reply-move-l-terraa.comercial.ws Open in urlscan Pro
157.173.106.69 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://reply-move-l-terraa.comercial.ws/terra2/adm/
Effective URL:
http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Submission: On September 27 via manual (September 27th 2024, 1:55:06 pm UTC) from BR — Scanned from GB

Summary HTTP 91 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 18 IPs in 5 countries across 11 domains to perform 91 HTTP transactions. The main IP is 157.173.106.69, located in United Kingdom and belongs to CONTABO, DE. The main domain is reply-move-l-terraa.comercial.ws.

This is the only time reply-move-l-terraa.comercial.ws was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 18	157.173.106.69 157.173.106.69	51167 (CONTABO) (CONTABO)
2	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80e::2001	15169 (GOOGLE) (GOOGLE)
1	108.157.4.118 108.157.4.118	16509 (AMAZON-02) (AMAZON-02)
11	2a02:26f0:e30... 2a02:26f0:e300::5f64:9233	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c00::9c	15169 (GOOGLE) (GOOGLE)
1	142.250.184.195 142.250.184.195	15169 (GOOGLE) (GOOGLE)
3	35.201.123.184 35.201.123.184	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:26f0:e30... 2a02:26f0:e300::5f64:924a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
34	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
4	142.250.186.65 142.250.186.65	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
1	108.157.4.38 108.157.4.38	16509 (AMAZON-02) (AMAZON-02)
5	34.102.185.99 34.102.185.99	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
91	18

18 157.173.106.69 (United Kingdom) 1 redirects

ASN51167 (CONTABO, DE)
PTR: mail.meuacessonovomail.store

reply-move-l-terraa.comercial.ws	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80e::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-118.dus51.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a02:26f0:e300::5f64:9233 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

s1.trrsf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p1.trrsf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net

www.google.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.123.184 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 184.123.201.35.bc.googleusercontent.com

tags.t.tailtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.tailtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:e300::5f64:924a (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)

s1.trrsf.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 142.250.186.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.65 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.157.4.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-38.dus51.r.cloudfront.net

b.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.102.185.99 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 99.185.102.34.bc.googleusercontent.com

tt-10969-0.seg.t.tailtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.t.tailtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
t.tailtarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 170 pagead2.googlesyndication.com — Cisco Umbrella Rank: 122 4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com	479 KB
18	comercial.ws 1 redirects reply-move-l-terraa.comercial.ws	1 MB
12	trrsf.com s1.trrsf.com — Cisco Umbrella Rank: 251475 p1.trrsf.com — Cisco Umbrella Rank: 267581	85 KB
8	tailtarget.com tags.t.tailtarget.com — Cisco Umbrella Rank: 97125 d.tailtarget.com — Cisco Umbrella Rank: 113826 tt-10969-0.seg.t.tailtarget.com — Cisco Umbrella Rank: 300837 b.t.tailtarget.com — Cisco Umbrella Rank: 75940 t.tailtarget.com — Cisco Umbrella Rank: 29597	48 KB
4	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 152 securepubads.g.doubleclick.net — Cisco Umbrella Rank: 227	182 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 57	181 KB
1	scorecardresearch.com b.scorecardresearch.com — Cisco Umbrella Rank: 7630	331 B
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	600 B
1	google.co.uk www.google.co.uk — Cisco Umbrella Rank: 4792	63 B
1	google.com region1.analytics.google.com — Cisco Umbrella Rank: 4111
1	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 957	6 KB
91	11

	Domain	Requested by
34	pagead2.googlesyndication.com	securepubads.g.doubleclick.net reply-move-l-terraa.comercial.ws pagead2.googlesyndication.com
18	reply-move-l-terraa.comercial.ws	1 redirects reply-move-l-terraa.comercial.ws
7	p1.trrsf.com	reply-move-l-terraa.comercial.ws
7	tpc.googlesyndication.com	reply-move-l-terraa.comercial.ws securepubads.g.doubleclick.net tpc.googlesyndication.com
5	s1.trrsf.com	reply-move-l-terraa.comercial.ws
2	b.t.tailtarget.com	d.tailtarget.com
2	tt-10969-0.seg.t.tailtarget.com	d.tailtarget.com
2	d.tailtarget.com	reply-move-l-terraa.comercial.ws d.tailtarget.com
2	securepubads.g.doubleclick.net	reply-move-l-terraa.comercial.ws securepubads.g.doubleclick.net
2	stats.g.doubleclick.net	www.googletagmanager.com reply-move-l-terraa.comercial.ws
2	www.googletagmanager.com	reply-move-l-terraa.comercial.ws www.googletagmanager.com
1	t.tailtarget.com
1	b.scorecardresearch.com	reply-move-l-terraa.comercial.ws
1	www.google-analytics.com	reply-move-l-terraa.comercial.ws
1	4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	tags.t.tailtarget.com	s1.trrsf.com
1	www.google.co.uk	reply-move-l-terraa.comercial.ws
1	region1.analytics.google.com	www.googletagmanager.com
1	static.hotjar.com	reply-move-l-terraa.comercial.ws
91	19

This site contains links to these domains. Also see Links.

Domain
ad.doubleclick.net
servicos.terra.com.br
central.terra.com.br
duvidas.terra.com.br
s1.trrsf.com

Subject Issuer	Validity	Valid
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
tpc.googlesyndication.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.hotjar.com Amazon RSA 2048 M03	`2024-05-22` - `2025-06-20`	a year	crt.sh
terra.com.br DigiCert TLS RSA SHA256 2020 CA1	`2024-09-20` - `2025-09-20`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.google.co.uk WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.tailtarget.com Sectigo RSA Domain Validation Secure Server CA	`2024-08-02` - `2025-09-01`	a year	crt.sh

This page contains 7 frames:

Primary Page: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Frame ID: E3C92B39F23E4EDB0541E85FD70C4B34
Requests: 57 HTTP requests in this frame

