelleassets.com	128 KB
5	cloudfront.net d1vyngmisxigjx.cloudfront.net	16 KB
5	bagborroworsteal.com 2 redirects visit.bagborroworsteal.com www.bagborroworsteal.com	34 KB
3	online-metrix.net h.online-metrix.net w2txo5aapmdfyskhvkjljdcrhrixyo4vjbbclw5s2cc3d1942a77ba4bam1.e.aa.online-metrix.net	15 KB
3	google.de www.google.de	740 B
3	google.com 1 redirects www.google.com	700 B
3	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	2 KB
2	iglobalstores.com iprecon.iglobalstores.com checkout.iglobalstores.com	12 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	googleadservices.com www.googleadservices.com	19 KB
2	bbb.org seal-alaskaoregonwesternwashington.bbb.org	3 KB
1	gstatic.com fonts.gstatic.com	28 KB
1	googleapis.com fonts.googleapis.com	981 B
0	Failed function sub() { [native code] }. Failed
51	15

	Domain	Requested by
10	imgs.signifyd.com	cdn-scripts.signifyd.com imgs.signifyd.com www.bagborroworsteal.com
10	secure.avelleassets.com	www.bagborroworsteal.com
5	d1vyngmisxigjx.cloudfront.net	www.bagborroworsteal.com
4	www.bagborroworsteal.com	2 redirects www.bagborroworsteal.com
3	www.google.de	www.bagborroworsteal.com
3	www.google.com	1 redirects www.bagborroworsteal.com
2	h.online-metrix.net	imgs.signifyd.com
2	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
2	www.google-analytics.com	www.bagborroworsteal.com www.google-analytics.com
2	www.googleadservices.com	www.bagborroworsteal.com www.googleadservices.com
2	seal-alaskaoregonwesternwashington.bbb.org	www.bagborroworsteal.com
1	w2txo5aapmdfyskhvkjljdcrhrixyo4vjbbclw5s2cc3d1942a77ba4bam1.e.aa.online-metrix.net
1	checkout.iglobalstores.com	www.bagborroworsteal.com
1	iprecon.iglobalstores.com	secure.avelleassets.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	fonts.gstatic.com	fonts.googleapis.com
1	cdn-scripts.signifyd.com	www.bagborroworsteal.com
1	fonts.googleapis.com	www.bagborroworsteal.com
1	visit.bagborroworsteal.com
0	ghbmnnjooekpmoecnnnilnnbdlolhkhi Failed	imgs.signifyd.com
51	20

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.pinterest.com
instagram.com
www.bbb.org

Subject Issuer	Validity	Valid
visit.bagborroworsteal.com R3	`2021-05-12` - `2021-08-10`	3 months	crt.sh
bagborroworsteal.com Go Daddy Secure Certificate Authority - G2	`2020-05-26` - `2022-07-25`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
gp1.wac.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-03-10` - `2022-04-06`	a year	crt.sh
cdn-scripts.signifyd.com Amazon	`2020-09-30` - `2021-10-30`	a year	crt.sh
*.bbb.org GeoTrust RSA CA 2018	`2020-05-15` - `2022-07-03`	2 years	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
imgs.signifyd.com Go Daddy Secure Certificate Authority - G2	`2021-04-02` - `2022-05-04`	a year	crt.sh
*.iglobalstores.com Amazon	`2020-10-05` - `2021-11-05`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2021-01-21` - `2022-01-21`	a year	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh

This page contains 6 frames:

Primary Page: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Frame ID: FA5D2D040C52EF7C62D03200F8F01B25
Requests: 37 HTTP requests in this frame

Frame: https://www.bagborroworsteal.com/blank_for_iframe.html
Frame ID: 0FF4C9BD2E07E40152FCBD5826530C28
Requests: 1 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/check.js;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&jb=333f24266a716f7535446b6e77702668736d354c616675702e6873623f4360726f6d672732383a39
Frame ID: 1D2AE30B9D7A8642325C28E6703A20F5
Requests: 9 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/ls_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b
Frame ID: F1F2748BE39EDE7F4165DC83DA106622
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b
Frame ID: 2B67437563681484382FB670C4FA0E37
Requests: 2 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/top_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b
Frame ID: 3F7BBA7B24630C300EA3A8965F91B62D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_16&ems_l=8697087&i=1&d=NDIzMDExNDgw%7... Page URL
https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011480&sc_uid=ZTWDZ5NJ48&sc_l... HTTP 302
https://www.bagborroworsteal.com/failedPermission HTTP 302
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination= Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

51
Requests

96 %
HTTPS

47 %
IPv6

15
Domains

20
Subdomains

20
IPs

6
Countries

359 kB
Transfer

1005 kB
Size

10
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://www.facebook.com/bagborroworsteal

Search URL Search Domain Scan URL

URL: http://twitter.com/bagborrowsteal

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/bagborroworsteal/
Title:

Search URL Search Domain Scan URL

URL: http://instagram.com/bagborroworsteal
Title:

Search URL Search Domain Scan URL

URL: http://www.bbb.org/western-washington/business-reviews/handbags/bag-borrow-or-steal-in-seattle-wa-22027217#bbbseal