Frame: https://4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: B7F7DD2B15EA0FCF73888337BEA731EA
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvmrh3jw2GEh0LCJvmMt-lVZ6apKlD2grRbINOIHU7HLmN2Gsmwf2MkrrdoD-_jmLWAJ5BUAnG5mThoFJCB1W91cg0pMuUMLWlqLWMQH52ORb8s9vnhpb6oc4OITz-Q1lbH_TKHUup2tyVf3U6otdo0S342Xrf5Q8PByoz2iOnO_aYdnuEDzeNLPnJ5uRB4-XDLEUaCJacxwSWgeIzebdreJlxSDeZzVTjor2SUA5scOlyN5v82vHOXQyiCXDv4z5IzvM_ASVhC8HE9aZq2N5dIf1ebPIz8K7yPfPgZmbrS0qMyoAlVeAgDJ-COEbCGjbJmOJAOYE0P1HnrwRmTGldyj16WO8F93WEMlZR5rTSTIkmfclD8sIzF27ThZQLm-ByPL3lROOxANNTow_36aXoEg7maSlkFUA&sig=Cg0ArKJSzHN5zxFlrrQHEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: F3491BAC6BCB1E966EDA3E15F1970769
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssgk63_KHPY-x_cH7PdjbiO3TnLqYHyZ6ldGPPqjtvsQqEq2p2ojEUR6IQCj84RfhQV3btJaVJTCiWgsClnMWF5qYHpExf3Sz4V31wuyIyY7txqD3o2nSAtuKaYxhRyVddTgPRxBxlj9jbbIHDSWJ2IJz6hZy2Sd9NWwd_tL0BcOW7VCUDRkok85rxYufgh78jhDARAahPsoOmlrYDcQSePKHCI7l5HKqZBOoHw6qhGuMF5AADqXYgWV4LhnJvoV1oPsKpoq3uQ-GNnReVbG9oIWYtZElNSmsBFvabkF3NMMAR2uo7NYNxbIKXvzqEYgpUQk8d7kqvu04b6yqD9NsgYNchMVj-Kzu7U7Eh-zavNWy57sgDDErW2khCIpw8A0MG4ZBm7RyrT1iUfQ295Kgns-J_SZ1V1mg&sig=Cg0ArKJSzNje42b21gPhEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 95C237EFD3E8502BA20B2758F4145FE4
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssskAGmESCnURu1mknvmwd5Nou_72GmUV5AynQ8EvGRjQ-JGkO8PidwZ_srrdb6PB9HdvJLi6EaBe_psdNx42BBO5Pt6HIDXdkBDASwqGgBtAZxPsZy8OFAotiNbDb11K6sDkiW2r22bng4nkSiz3pFGvXqagEj8V_AZQ8VBKBcHLEfTqlcdOIT8EO-HYIOfTp5rpOs_rxdxmPATyKOMfxkwXqyF0vza_1qFF1n06RaDy3slzMZIxAF7k4vKZR0Po1uen5BRaVom13wbIANgDMAtS6iB1btREyc2dcIzNcjmr42ekYSO-FFy9VGw6QQDYWavoxdTYkOrzCNtrvb3B-rOCsHGAT_rfxx0EjujPWfFczMbQsaXqOmeCny4DcI9SxNMv1enVq7_RMkeDxEaTky7TCXhiLaxg&sig=Cg0ArKJSzHpH-vK1ibUyEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: EC357BEC2FF915AA93C7E31BE386E898
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsuPhbsfRd5MeY16QGFUi5e9DBgBlPq44raCy5LvqZsDBXPzXUOY-OnToWMhz60T8Zib8sL8ChUnOW-rU6Jxl7R3dQBGD6K7Pyul1X_apIbIS47rQaG0uYiiaSRYnKlj_JGbSE657XZVrbmo6tXPvm8lZV6YrSHrxSdTENczpYZUCA3_zOiocQ36OSWwTO7YhBe23Nz8TWmb9s37zTnmJU8jCZjgQmRGtNpSEEPIsQEXNHxraOzFyL4z4PsH_8_Pl4uOjlB5BdtpAt_fslHco-xOmfBQcQEEeO9gyah-abkNft77B91QqJVt3Pt9IdSYawsZK9MGFI7o31QnD3sTfN7Btl9J079jVsd71FW4I9bQX1H4NMCSUv8qqvJ0PKrFDNbkEXqqGVv7vwqZgfB5_bB-m76b4DMSmQ&sig=Cg0ArKJSzP7ZrcXcRGATEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 849DA0752562C1509B3F11D05D03F224
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: EB0ACBA938C29DADF9F9AF6660DF79F4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Terra Mail

Page URL History Show full URLs

http://reply-move-l-terraa.comercial.ws/terra2/adm/ HTTP 307
https://reply-move-l-terraa.comercial.ws/terra2/adm/ HTTP 307
http://reply-move-l-terraa.comercial.ws/terra2/adm/ HTTP 302
http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

Page Statistics

91
Requests

73 %
HTTPS

47 %
IPv6

11
Domains

19
Subdomains

18
IPs

5
Countries

2462 kB
Transfer

4776 kB
Size

19
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://ad.doubleclick.net/pcs/click?xai=AKAOjsuk9kiS6aiAYO8QbhhXf92RVfshmYzvxY1mOimtrFsQFrgYroUqQJ-ohbNP8SQrCj78034HJj39Q7Imszkv9k6VpjirSZrT9jXe66m5w35zD7Hk9_gZN0Xan9uEQpqNvfXgc81_ywxL5Bgnj-NxUZ91uJE0IGy41_ndwcdE96nS7z5iW3cvGP63MNfBYOTGZZoySZJ7UT4KNEqJKmjRHPoyVBXawNDUtA7Ev46wI6mLQAYhd_aYKg-A9Rllsn_wnfvtf3oNedgZAIusm2aDxc5rP8ZWav2-Uj1pitHx0bidiYov2JdRmG8KDeZgOvbkguPq8tqMFjm84jx0IraHmg2pLMKgdjLSt3Ec4kQ_FH5OVtHJ6E8QrNO61iyYCJxpYkwSGiqiuHr8-0uB3pZ_GRdsJveKF0njcLrc6RHbqYY5gQyLehIxGZ-UGwV9JKFv2o5UJP-CQr67QYYqgl3tuyPXg0SvQqaNMmsTXwSeHHocgOt4AGrXwLG-b9oawXkxc6UfLsbWYtthxfNyjtG6STDx-GKl-nB3lSZbXs39VTDSvFnwyrz3o9o_bAat-a6lT0zl0T28RvQxFcAi5h-f6ifZRDY3FuIqlUiaJzLyL71MPkBikOW2DyWPBOJomht1R9EKj4IPnhS9UdruNVFQIkGQMT3adLR9ZGx--POK9GSng3TFCdS4RoFNZsfGzLR40tVUtszy9QWbBbTMtnXU89XdicFYanwrNewNUAwSt4tAS97MLNF6HYuItl0npW8MgwH8UNAVcaRz8Kthjz9XCBbGoTbNUlGm29bElqZ44FX6hVaMt9l_i1CKf1rK6BBlm7HRvBzK3aYxU65KZb0T7YJB89VUBWfNn-L1il7unxS-9_yg3ztZoyRunwj7niHc5Woj7IBE--I4u3XlhWg3frQdIMRZLdsCI0JmVVXAW71Za2CvryImtsm2Ta5ZfiCMAlDIUPxVuO3e2Be0igNsknUdEyHVDebCNicenE1XpEoCKm0tGAjKM2W7nyL-zPUgfIMSLZpjTLEbKXz1Yx1UQJ7jnzYljWqH-5MCS9xUYqdefPLQhwvYMiZKskfAMygsDN335WbCcrZNQNpmqXHkhsSpIhdnkSYTXlPjC97u5FvP4m5FcYaGZgKyoBxsqD0cCwBFIy6LlELRUN-0JmkA7CF8tiq9L8auFmtqxa4y3gwB-6RJlDM3qf0z6baDdAXMBtWgfR39NQdsveT6dFkMl1JG2acq3-Fx2mAzPHAu1q4X4Yo4Cm4FiWrGybIxHQ8Odwjpk9gWrZ_RoaI6Lbz5tHySziUI_LKFDMVqwwLLi4hFNDVTQFx2lApTfGiA03sPopulWXKx8qIttWH8KFHGay7MJ82Y6-3ubeRURfABrptgetMwOQyxGmhH23S3nQ3TzBkstBOBPUelLwKYqaP5evDv84vVDaNwLi_EC8HebvgYdT2w-DtNn2THSSKWKN9qZZKyhVI9IkuJLufNL9vjlWUcitXE9HXdWVQESCF1BRoy8tvaS_PGq6wSzvNhLTzsfQcM57vneYfS7QfSB6H5ECQUt7-xSDrTNici_IKpqYx0K5mXtjTeVgaerezmx_SqUxxiAA3-TmWMMqNwxaQwC21j_RNMWmvczhKzfs4SfvXuuWJZLGp_JA8hNsFxrwRaytSePqDuOn2F-VgAPL55afk-paBaCW-g-lmDewKo8LdvZM_Vh8Yv7FRRe2PAkDjJjNr5OxlIf-H9Pdihp6cbV42fDzfNgNY4p2IIC4x5ven-LF3p3aHpN83sEm5BOMczgITqrClrQuft0RMbqsDsz0e7&sai=AMfl-YT_YF81bY6bNIIThC5PkqZIA5jYtbmY8nmAumChUKWnwVIqLPcWkY_C7P6Gx_YU2pI1cup_hgNluo6ILqNnvduDSYbeeuBh3eFJDSdQqkQnrxnLgV1z6DXtIlexnUFV_GwefjojCcb6_nfloyXsU8t-CqnIxXheLxaOTIM-sQ6ORKvk1IzEFflUrXO7fhq_50xbuk7S6WdidCvmrdkqFs66R8LlmKRLU172i2UqFwjMnjcE6RPgQNLlAEP27P01-73rSQZMi7paCyolCnTHvMID1T82p1ity47r6yYBPpX5CimKo-ozPJoiygp1&sig=Cg0ArKJSzCR0xbd6061i&fbs_aeid=%5Bgw_fbsaeid%5D&crd=aHR0cHM6Ly9kaXNuZXlwbHVzLmNvbQ&urlfix=1&nx=391&ny=82&dim=970x250&adurl=https://www.disneyplus.com/%3Fcid%3DDisney-ProgDisplay-DBM-32312872-401416619-593648311-220640339%26dclid%3D%25edclid!

Search URL Search Domain Scan URL

URL: https://servicos.terra.com.br/mail-gigante/
Title: Assine

Search URL Search Domain Scan URL

URL: https://central.terra.com.br/
Title: Central do Assinante

Search URL Search Domain Scan URL

URL: https://duvidas.terra.com.br/produtos/frequente/31/terra-mail/
Title: ajuda

Search URL Search Domain Scan URL

URL: https://s1.trrsf.com/stf-psvo/web/contratos/CXP.htm
Title: Condições de uso

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://reply-move-l-terraa.comercial.ws/terra2/adm/ HTTP 307
https://reply-move-l-terraa.comercial.ws/terra2/adm/ HTTP 307
http://reply-move-l-terraa.comercial.ws/terra2/adm/ HTTP 302
http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

http://www.google-analytics.com/collect?v=1&_v=j41&a=1531430009&t=pageview&_s=1&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&ul=en-gb&de=UTF-8&dt=Terra%20Mail&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SCCAgEABG~&jid=234489052&cid=1354747732.1727445301&tid=UA-54936151-1&cd1=comunidad&cd2=email&cd3=&cd4=comunidades&cd5=300264&cd6=novo&cd7=srv&cd9=terra&cd10=N&cd11=&cd15=br&cd18=&cd19=&cd20=other&cd21=T&cd22=desktop&cd34=&cd35=&cd44=reply-move-l-terraa%3Acomercial%3Aws%3Aterra2%3Aadm&cd8=Direct%20Load&cd12=&cd14=&cd16=&cd17=&cd23=&cd40=&cd41=&cd48=&cd49=false&cd52=default&cd60=10&cd61=100&cd62=4g&cd63=false&cd64=browser&z=2106195977 HTTP 307
https://www.google-analytics.com/collect?v=1&_v=j41&a=1531430009&t=pageview&_s=1&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&ul=en-gb&de=UTF-8&dt=Terra%20Mail&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SCCAgEABG~&jid=234489052&cid=1354747732.1727445301&tid=UA-54936151-1&cd1=comunidad&cd2=email&cd3=&cd4=comunidades&cd5=300264&cd6=novo&cd7=srv&cd9=terra&cd10=N&cd11=&cd15=br&cd18=&cd19=&cd20=other&cd21=T&cd22=desktop&cd34=&cd35=&cd44=reply-move-l-terraa%3Acomercial%3Aws%3Aterra2%3Aadm&cd8=Direct%20Load&cd12=&cd14=&cd16=&cd17=&cd23=&cd40=&cd41=&cd48=&cd49=false&cd52=default&cd60=10&cd61=100&cd62=4g&cd63=false&cd64=browser&z=2106195977