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_16&ems_l=8697087&i=1&d=NDIzMDExNDgw%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_26e911b40704049bbf7cffd0f3c11b73c18148b110828dca87854bcfb9b400fe Page URL
https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011480&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438 HTTP 302
https://www.bagborroworsteal.com/failedPermission HTTP 302
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070221345/?random=435276161&cv=9&fst=1625574805534&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=lU3kYMHlI8_W7_UPh8WTiAg&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1070221345/?random=435276161&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=1250032054&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/1070221345/?random=435276161&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=1250032054&resp=GooglemKTybQhCsO&ipr=y

51 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK nrd.php Show response
visit.bagborroworsteal.com/u/ 847 B
809 B 313ms
199ms Document
text/html 217.175.192.21
NEXTLAYER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_16&ems_l=8697087&i=1&d=NDIzMDExNDgw%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_26e911b40704049bbf7cffd0f3c11b73c18148b110828dca87854bcfb9b400fe

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

217.175.192.21 , Austria, ASN1764 (NEXTLAYER-AS, AT),

Reverse DNS

Software

Apache /

Resource Hash

9d250fd718797185c54d5893c46d797b4fa71430617eeab61715d9ee26bf9878

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: visit.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:23 GMT
server: Apache
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
content-encoding: gzip
x-af: suite16-web2
cache-control: max-age=0, no-cache, no-store, must-revalidate
pragma: no-cache
content-length: 431
content-type: text/html; charset=utf-8
x-hf: suite-haproxy01f

GET
H/1.1

200
OK

Primary Request signinInput Show response
www.bagborroworsteal.com/
Redirect Chain

https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011480&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2...
https://www.bagborroworsteal.com/failedPermission
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

31 KB
32 KB

197ms
197ms

Document
text/html

162.242.193.45
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.242.193.45 , United States, ASN27357 (RACKSPACE, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

ae5b89fadfdefe5d7b59ea3b130291883ef1f18d9cb91d2d27d84de96fec8813

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://visit.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: JSESSIONID=2B6C14CE657F4976B8BF4BA6514235FD.workerA; UBID=""; SESSION=18fe574a-921c-4fd7-a990-8214318aa0b2; adTrackId=null; destination="/sell/configInfo?sc_src=email_7092609&sc_lid=423011480&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_16&ems_l=8697087&i=1&d=NDIzMDExNDgw%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_26e911b40704049bbf7cffd0f3c11b73c18148b110828dca87854bcfb9b400fe

Response headers

Date: Tue, 06 Jul 2021 12:33:24 GMT
Server: Apache-Coyote/1.1
X-Frame-Options: SAMEORIGIN
Content-Type: text/html;charset=UTF-8
Keep-Alive: timeout=5, max=498
Connection: Keep-Alive
Transfer-Encoding: chunked

Redirect headers

Date: Tue, 06 Jul 2021 12:33:24 GMT
Server: Apache-Coyote/1.1
X-Frame-Options: SAMEORIGIN
Location: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Content-Length: 0
Keep-Alive: timeout=5, max=499
Connection: Keep-Alive

GET
H2 200 css
fonts.googleapis.com/ 1 KB
981 B 36ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Playfair+Display

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9d83121a5242fd08642d5791a2c7536b9f20291498977184992a6a1db5808f05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 12:11:15 GMT
server: ESF
date: Tue, 06 Jul 2021 12:33:25 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Jul 2021 12:33:25 GMT

GET
H2 200 global.min.css
secure.avelleassets.com/TNT1930/css/ 29 KB
7 KB 137ms
58ms Stylesheet
text/css 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/css/global.min.css

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67C0) /

Resource Hash

87755777f5ef22d9f1963138aec8eff9577c8d6c4dacfbc208ff4842194999fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 04 May 2020 16:34:51 GMT
server: ECS (frb/67C0)
age: 594461
etag: "73cc-5a4d51c2920c0+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
content-length: 6894

GET
H2 200 concat_global.min.js Show response
secure.avelleassets.com/TNT1930/js_prod/ 118 KB
39 KB 108ms
29ms Script
text/javascript 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/js_prod/concat_global.min.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6727) /

Resource Hash

df095f2eeccde5bd77d3d845d3c1a077d9f72f2c757d7a77bd2ef540af9c234f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 10 Mar 2016 19:20:10 GMT
server: ECS (frb/6727)
age: 455110
etag: "1d940-52db6b3f48e80+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/javascript
content-length: 39856

GET
H2 200 ig_welcome_mat_bagborrowsteal.css
secure.avelleassets.com/TNT1930/css/ 4 KB
2 KB 136ms
57ms Stylesheet
text/css 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/css/ig_welcome_mat_bagborrowsteal.css

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D3) /

Resource Hash

01708dc7992dc288a868c11571d919e7d474d4936cac11735c2f7d363f3d2d6f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 03 Jun 2019 21:43:27 GMT
server: ECS (frb/67D3)
age: 104564
etag: "f14-58a72411eddc0+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
content-length: 1456

GET
H2 200 ig_welcome_mat_bagborrowsteal.js Show response
secure.avelleassets.com/TNT1930/js_dev/ 30 KB
10 KB 104ms
26ms Script
text/javascript 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/js_dev/ig_welcome_mat_bagborrowsteal.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/668A) /

Resource Hash

63302d1db7161aa5add476568458cccf5d85ed30a615b8a29df686deb5d42245

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 01 Aug 2019 20:27:21 GMT
server: ECS (frb/668A)
age: 455102
etag: "7790-58f14119a5c40+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/javascript
content-length: 9951

GET
H2 200 script-tag.js Show response
cdn-scripts.signifyd.com/api/ 7 KB
7 KB 100ms
39ms Script
application/javascript 13.224.193.85
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/script-tag.js
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.193.85 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-193-85.fra2.r.cloudfront.net
Software: /
Resource Hash: e17857cb74ff8bb8c18929844a2d0ff42bd36dee42113f85a8831ad42ef6eb79

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:26:44 GMT
via: 1.1 d8328954e51c0912a8419c1a67cea1dc.cloudfront.net (CloudFront)
age: 401
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-cf-pop: FRA2-C1
content-length: 7199
x-amz-cf-id: qFlEjVnD4FUsyWAdpyhbI1a3csdGkdax8bmvmDcPbDnYVD7yvDn0ew==

GET
H2 200 spacer.gif
secure.avelleassets.com/images/ 43 B
135 B 29ms
28ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/spacer.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/673A) /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Wed, 30 Nov 2005 01:15:09 GMT
server: ECS (frb/673A)
age: 507006
etag: "2b-406be1133c140"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 43

GET
H2 200 sign_in_pink.gif
secure.avelleassets.com/images/icons/buttons/ 2 KB
2 KB 373ms
372ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/icons/buttons/sign_in_pink.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache/2.4.41 (IUS) /

Resource Hash

3276b3d1db11c0bf2d0115055682512dc39716d2f1dccf07f529ddae440e3317

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Wed, 07 Aug 2019 21:29:43 GMT
server: Apache/2.4.41 (IUS)
etag: "77d-58f8da3b0ffc0"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1917

GET
H2 200 accessibility.gif
secure.avelleassets.com/images/icons/ 5 KB
6 KB 28ms
28ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/icons/accessibility.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6795) /

Resource Hash

d61f1e577b16aefc5029d0642694c25da422759e1ba766ca6d675dcc47d02ddc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Fri, 10 Jan 2020 23:14:59 GMT
server: ECS (frb/6795)
age: 353118
etag: "15bc-59bd14b6602c0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 5564

GET
H2 200 bag-borrow-or-steal-22027217.png
seal-alaskaoregonwesternwashington.bbb.org/logo/rbvtbas/ 2 KB
2 KB 22ms
6ms Image
image/png 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://seal-alaskaoregonwesternwashington.bbb.org/logo/rbvtbas/bag-borrow-or-steal-22027217.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine / ASP.NET
Resource Hash: cec1bbe9694e8380d5d11e528292f347622be1e2fac7064d2dd987aa8ccda177

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Tue, 06 Jul 2021 06:00:07 GMT
server: keycdn-engine
x-aspnet-version: 4.0.30319
x-edge-location: defr
x-powered-by: ASP.NET
x-cache: STALE
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
x-shield: active
content-length: 2073
expires: Tue, 06 Jul 2021 16:33:25 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 44 KB
17 KB 98ms
39ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

0f506a0bf099d96a1f34c7c23cb74929b8fa381d4114509f9aef2273f2c852b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17349
x-xss-protection: 0
server: cafe
etag: 3780840205288251298
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Jul 2021 12:33:25 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 4060
date: Tue, 06 Jul 2021 11:25:45 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Tue, 06 Jul 2021 13:25:45 GMT

GET
H2 200 global_sprites.png
secure.avelleassets.com/TNT1930/css/sprites/ 62 KB
62 KB 28ms
28ms Image
image/png 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/TNT1930/css/sprites/global_sprites.png

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67E2) /

Resource Hash

1fa823896b863bc6bf90a0e3b122db129a337a98b16364fd72018549e1184600

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Mon, 03 Jun 2019 21:43:27 GMT
server: ECS (frb/67E2)
age: 443083
etag: "f748-58a72411eddc0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/png
accept-ranges: bytes
content-length: 63304

GET
H2 200 search_vert.gif
secure.avelleassets.com/images/navigation/mainnav/ 1 KB
1 KB 28ms
27ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/navigation/mainnav/search_vert.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6762) /

Resource Hash

91ddf1744d48128e8279b661f1c36bcae9eed12b542c420ae8de883a6d2002c9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Fri, 10 Jan 2014 02:00:08 GMT
server: ECS (frb/6762)
age: 337370
etag: "452-4ef9415df5a00"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 1106

GET
H2 200 search_arrow.gif
secure.avelleassets.com/images/navigation/mainnav/ 68 B
174 B 26ms
26ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/navigation/mainnav/search_arrow.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/668C) /

Resource Hash

1319095e503185318684b65d6a8eda0cf1efb19028b35d3f966c154019df9c69

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
last-modified: Wed, 08 Jan 2014 23:28:21 GMT
server: ECS (frb/668C)
age: 337370
etag: "44-4ef7dd9362f40"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 68