91 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request index.php Show response
reply-move-l-terraa.comercial.ws/terra2/adm/
Redirect Chain

http://reply-move-l-terraa.comercial.ws/terra2/adm/
https://reply-move-l-terraa.comercial.ws/terra2/adm/
http://reply-move-l-terraa.comercial.ws/terra2/adm/
http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

29 KB
29 KB

4573ms
4573ms

Document
text/html

157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 / PHP/7.4.33
Resource Hash: a68a20ead95255e7c07a40da2351f85ee78ca3db1365d1cf21c149f59cf75a10

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 27 Sep 2024 13:54:55 GMT
Keep-Alive: timeout=5, max=99
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33
Transfer-Encoding: chunked
X-Powered-By: PHP/7.4.33

Redirect headers

Connection: Keep-Alive
Content-Length: 4
Content-Type: text/html; charset=UTF-8
Date: Fri, 27 Sep 2024 13:54:50 GMT
Keep-Alive: timeout=5, max=100
Location: index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33
X-Powered-By: PHP/7.4.33

GET
H/1.1 200
OK mod-manager.min.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/ 42 KB
43 KB 132ms
45ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/mod-manager.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 46b9f8d3285f9ea9bea3526220cf5c31bc85d848e3851a650daabe23aaaaea06

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "a984-61fd3e868b280"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 43396
Keep-Alive: timeout=5, max=99
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Fri, 16 Aug 2024 21:47:38 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK zaz.min.css
reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586315/fe/zaz-morph/_css/ 10 KB
10 KB 83ms
44ms Stylesheet
text/css 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586315/fe/zaz-morph/_css/zaz.min.css
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 361aa05152f542b113c0fe41d1213876018d3822cf8be35f3c33c3325c141f13

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "282c-5f307027388c0"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 10284
Keep-Alive: timeout=5, max=100
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Tue, 24 Jan 2023 18:51:55 GMT
Content-Type: text/css
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK ozone.min.css
reply-move-l-terraa.comercial.ws/terra2/adm/update-1722016084/fe/zaz-mod-icons/_css/ 7 KB
7 KB 79ms
41ms Stylesheet
text/css 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1722016084/fe/zaz-mod-icons/_css/ozone.min.css
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 6965cc9d2c66264e6e4b14391c837f870d70df730f4ce5d7d7cc4cb96c588d2b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "1b4c-61e2a1cfbfd00"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 6988
Keep-Alive: timeout=5, max=100
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Fri, 26 Jul 2024 17:48:04 GMT
Content-Type: text/css
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK sizes.min.css
reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586307/fe/zaz-mod-icons/_css/ 665 B
974 B 84ms
45ms Stylesheet
text/css 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586307/fe/zaz-mod-icons/_css/sizes.min.css
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 8d024882fc0a0be1957836a13cd7875b0e15a057ffd5542eca0f569cdb6779b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "299-5f30701f976c0"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 665
Keep-Alive: timeout=5, max=100
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Tue, 24 Jan 2023 18:51:47 GMT
Content-Type: text/css
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK jquery-ui-1.11.4.css
reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751311/fe/zaz-3rd/jquery-ui/ 35 KB
35 KB 81ms
42ms Stylesheet
text/css 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751311/fe/zaz-3rd/jquery-ui/jquery-ui-1.11.4.css
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 8f05c230721feace4a3da1d3ed64ba613af37d718088b7ba7327a5895f8558b6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "8a3f-61fbe2092c1c0"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 35391
Keep-Alive: timeout=5, max=100
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Thu, 15 Aug 2024 19:48:31 GMT
Content-Type: text/css
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK context.min.css
reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586544/fe/zaz-ui-webmail/_css/ 122 KB
123 KB 83ms
44ms Stylesheet
text/css 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586544/fe/zaz-ui-webmail/_css/context.min.css
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: c84e1580d17203d51cf86ae25d38c994b97b318a77726aee15df98ee2a967d93

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "1e8df-5f3071019cc00"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 125151
Keep-Alive: timeout=5, max=100
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Tue, 24 Jan 2023 18:55:44 GMT
Content-Type: text/css
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK a7d050cd624c59e4404eb037369f2662.css
reply-move-l-terraa.comercial.ws/terra2/adm/static_concat/update-1674586302/a/ 2 KB
2 KB 115ms
39ms Stylesheet
text/css 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/static_concat/update-1674586302/a/a7d050cd624c59e4404eb037369f2662.css
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: f458a36ffaa366ccb695128ad7014f03b55deb42eaef112bd6872ae27c2d4d6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "612-5f3071e95aec0"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1554
Keep-Alive: timeout=5, max=98
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Tue, 24 Jan 2023 18:59:47 GMT
Content-Type: text/css
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 220 KB
77 KB 157ms
59ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KNBN3N4S

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6bdc7d7becbe58088a6e88e2991fcf1885bf42848af9a692e855b57694717abb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Fri, 27 Sep 2024 13:55:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 13:55:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Fri, 27 Sep 2024 12:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 78306
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 4543347703482746422
tpc.googlesyndication.com/simgad/ 70 KB
71 KB 156ms
49ms Image
image/png 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4543347703482746422?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qm8YFKbH7qTi1WEdgtGHFzxag_sKQ

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c682d9d35660ae21ce151813d396a05e016e880aa9fabae6178ea48b194264a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

age: 101518
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 09:43:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 26 Sep 2024 09:43:02 GMT
last-modified: Wed, 01 Nov 2023 13:48:49 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 71919
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK zaz.min.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/ 348 KB
348 KB 40ms
40ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 99086e62bdecf75871885758da9ff25e5ad37ac52bc4df3e8c5518a0432f9825