GET
H2 200 nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.woff2
fonts.gstatic.com/s/playfairdisplay/v22/ 28 KB
28 KB 27ms
7ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/playfairdisplay/v22/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Playfair+Display

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5348e4d76366efc13f2bcb5a5ce138e581e90d570a09d0ec66a8cab4920be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bagborroworsteal.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 01:54:51 GMT
x-content-type-options: nosniff
age: 38314
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28568
x-xss-protection: 0
last-modified: Thu, 28 Jan 2021 20:30:38 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 01:54:51 GMT

GET
H2 200 bag-borrow-or-steal-22027217.js Show response
seal-alaskaoregonwesternwashington.bbb.org/logo/ 3 KB
980 B 6ms
6ms Script
application/javascript 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://seal-alaskaoregonwesternwashington.bbb.org/logo/bag-borrow-or-steal-22027217.js
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine / ASP.NET
Resource Hash: 716c18fda50474e76ea9e81fd08eb20024fe490ccb77b21b22e513bf8b673d78

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
x-edge-location: defr
x-powered-by: ASP.NET
x-cache: HIT
content-length: 659
last-modified: Tue, 08 Dec 2015 18:58:11 GMT
server: keycdn-engine
etag: "80e33162ea31d11:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
x-shield: active
expires: Tue, 06 Jul 2021 16:33:25 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=159048288&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&dr=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&dp=Sign%20In&ul=en-us&de=UTF-8&dt=Account%20Sign%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=386003914&gjid=1514510984&cid=1405664542.1625574806&tid=UA-238171-1&_gid=1969676606.1625574806&_r=1&_slc=1&z=228937419

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bagborroworsteal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK blank_for_iframe.html Show response
www.bagborroworsteal.com/ Frame 0FF4 293 B
619 B 112ms
111ms Document
text/html 162.242.193.45
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bagborroworsteal.com/blank_for_iframe.html

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.242.193.45 , United States, ASN27357 (RACKSPACE, US),

Reverse DNS

Software

Apache/2.4.41 (IUS) /

Resource Hash

56f9b2160d7519c225d7455901a249f231349ee1ab51ba38377370f098d9f46d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: JSESSIONID=2B6C14CE657F4976B8BF4BA6514235FD.workerA; UBID=""; SESSION=18fe574a-921c-4fd7-a990-8214318aa0b2; adTrackId=null; destination="/sell/configInfo?sc_src=email_7092609&sc_lid=423011480&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"; _ga=GA1.2.1405664542.1625574806; _gid=GA1.2.1969676606.1625574806; _gat=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Response headers

Date: Tue, 06 Jul 2021 12:33:25 GMT
Server: Apache/2.4.41 (IUS)
X-Frame-Options: SAMEORIGIN
Last-Modified: Fri, 30 May 2014 19:30:53 GMT
ETag: "125-4faa3156e3540"
Accept-Ranges: bytes
Content-Length: 293
Keep-Alive: timeout=5, max=497
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
469 B 44ms
15ms XHR
text/plain 2a00:1450:400c:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-238171-1&cid=1405664542.1625574806&jid=386003914&gjid=1514510984&_gid=1969676606.1625574806&_u=IEBAAEAAAAAAAC~&z=1554643235

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 06 Jul 2021 12:33:25 GMT
content-type: text/plain
access-control-allow-origin: https://www.bagborroworsteal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 / Show response
www.googleadservices.com/pagead/conversion/1070221345/ 2 KB
1 KB 68ms
34ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1070221345/?random=1625574805534&cv=9&fst=1625574805534&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

fc34738a2f7044db5f4e088285efc7699c73fd4cc1e81a211f5f45a04b111843

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1181
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/972814219/ 2 KB
2 KB 42ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/972814219/?random=1625574805538&cv=9&fst=1625574805534&num=2&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18fdb4cc9d6d2c0a9f3aaa7f4c476e5eec2b9e529f2a04c94a96003f19e2bfb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1096
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK tags.js Show response
imgs.signifyd.com/fp/ 80 KB
11 KB 73ms
22ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/tags.js?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&pageid=2

Requested by

Host: cdn-scripts.signifyd.com
URL: https://cdn-scripts.signifyd.com/api/script-tag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

396c4ffaaab8afb9b120408a548343f8f3fd50ae6c2535e8c265ede5494421c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:25 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iGlobalIp.js Show response
iprecon.iglobalstores.com/ 18 B
438 B 56ms
9ms Script
text/javascript 2600:9000:20eb:2c00:0:43cc:80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://iprecon.iglobalstores.com/iGlobalIp.js?p=igcCallback&_1625574805543=
Requested by: Host: secure.avelleassets.com
URL: https://secure.avelleassets.com/TNT1930/js_dev/ig_welcome_mat_bagborrowsteal.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:2c00:0:43cc:80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4406332ec7167767030f8f3f0561af1bc97ce03b13b86370736f1654e742c09b

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:20:44 GMT
via: 1.1 1d67a4c00b06651cb6daa95ec3f21f9b.cloudfront.net (CloudFront)
age: 761
x-amzn-requestid: 7f3c9ac3-0434-458c-bbcb-8f07879500b6
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=1800
x-amzn-trace-id: Root=1-60e44a9c-70bcb4216518ca05735f3c5f;Sampled=0
x-amz-cf-pop: FRA2-C1
access-control-allow-credentials: true
x-amz-apigw-id: CDCYcEodIAMFyfw=
content-length: 18
x-amz-cf-id: tZlhnrf-bN4fWvvtctZLYWBfupoYax4_zm-cgz3AsT4oMIaXee6lUw==

GET
H/1.1 200
OK close-square.png
d1vyngmisxigjx.cloudfront.net/images/ 1 KB
2 KB 95ms
31ms Image
image/png 13.225.87.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/close-square.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-112.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: c4a749be78ebdf7a12353556c362cd7a5b63fdfdb0b65306e8968576ed1ffe87

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 11:07:46 GMT
Via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:47 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 5139
ETag: "554-59d396f2cb8e5"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Length: 1364
X-Amz-Cf-Id: ADwOiXt0CE9ZrKECKNrGiShOQMmES6gtIYzxadhxqcC93eGxSv8mVw==

GET
H/1.1 200
OK bagborroworsteel.png
checkout.iglobalstores.com/images/ 11 KB
12 KB 444ms
109ms Image
image/png 52.202.92.254
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://checkout.iglobalstores.com/images/bagborroworsteel.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.92.254 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-92-254.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 65dafcdaae3b766bb4cf47d6ff72f49eeda9af3363a7efae97d48ef76cc22d01

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:33:25 GMT
Last-Modified: Tue, 28 Jan 2020 20:54:08 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "2d3b-59d396cd56bb4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11579

GET US.png
d1vyngmisxigjx.cloudfront.net/images/flags/96x64/ 0
0

GET
H/1.1 200
OK payment-methods-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 4 KB
4 KB 96ms
31ms Image
image/png 13.225.87.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/payment-methods-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-112.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: de6198ebfb4c6f439366c804fa711983cfcbb0c694432d2e5fb1f8e541ecd804

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 05:29:12 GMT
Via: 1.1 e5b93012e2bfb81dc9846f43efd610a6.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:46 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 25453
ETag: "fc4-59d396f228788"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Length: 4036
X-Amz-Cf-Id: Bcr8sG99lpMZ86BhtS9OmSrc-0TDQvuaY865GfeCMMhcEugnXsgnaA==

GET
H/1.1 200
OK prepay-duty-tax-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 2 KB
3 KB 98ms
30ms Image
image/png 13.225.87.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/prepay-duty-tax-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-112.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 7446767437b0174b01820e3eb0d2202fa8e67f1753296ab5c97c21bc2dd20147

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 07:27:10 GMT
Via: 1.1 90cf045072373c2c671297de3161846f.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:50 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 18375
ETag: "9a5-59d396f5e57f7"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Length: 2469
X-Amz-Cf-Id: UirGY5tf593HyMlvMOfIMliAiWzgk4QHL_yHcdp2MhD7MYHBzbsb6g==

GET
H/1.1 200
OK shipping-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 4 KB
5 KB 115ms
40ms Image
image/png 13.225.87.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/shipping-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-112.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 4389239d90f66985ca942fc833a14f1f2269581a37b804843846954e056f8036

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 07:27:10 GMT
Via: 1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:50 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 18375
ETag: "1133-59d396f5c7398"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Length: 4403
X-Amz-Cf-Id: aJ0N5oZIn1QbmL39usgftFcMafCwMrZux81EkjoukBG2En2o6yareA==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
522 B 40ms
17ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-238171-1&cid=1405664542.1625574806&jid=386003914&_u=IEBAAEAAAAAAAC~&z=1581645745

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
522 B 41ms
18ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-238171-1&cid=1405664542.1625574806&jid=386003914&_u=IEBAAEAAAAAAAC~&z=1581645745

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/972814219/ 42 B
154 B 26ms
19ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/972814219/?random=1625574805538&cv=9&fst=1625572800000&num=2&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&is_vtc=1&random=3301002961&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/972814219/ 42 B
154 B 19ms
18ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/972814219/?random=1625574805538&cv=9&fst=1625572800000&num=2&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&is_vtc=1&random=3301002961&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK DE.png
d1vyngmisxigjx.cloudfront.net/images/flags/96x64/ 1 KB
2 KB 46ms
29ms Image
image/png 13.225.87.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/flags/96x64/DE.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.87.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-87-112.fra2.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a02b3ffbb8805d295bb9ef2b5676ac97189736203b6779ab848ceb7b9008e67c

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 10:42:02 GMT
Via: 1.1 6c9a2d99a25484f38efa27d58a726b2d.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:48 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 6683
ETag: "592-59d396f3a7481"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C2
Accept-Ranges: bytes
Content-Length: 1426
X-Amz-Cf-Id: t5tnjQ57jPL0c-3OQXQUWw6e2MYXaWxLlM60ebJQEefFjS3ZgnwOFQ==

GET
H3-29

200

/
www.google.de/pagead/1p-user-list/1070221345/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070221345/?random=435276161&cv=9&fst=1625574805534&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTyb...
https://www.google.com/pagead/1p-user-list/1070221345/?random=435276161&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=...
https://www.google.de/pagead/1p-user-list/1070221345/?random=435276161&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1...