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "5708d-620387d6fcbc0"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 356493
Keep-Alive: timeout=5, max=99
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Wed, 21 Aug 2024 21:47:35 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK jstz.min.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751318/fe/zaz-3rd/timezoneDetect/ 12 KB
12 KB 42ms
41ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751318/fe/zaz-3rd/timezoneDetect/jstz.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: edc3c02a5b2d68ee89e7f4fbe3645eb8f3f065a2cff0fca1de4e3df755155bbb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "2f8a-61fbe20fd9180"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 12170
Keep-Alive: timeout=5, max=98
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Thu, 15 Aug 2024 19:48:38 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK jquery-3.4.1.min.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751314/fe/zaz-3rd/jquery/ 86 KB
86 KB 68ms
67ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751314/fe/zaz-3rd/jquery/jquery-3.4.1.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 99db4a43da4533df1bf084c76e0e2c8b3ea2fbe53b0c6016e8ec904db35ebed9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "158ae-61fbe20c08880"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 88238
Keep-Alive: timeout=5, max=99
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Thu, 15 Aug 2024 19:48:34 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK mod-jquery-ui.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751312/fe/zaz-3rd/jquery-ui/ 236 KB
236 KB 69ms
68ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1723751312/fe/zaz-3rd/jquery-ui/mod-jquery-ui.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: b6a2c2d3f5281e8f7c1f1a3bfa1e5f2296b55cb059f24a8c4d5a97d46b3275ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "3aea8-61fbe20a20400"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 241320
Keep-Alive: timeout=5, max=99
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Thu, 15 Aug 2024 19:48:32 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK comp-drop-down-list.min.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586302/fe/zaz-comp-drop-down-list/_js/ 2 KB
3 KB 67ms
66ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586302/fe/zaz-comp-drop-down-list/_js/comp-drop-down-list.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: d64f7ed99731057d7f934c492dd86d3bde044ccb38de703fdec11a30c1b39be6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "98f-5f30701ad2b80"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2447
Keep-Alive: timeout=5, max=99
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Tue, 24 Jan 2023 18:51:42 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK context.min.js Show response
reply-move-l-terraa.comercial.ws/terra2/adm/update-1723053483/fe/zaz-ui-webmail/_js/ 535 KB
535 KB 43ms
42ms Script
application/javascript 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1723053483/fe/zaz-ui-webmail/_js/context.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 80eecc4ca283f6b956f83048a72fdd54bf3689b539c283c3469721d99d7e4eb7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "85ca2-61f1ba6c880c0"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 548002
Keep-Alive: timeout=5, max=97
Date: Fri, 27 Sep 2024 13:55:00 GMT
Last-Modified: Wed, 07 Aug 2024 17:58:03 GMT
Content-Type: application/javascript
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H2 200 hotjar-2029857.js Show response
static.hotjar.com/c/ 13 KB
6 KB 184ms
86ms Script
application/javascript 108.157.4.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2029857.js?sv=6

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.157.4.118 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-157-4-118.dus51.r.cloudfront.net

Software

Resource Hash

d9a7c8135615a93df41b35bf91766fbffd5419fde7896ee2990d6d2a7adb143b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: max-age=60
content-encoding: br
etag: W/caef7a3c3d1ba1802841e31471f96751
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
x-cache-hit: 1
via: 1.1 6c90efa18f660ef893fb03f41073cde8.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: RefreshHit from cloudfront
x-amz-cf-id: udJvOV8fJ2cur9FHuKQ4hZGsx6LO4qK8qJQZUlhNnC1Mj_871GiK7g==
date: Fri, 27 Sep 2024 13:55:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-pop: DUS51-P2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 313 KB
104 KB 65ms
64ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S4K1JZJDZF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KNBN3N4S

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f75b19906923788d52022ce4e94e0934147e8f46f388fb3ab08c593192a9d0ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Fri, 27 Sep 2024 13:55:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 13:55:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 105794
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 t-g-d.min.js Show response
s1.trrsf.com/update-1674586311/fe/zaz-mod-metrics/_js/ 66 KB
24 KB 338ms
56ms Fetch
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.trrsf.com/update-1674586311/fe/zaz-mod-metrics/_js/t-g-d.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: 36fb0d8d6b55034c41405e7f1f43f33b1f6ea30aa778768dcb6324a94cb78cd5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=315360000, stale-while-revalidate=3600, stale-if-error=864000, immutable
timing-allow-origin: *
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,OPTIONS
x-cdnterra-cache-status: MISS
access-control-allow-origin: *
content-length: 24182
date: Fri, 27 Sep 2024 13:55:00 GMT
content-type: application/javascript
last-modified: Tue, 24 Jan 2023 18:51:51 GMT
server: Terra Web Server
access-control-allow-headers: Content-Type

GET
H2 200 ShowArea Show response
p1.trrsf.com/api/tagmanfe/ 7 KB
3 KB 933ms
648ms Script
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p1.trrsf.com/api/tagmanfe/ShowArea?key=br.terra_mail.home.setup&direct=1
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/mod-manager.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: f9a528c274b711eef7e75e59912ea81f5f4e4672d5cf02783e1e90ca89dcfab4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=300
content-encoding: gzip
x-tagman-uuid: 96d07cc2-83b8-4c4c-a8cc-909e38c44497
x-cdnterra-cache-status: EXPIRED
content-length: 2599
date: Fri, 27 Sep 2024 13:55:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: Terra Web Server

POST
H2 204 collect
region1.analytics.google.com/g/ 0
0 139ms
45ms Fetch
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-S4K1JZJDZF&gtm=45je49p0v9177000223z89135067849za200zb9135067849&_p=1727445300120&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101686684~101747727&cid=1354747732.1727445301&ecid=1988826942&ul=en-gb&sr=1600x1200&are=1&frm=0&pscdl=noapi&ec_mode=a&_s=1&sid=1727445300&sct=1&seg=0&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&dt=Terra%20Mail&en=page_view&_fv=1&_nsi=1&_ss=1&ep.Page_Hostname=reply-move-l-terraa.comercial.ws&ep.Page_Path=%2Fterra2%2Fadm%2Findex.php&ep.Page_URL=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&tfd=12842
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S4K1JZJDZF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 13:55:00 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
556 B 139ms
45ms Ping
text/plain 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S4K1JZJDZF&cid=1354747732.1727445301&gtm=45je49p0v9177000223z89135067849za200zb9135067849&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101671035~101686684~101747727
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S4K1JZJDZF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 13:55:00 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.co.uk/ads/ 42 B
63 B 133ms
79ms Image
image/gif 142.250.184.195
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S4K1JZJDZF&cid=1354747732.1727445301&gtm=45je49p0v9177000223z89135067849za200zb9135067849&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101671035~101686684~101747727&tag_exp=101671035~101686684~101747727&z=1833969302