42 B
64 B

46ms
31ms

Image
image/gif

2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1070221345/?random=435276161&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=1250032054&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:33:25 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1070221345/?random=435276161&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=1250032054&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK check.js;CIS3SID=CA9771616F3EE761ED15592256D57585 Show response
imgs.signifyd.com/fp/ Frame 1D2A 219 KB
36 KB 28ms
27ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/check.js;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&jb=333f24266a716f7535446b6e77702668736d354c616675702e6873623f4360726f6d672732383a39

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/fp/tags.js?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&pageid=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

3a4cece92f54cf5a94f2e450f75aacde5b0b055c7e92aea67714ac99ecf0c819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: 2cc3d1942a77ba4b
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
imgs.signifyd.com/fp/ Frame 1D2A 81 B
475 B 58ms
19ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
imgs.signifyd.com/fp/ Frame 1D2A 81 B
475 B 58ms
20ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&ck=0&m=1

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
imgs.signifyd.com/fp/ Frame 1D2A 81 B
540 B 62ms
19ms XHR
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/fp/check.js;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&jb=333f24266a716f7535446b6e77702668736d354c616675702e6873623f4360726f6d672732383a39

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, w2txo5aa/2cc3d1942a77ba4b18fe574a-921c-4fd7-a990-8214318aa0b2
Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:33:26 GMT
Last-Modified: Tue, 06 Jul 2021 12:33:26 GMT
Server: Apache
Etag: ba4bb02f61dd4fbd948d588082afa283
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://www.bagborroworsteal.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sun, 05 Jul 2026 12:33:26 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585 Show response
imgs.signifyd.com/fp/ Frame F1F2 82 KB
13 KB 22ms
22ms Document
text/html 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/ls_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

ca108889012ed6d60232b153f05c940f47b35f34a052eae25182fc5342e44abc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: imgs.signifyd.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: thx_guid=35966b78774d469ab918365ab3da3329
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:33:26 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 200
OK sid_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585 Show response
h.online-metrix.net/fp/ Frame 2B67 95 KB
14 KB 74ms
23ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

c816a251b1e7623fc156c9b2ea588b1843f18889ea19a602859985c6003c05f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:33:26 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET page_embed_script.js
ghbmnnjooekpmoecnnnilnnbdlolhkhi/ Frame 1D2A 0
0

GET
H/1.1 200
OK top_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585 Show response
imgs.signifyd.com/fp/ Frame 3F7B 82 KB
12 KB 22ms
22ms Document
text/html 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/top_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

cd5e11e4f82f658aabd8b723d16a8e65ad02cb724cb000ce3163d6878d624c57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: imgs.signifyd.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: thx_guid=35966b78774d469ab918365ab3da3329
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:33:26 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=98
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
imgs.signifyd.com/fp/ Frame 1D2A 0
218 B 21ms
20ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&ja=373b312626613d36382e783d343826643d333e303870313a38322661643d393630307a3332383226737a793d387032266678723f312e393638382c393a32302c333638302c3130323024333630322c313a38322c333e30322c333a303824302438247363663d3a34266c6a3f687c7670732733412d3a4425304e7775772c6a616f6a6f7a7a6d776f70737c65616c2c616f6527324671696766616c496c78757625314e707a67647d6b76496427334c302532347169726725334625323e7a676e76696c56657065496c2d334c2d30366467737c696e61766b6f6627334424647235607674727b253141273a462d3a467e617169742c626967626f70706f7f6d72737665616426616f6f2d3244266a603d313b63693a37653534303d33653435636231616461613938303a32396131366026687b6f354469667d7a266a7162354368726d6f652d3030383b266a7b67773d4e616e77782466686b35313a2e6c646d3f382e747a643f47757a6d70652732464a6d706c6b66266f61766072353c30383b66316330626d6330326734636b373630323832696c3335373c303366663c353030313c3966366563613a3464633b36616e6064373033313b393b36632e703f706e7d6761665f6e646373685c66696c736523726c7d65696e5d7769666c6d7771576d67646b695f786461716d705e66636c7b6521706e7767616c5f61666f626d57636370676263745c6e61647b6529786e75676b6e57717569616974616f655e64616c7b6d23706e7d676b6e5d7b68676b6b7f6974655e646164736521726e756f6b6e5f70656164786e617b6d725c666364736d2970647d65696e5d7664635f706e63796d705e66636c736d29726c776f696c5f666d766964767a5664616c716529706c75656b6e577176675d76696d7f67725c6e616e73672970647d6761665d6a6174615666616c7167266d7a333d6138346e3c3564353e396162313f613b3c633a386732643b316e6637333a36306b6337303761346b2e61636635373336&jb=313d31266c733d4d67726b6c6e692530463726302d3a30205f6b6e646d777b2532304c56253a3231302c30253b4a2732325f696c36362d334a2d3238703434292732384170706e67576d604b697625324e3d31372c3b36273232204b405c4d442d304325303064696b652730304f67636b6d29253a38416870676d6725304e38312630263c3138392c373a253230516366697069253046353b3f2c3334