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.195 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 27 Sep 2024 13:55:00 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK t3m.js Show response
tags.t.tailtarget.com/ 362 KB
31 KB 80ms
34ms Script
application/javascript 35.201.123.184
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://tags.t.tailtarget.com/t3m.js?i=TT-10969-0/CT-411
Requested by: Host: s1.trrsf.com
URL: https://s1.trrsf.com/update-1674586311/fe/zaz-mod-metrics/_js/t-g-d.min.js
Protocol: HTTP/1.1
Server: 35.201.123.184 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 184.123.201.35.bc.googleusercontent.com
Software: nginx/1.8.1 /
Resource Hash: 635e6036f5ed2dc391350d81313627530c106ff7620bb1492f8bce820b1912f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-goog-hash: md5=VHet6efdHb85sxfJsuJz2A==
ETag: "5477ade9e7dd1dbf39b317c9b2e273d8"
Age: 6679
x-goog-stored-content-encoding: gzip
Expires: Fri, 27 Sep 2024 14:03:42 GMT
x-goog-stored-content-length: 30864
Date: Fri, 27 Sep 2024 12:03:42 GMT
Last-Modified: Tue, 24 Sep 2024 18:02:11 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
X-GUploader-UploadID: AD-8ljsr5ppv_8VSZp40YuQb0fDKoxMMQT2URCske6Tmk_03pwLK8zq8JPu8fv-WgxUylhhnakE
Cache-Control: max-age=7200,public
x-goog-storage-class: STANDARD
Via: 1.1 google
Accept-Ranges: bytes
x-goog-generation: 1727200931156430
Content-Length: 30864
Server: nginx/1.8.1

GET
H/1.1 200
OK terra-horizontal-branco.svg
reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-t360-icons/svg/logos/ 6 KB
6 KB 41ms
41ms Image
image/svg+xml 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-t360-icons/svg/logos/terra-horizontal-branco.svg
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586544/fe/zaz-ui-webmail/_css/context.min.css
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 044ebbd0a887ffce575bef7a00aa81536aea2d1f8cfa7894c1618f6101067e72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1674586544/fe/zaz-ui-webmail/_css/context.min.css

Response headers

ETag: "1721-5f3070245c200"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 5921
Keep-Alive: timeout=5, max=96
Date: Fri, 27 Sep 2024 13:55:01 GMT
Last-Modified: Tue, 24 Jan 2023 18:51:52 GMT
Content-Type: image/svg+xml
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK password-show.svg
reply-move-l-terraa.comercial.ws/terra2/adm/update-1722014834/fe/zaz-mod-icons/svg/ozone/ 335 B
648 B 43ms
43ms Image
image/svg+xml 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1722014834/fe/zaz-mod-icons/svg/ozone/password-show.svg
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1722016084/fe/zaz-mod-icons/_css/ozone.min.css
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 2c961680e1618b81e56e91ea24b45272a4a10071b83891e5e8ae41aacbc18c0c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1722016084/fe/zaz-mod-icons/_css/ozone.min.css

Response headers

ETag: "14f-5f3070208b900"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 335
Keep-Alive: timeout=5, max=98
Date: Fri, 27 Sep 2024 13:55:01 GMT
Last-Modified: Tue, 24 Jan 2023 18:51:48 GMT
Content-Type: image/svg+xml
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H/1.1 200
OK jquery-3.4.1.min.js Show response
s1.trrsf.com/update-1582053940/fe/zaz-3rd/jquery/ 86 KB
31 KB 115ms
61ms Script
application/javascript 2a02:26f0:e300::5f64:924a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: http://s1.trrsf.com/update-1582053940/fe/zaz-3rd/jquery/jquery-3.4.1.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: HTTP/1.1
Server: 2a02:26f0:e300::5f64:924a Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: 99db4a43da4533df1bf084c76e0e2c8b3ea2fbe53b0c6016e8ec904db35ebed9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

Vary: Accept-Encoding
Cache-Control: max-age=315360000, stale-while-revalidate=3600, stale-if-error=864000, immutable
Timing-Allow-Origin: *
Content-Encoding: gzip
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET,POST,OPTIONS
X-CDNTerra-Cache-Status: MISS
Access-Control-Allow-Origin: *
Content-Length: 30798
Date: Fri, 27 Sep 2024 13:55:01 GMT
Content-Type: application/javascript
Last-Modified: Thu, 15 Aug 2024 19:48:34 GMT
Server: Terra Web Server
Access-Control-Allow-Headers: Content-Type

GET
H/1.1 200
OK include Show response
p1.trrsf.com/api/includer/ 3 KB
899 B 665ms
610ms Fetch
application/json 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: http://p1.trrsf.com/api/includer/include?component=mod.xRequest&country=br&env=prod&format=json&group=web
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: HTTP/1.1
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: dccdf122a89a2920fcfe55987a614815229d59893b2ce13fbfcf4258e71d05c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

x-includer-uuid: 7d7dfda6-edf6-4e03-a784-86d545e2d2e0
Cache-Control: max-age=60, stale-while-revalidate=300, stale-if-error=86400
Content-Encoding: gzip
Connection: keep-alive
X-CDNTerra-Cache-Status: STALE
Access-Control-Allow-Origin: *
Content-Length: 482
Date: Fri, 27 Sep 2024 13:55:02 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding
Server: Terra Web Server

GET
H2 200 ShowArea Show response
p1.trrsf.com/api/tagmanfe/ 5 KB
1 KB 605ms
604ms Script
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p1.trrsf.com/api/tagmanfe/ShowArea?key=br.terra_mail.home.c1&area=c1&direct=1
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/mod-manager.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: be6aa02c22c27b168673040e96b0bb0e978fa0a96fb51d07a6043a8eda31410b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=300
content-encoding: gzip
x-tagman-uuid: 0b3eaeb7-a3e5-46a5-85fa-1f7521e5f1cf
x-cdnterra-cache-status: HIT
content-length: 1128
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: Terra Web Server

GET
H2 200 ShowArea Show response
p1.trrsf.com/api/tagmanfe/ 5 KB
1 KB 710ms
709ms Script
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p1.trrsf.com/api/tagmanfe/ShowArea?key=br.terra_mail.home.c2&area=c2&direct=1
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/mod-manager.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: 71f3d8c5ab2df141b8ab9a2334c640abc0c471a2713995d39ccb7023197306a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=300
content-encoding: gzip
x-tagman-uuid: 89b54dbb-2866-41b6-8aa0-4d5b1bd4cfa3
x-cdnterra-cache-status: HIT
content-length: 1150
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: Terra Web Server