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:33:26 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
w2txo5aapmdfyskhvkjljdcrhrixyo4vjbbclw5s2cc3d1942a77ba4bam1.e.aa.online-metrix.net/fp/ Frame 1D2A 81 B
438 B 84ms
19ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://w2txo5aapmdfyskhvkjljdcrhrixyo4vjbbclw5s2cc3d1942a77ba4bam1.e.aa.online-metrix.net/fp/clear.png?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=CA9771616F3EE761ED15592256D57585
imgs.signifyd.com/fp/ Frame 1D2A 0
400 B 22ms
21ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear1.png;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&jf=34393626736b645f7a66663d766c725d634059797e69324a7b57463571326e5326736b665f6c6374653f31363a3d37373630303426716164577c79786d3f7765603a6d63647363247361665f6b67793d3b38373931383131303438373a69383e3c3a6365316438323031323430303061383434386b6d3164323b3033303538333c3a3038383636343b30303631333232326d32663436386330303465676d363b37366b356b6b30303a61373335376e3932323266643b3033373037313a696734336e3967366630633b3836693d61333963373b3434326464356b3536333732666b6b37323b3f323a31313a346d69646c6b3665383a61696334653066313b3266616631353d3024736b6c5f7169653533383c34383a30303767393b3436396061343d6463333763306a3d6035636c3564663a3a646c3039316b32363960616c3938646736633b3632343031343b6a6034336d3260653538303a3a303f3861323766313e3539376633333a33646163636639396139346c623262606c653b3a64693861666537376d343535673466693130643735393c6d306666386324736b6e723538

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=6AB7C73059B46398DDD5361AF11EBF70
h.online-metrix.net/fp/ Frame 2B67 0
400 B 22ms
22ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=6AB7C73059B46398DDD5361AF11EBF70?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&jf=34393a26736b645f7a66663d766c725d663743664778663c6f7064373739705526736b665f6c6374653f31363a3d37373630303426716164577c79786d3f7765603a6d63647363247361665f6b67793d3b38373931383131303438373a69383e3c3a6365316438323031323430303061383434386b6d3164323b3033303538333c3a30383836306367313b613963343a646d6635646633376b3b3b30376e633530326b646c3c393a3033646430316e6162373136386a3b38306430646d3d3231376e6664636169336b38316c3e31616560383a363334603b33396430383030393131603932693736646130303d6b613c393238633a373c3831393a3b3131373162666263313e24736b6c5f7169653533383c36383a30313032643e633432603a663a363136363037313f3061613b636134673a376e31626d3c3162383a383f303361313561306739653537643e6a36613338656737603b326b38323a393230623539696165343063393e313732313562396e3031603a6566373139376c6c633c3a306538353231353235333b353e3365383730666b3c3b63603e6334616730267b61667a3533

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=CA9771616F3EE761ED15592256D57585?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
imgs.signifyd.com/fp/ Frame 1D2A 0
387 B 20ms
19ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=18fe574a-921c-4fd7-a990-8214318aa0b2&nonce=2cc3d1942a77ba4b&jac=1&je=313f3626267565627a7c615f67707467726c696c576170353937392e36382635352e3a3a267f6b6d3d7565627a7c615f6b667467726c696c576564667b24706d3f6e672662617671743579226c677665642a38312c38302e22717c617c7d732a3220636863726f696e67207f26697764683f63656e6a6365363f383437356e303a6e626a6c3b373334313f363932666064316136343730626e3d3434333e363b65606d66393d393d6960373437613a313137

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:33:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: d1vyngmisxigjx.cloudfront.net
URL: https://d1vyngmisxigjx.cloudfront.net/images/flags/96x64/US.png

Domain: ghbmnnjooekpmoecnnnilnnbdlolhkhi
URL: chrome-extension://ghbmnnjooekpmoecnnnilnnbdlolhkhi/page_embed_script.js

Verdicts & Comments Add Verdict or Comment

171 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.bagborroworsteal.com/	1970-01-19 19:42:59	Name: igSplash Value: igSplash
.www.bagborroworsteal.com/	1970-01-20 04:18:30	Name: igCountry Value: DE
.bagborroworsteal.com/	1970-01-19 19:34:21	Name: _gid Value: GA1.2.1969676606.1625574806
.bagborroworsteal.com/	1970-01-20 13:04:06	Name: _ga Value: GA1.2.1405664542.1625574806
www.bagborroworsteal.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 2B6C14CE657F4976B8BF4BA6514235FD.workerA
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: destination Value: "/sell/configInfo?sc_src=email_7092609&sc_lid=423011480&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: adTrackId Value: null
.bagborroworsteal.com/	1970-01-30 18:20:54	Name: UBID Value: ""
.bagborroworsteal.com/	1970-01-19 19:32:54	Name: _gat Value: 1
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: SESSION Value: 18fe574a-921c-4fd7-a990-8214318aa0b2