GET
H2 200 ShowArea Show response
p1.trrsf.com/api/tagmanfe/ 5 KB
1 KB 223ms
223ms Script
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p1.trrsf.com/api/tagmanfe/ShowArea?key=br.terra_mail.home.c3&area=c3&direct=1
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/mod-manager.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: 67fccdae17efddc3f8526e8944871040b47fe6f33471f6da6d8abf10c78f774d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=300
content-encoding: gzip
x-tagman-uuid: 46340c06-ebb1-4d0c-a29d-781ceeaa9238
x-cdnterra-cache-status: HIT
content-length: 1150
date: Fri, 27 Sep 2024 13:55:01 GMT
content-type: application/javascript
vary: Accept-Encoding
server: Terra Web Server

GET
H2 200 ShowArea Show response
p1.trrsf.com/api/tagmanfe/ 5 KB
1 KB 674ms
674ms Script
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p1.trrsf.com/api/tagmanfe/ShowArea?key=br.terra_mail.home.c4&area=c4&direct=1
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/fe/zaz-mod-manager/mod-manager.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: d086be30d5f8bc168f0aefa2fdaed02c8352bcb2e3b7df32574d4cddcca33433

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=300
content-encoding: gzip
x-tagman-uuid: 950676b5-e880-417a-b5ef-a4e7961acd3e
x-cdnterra-cache-status: EXPIRED
content-length: 1149
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: application/javascript
vary: Accept-Encoding
server: Terra Web Server

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 105 KB
32 KB 145ms
60ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

7fe5dfe9b951fe9ddee37f99254350e7bdb68d1cc2794a98a849a45aa2ca0ec1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 936 / 19993 / m202409230101 / config-hash: 1890275544128936471
x-content-type-options: nosniff
expires: Fri, 27 Sep 2024 13:55:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 13:55:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 32871
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/ 478 KB
149 KB 43ms
43ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

e7c830884fcf4bff019e1588004e72e97fde70bbd28e94bbdea801b24f011bf9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 16457912710013743337
age: 34408
x-content-type-options: nosniff
expires: Sat, 27 Sep 2025 04:21:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 04:21:33 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 152739
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 586 B
315 B 203ms
118ms Fetch
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3603701336521198&correlator=3831072379206136&eid=44809527%2C31087358%2C31087482&output=ldjh&gdfp_req=1&vrg=202409230101&ptt=17&impl=fifs&iu_parts=1211%2Cbr.terra.mail%2Chome&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&fsbs=1&ists=1&eri=1&sc=0&abxe=1&dt=1727445301926&lmt=1727445301&adxs=0&adys=700&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&bc=23&nvt=1&url=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&vis=1&psz=1600x700&msz=1600x0&fws=4&ohw=1600&dlt=1727445300107&idt=1793&prev_scp=testfloor%3Dfalse%26connection%3D4g%26fledge%3Dfalse%26lite%3D0%26pf%3Dfalse%26pr%3Dfalse&adks=3225428632&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

85e4188b25b24de4bf37da81ab15a17904b787f2bbceb3599e47f9d5d5535e24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
google-lineitem-id: -2
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
content-length: 286
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 64 KB
22 KB 209ms
124ms Fetch
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3603701336521198&correlator=3996775154768972&eid=44809527%2C31087358%2C31087482&output=ldjh&gdfp_req=1&vrg=202409230101&ptt=17&impl=fifs&iu_parts=1211%2Cbr.terra.mail%2Chome%2Cc3&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=2&sfv=1-0-40&fsbs=1&eri=1&sc=0&abxe=1&dt=1727445301934&lmt=1727445301&adxs=651&adys=80&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&bc=23&nvt=1&url=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&vis=1&psz=300x0&msz=300x0&fws=4&ohw=300&dlt=1727445300107&idt=1793&prev_scp=viewport%3Dc3%26refresh%3D0%26mail%3D3%26testfloor%3Dtrue%26connection%3D4g%26fledge%3Dfalse%26lite%3D0%26pf%3Dfalse%26pr%3Dfalse&adks=1379904896&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

7293cb6c783664d5c75ba0849ebd053185c5b6f143edd54cebd773c9931f669a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
google-lineitem-id: 5547783970
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138482830748
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
content-length: 22931
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B7F7 0
0 166ms
52ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://reply-move-l-terraa.comercial.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 27 Sep 2024 13:55:02 GMT
expires: Fri, 27 Sep 2024 13:55:02 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame F349 0
0 174ms
83ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvmrh3jw2GEh0LCJvmMt-lVZ6apKlD2grRbINOIHU7HLmN2Gsmwf2MkrrdoD-_jmLWAJ5BUAnG5mThoFJCB1W91cg0pMuUMLWlqLWMQH52ORb8s9vnhpb6oc4OITz-Q1lbH_TKHUup2tyVf3U6otdo0S342Xrf5Q8PByoz2iOnO_aYdnuEDzeNLPnJ5uRB4-XDLEUaCJacxwSWgeIzebdreJlxSDeZzVTjor2SUA5scOlyN5v82vHOXQyiCXDv4z5IzvM_ASVhC8HE9aZq2N5dIf1ebPIz8K7yPfPgZmbrS0qMyoAlVeAgDJ-COEbCGjbJmOJAOYE0P1HnrwRmTGldyj16WO8F93WEMlZR5rTSTIkmfclD8sIzF27ThZQLm-ByPL3lROOxANNTow_36aXoEg7maSlkFUA&sig=Cg0ArKJSzHN5zxFlrrQHEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/ Frame F349 23 KB
9 KB 136ms
46ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 1262224488297882673
age: 51608
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 23:34:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 26 Sep 2024 23:34:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9310
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/ Frame F349 3 KB
1 KB 210ms
120ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 16544991220582087243
age: 19832
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 08:24:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 08:24:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1229
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame F349 206 KB
64 KB 139ms
50ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

05de5c8908714cc3dc1dac9ac7659b9bd33257cc1f6b31e6990bc73e950f760a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 11746362072233399066
age: 1142
x-content-type-options: nosniff
expires: Fri, 27 Sep 2024 14:36:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:36:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65415
x-xss-protection: 0
server: cafe

GET
H2 200 13631092998768625136
tpc.googlesyndication.com/simgad/ Frame F349 34 KB
35 KB 65ms
65ms Image
image/jpeg 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13631092998768625136