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-scripts.signifyd.com
checkout.iglobalstores.com
d1vyngmisxigjx.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
ghbmnnjooekpmoecnnnilnnbdlolhkhi
googleads.g.doubleclick.net
h.online-metrix.net
imgs.signifyd.com
iprecon.iglobalstores.com
seal-alaskaoregonwesternwashington.bbb.org
secure.avelleassets.com
stats.g.doubleclick.net
visit.bagborroworsteal.com
w2txo5aapmdfyskhvkjljdcrhrixyo4vjbbclw5s2cc3d1942a77ba4bam1.e.aa.online-metrix.net
www.bagborroworsteal.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
d1vyngmisxigjx.cloudfront.net
ghbmnnjooekpmoecnnnilnnbdlolhkhi
13.224.193.85
13.225.87.112
142.250.186.130
162.242.193.45
185.32.241.65
217.175.192.21
2600:9000:20eb:2c00:0:43cc:80:93a1
2a00:1450:4001:808::2004
2a00:1450:4001:808::200e
2a00:1450:4001:811::2002
2a00:1450:4001:82a::2003
2a00:1450:4001:82f::200a
2a00:1450:4001:831::2003
2a00:1450:400c:c08::9d
2a0b:4d07:101::1
52.202.92.254
91.235.132.130
91.235.134.131
93.184.220.20
01708dc7992dc288a868c11571d919e7d474d4936cac11735c2f7d363f3d2d6f
0f506a0bf099d96a1f34c7c23cb74929b8fa381d4114509f9aef2273f2c852b3
1319095e503185318684b65d6a8eda0cf1efb19028b35d3f966c154019df9c69
18fdb4cc9d6d2c0a9f3aaa7f4c476e5eec2b9e529f2a04c94a96003f19e2bfb1
1fa823896b863bc6bf90a0e3b122db129a337a98b16364fd72018549e1184600
3276b3d1db11c0bf2d0115055682512dc39716d2f1dccf07f529ddae440e3317
396c4ffaaab8afb9b120408a548343f8f3fd50ae6c2535e8c265ede5494421c9
3a4cece92f54cf5a94f2e450f75aacde5b0b055c7e92aea67714ac99ecf0c819
4389239d90f66985ca942fc833a14f1f2269581a37b804843846954e056f8036
4406332ec7167767030f8f3f0561af1bc97ce03b13b86370736f1654e742c09b
56f9b2160d7519c225d7455901a249f231349ee1ab51ba38377370f098d9f46d
63302d1db7161aa5add476568458cccf5d85ed30a615b8a29df686deb5d42245
65dafcdaae3b766bb4cf47d6ff72f49eeda9af3363a7efae97d48ef76cc22d01
716c18fda50474e76ea9e81fd08eb20024fe490ccb77b21b22e513bf8b673d78
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7446767437b0174b01820e3eb0d2202fa8e67f1753296ab5c97c21bc2dd20147
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87755777f5ef22d9f1963138aec8eff9577c8d6c4dacfbc208ff4842194999fa
91ddf1744d48128e8279b661f1c36bcae9eed12b542c420ae8de883a6d2002c9
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
9c5348e4d76366efc13f2bcb5a5ce138e581e90d570a09d0ec66a8cab4920be6
9d250fd718797185c54d5893c46d797b4fa71430617eeab61715d9ee26bf9878
9d83121a5242fd08642d5791a2c7536b9f20291498977184992a6a1db5808f05
a02b3ffbb8805d295bb9ef2b5676ac97189736203b6779ab848ceb7b9008e67c
ae5b89fadfdefe5d7b59ea3b130291883ef1f18d9cb91d2d27d84de96fec8813
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c4a749be78ebdf7a12353556c362cd7a5b63fdfdb0b65306e8968576ed1ffe87
c816a251b1e7623fc156c9b2ea588b1843f18889ea19a602859985c6003c05f1
ca108889012ed6d60232b153f05c940f47b35f34a052eae25182fc5342e44abc
cd5e11e4f82f658aabd8b723d16a8e65ad02cb724cb000ce3163d6878d624c57
cec1bbe9694e8380d5d11e528292f347622be1e2fac7064d2dd987aa8ccda177
d61f1e577b16aefc5029d0642694c25da422759e1ba766ca6d675dcc47d02ddc
de6198ebfb4c6f439366c804fa711983cfcbb0c694432d2e5fb1f8e541ecd804
df095f2eeccde5bd77d3d845d3c1a077d9f72f2c757d7a77bd2ef540af9c234f
e17857cb74ff8bb8c18929844a2d0ff42bd36dee42113f85a8831ad42ef6eb79
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fc34738a2f7044db5f4e088285efc7699c73fd4cc1e81a211f5f45a04b111843

www.bagborroworsteal.com Open in urlscan Pro 162.242.193.45 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

51 Requests

96 %HTTPS

47 %IPv6

15 Domains

20 Subdomains

20 IPs

6 Countries

359 kBTransfer

1005 kBSize

10 Cookies

5 Outgoing links

Page URL History

Redirected requests

51 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bagborroworsteal.com Open in urlscan Pro
162.242.193.45 Public Scan

Screenshot
Live screenshot

Full Image

51
Requests

96 %
HTTPS

47 %
IPv6

15
Domains

20
Subdomains

20
IPs

6
Countries

359 kB
Transfer

1005 kB
Size

10
Cookies

51 HTTP transactions
0 data transactions