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1880f161170e6d2c37c221b38cc655ce5795f63cbfc428a4e6e0c52ac7acbf7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

age: 102392
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 09:28:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 26 Sep 2024 09:28:30 GMT
last-modified: Tue, 11 Jun 2024 19:20:42 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 35168
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame F349 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90afb74195e81e6793afa165089b5dcc5b06105443d169dd7607200556cf36da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

Content-Type: image/png

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 64 KB
22 KB 198ms
198ms Fetch
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3603701336521198&correlator=1918914687072776&eid=44809527%2C31087358%2C31087482&output=ldjh&gdfp_req=1&vrg=202409230101&ptt=17&impl=fifs&iu_parts=1211%2Cbr.terra.mail%2Chome%2Cc1&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=3&sfv=1-0-40&fsbs=1&eri=1&sc=0&abxe=1&dt=1727445302203&lmt=1727445302&adxs=651&adys=80&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&bc=23&nvt=1&url=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&vis=1&psz=300x0&msz=300x0&fws=4&ohw=300&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslRmaAO4-hX2inkPrIjJnJNRj7uM9sMUbrrKk0Lk02T7ceLTrPCgME0ZtBjx-cupg1-foEP6DmkljCrzWRK4Ow9&dlt=1727445300107&idt=1793&prev_scp=viewport%3Dc1%26refresh%3D0%26mail%3D1%26testfloor%3Dtrue%26connection%3D4g%26fledge%3Dfalse%26lite%3D0%26pf%3Dfalse%26pr%3Dfalse&adks=3093060894&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

2be8209fa8ebaad19ffb07f96caa1c2552e50405d046aac7b0bff9bf2470e066

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
google-lineitem-id: 5547783970
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138482674953
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
content-length: 22951
x-xss-protection: 0
server: cafe

GET
H2 200 mod-xrequest.min.js Show response
s1.trrsf.com/update-1674586315/fe/zaz-mod-xrequest/_js/ 19 KB
5 KB 56ms
56ms Fetch
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.trrsf.com/update-1674586315/fe/zaz-mod-xrequest/_js/mod-xrequest.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: aa3b66cc46e7b15d1cdf78e3dc02b9088bc39ed3f230eec1e0678e7e3dd6488b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=315360000, stale-while-revalidate=3600, stale-if-error=864000, immutable
timing-allow-origin: *
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,OPTIONS
x-cdnterra-cache-status: HIT
access-control-allow-origin: *
content-length: 5199
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: application/javascript
last-modified: Tue, 24 Jan 2023 18:51:55 GMT
server: Terra Web Server
access-control-allow-headers: Content-Type

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 64 KB
22 KB 139ms
139ms Fetch
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3603701336521198&correlator=1611134296184322&eid=44809527%2C31087358%2C31087482&output=ldjh&gdfp_req=1&vrg=202409230101&ptt=17&impl=fifs&iu_parts=1211%2Cbr.terra.mail%2Chome%2Cc4&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=4&sfv=1-0-40&fsbs=1&eri=1&sc=0&abxe=1&dt=1727445302273&lmt=1727445302&adxs=651&adys=330&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&bc=23&nvt=1&url=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&vis=1&psz=300x0&msz=300x0&fws=4&ohw=300&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslRmaAO4-hX2inkPrIjJnJNRj7uM9sMUbrrKk0Lk02T7ceLTrPCgME0ZtBjx-cupg1-foEP6DmkljCrzWRK4Ow9&dlt=1727445300107&idt=1793&prev_scp=viewport%3Dc4%26refresh%3D0%26mail%3D4%26testfloor%3Dfalse%26connection%3D4g%26fledge%3Dfalse%26lite%3D0%26pf%3Dfalse%26pr%3Dfalse&adks=1666632028&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

060ea6fb0a0d34227dbb38764e0ead50d20e4db5f82df2e0db04b7fce90c0d05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
google-lineitem-id: 5547783970
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138482680200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
content-length: 22940
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
pagead2.googlesyndication.com/gampad/ 64 KB
22 KB 148ms
147ms Fetch
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?pvsid=3603701336521198&correlator=2191171850598598&eid=44809527%2C31087358%2C31087482&output=ldjh&gdfp_req=1&vrg=202409230101&ptt=17&impl=fifs&iu_parts=1211%2Cbr.terra.mail%2Chome%2Cc2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=5&sfv=1-0-40&fsbs=1&eri=1&sc=0&abxe=1&dt=1727445302310&lmt=1727445302&adxs=651&adys=80&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&bc=23&nvt=1&url=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&vis=1&psz=300x0&msz=300x0&fws=4&ohw=300&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslRmaAO4-hX2inkPrIjJnJNRj7uM9sMUbrrKk0Lk02T7ceLTrPCgME0ZtBjx-cupg1-foEP6DmkljCrzWRK4Ow9&dlt=1727445300107&idt=1793&prev_scp=viewport%3Dc2%26refresh%3D0%26mail%3D2%26testfloor%3Dtrue%26connection%3D4g%26fledge%3Dfalse%26lite%3D0%26pf%3Dfalse%26pr%3Dfalse&adks=3310595515&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

bc85f834278c0cbf9809bfb7ff69e4a215fd01d427cfc70ed3ead44d8cb7982e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
google-lineitem-id: 5547783970
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138483431797
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: http://reply-move-l-terraa.comercial.ws
content-length: 22942
x-xss-protection: 0
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame F349 0
0 78ms
77ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjstlTKx_8yNHLCKHdoLQat943Xf31N4ILlb45GENHLgHDIf2xRpPEbW712iCLVRDB7afjgTqQlQ5Xo8xyNt29vB33_bRqtG4VK_bz09xwMa6pYZSsse-wo_0oyib2hXh48VEPXEwchtulIAOjNiQ_jZ7Q78ltHPKVOcXmV5wM-WZ0THk9mzxlNtLtIj0KfyNtt2lZIvpyVkF6nFbwQAo0Jb0lPzO6r6_pMtCp_apqmzEvZG_8oytZJdHjm_022LbCsgrMVWUyOMnQcG4YVdi1Sb6GimyqSPaT08Y4Z31VwLpUIxAWrAVjKUpOK9gCiFX41Dqb-PQpEdO_4nC3J3DpJPDZpRL0VXKad10Don29vXYFdlt2Me_PU4cAsfc2KiFxG8qtxreEu7O5Ht_iiBqRmC0NnSsxNRBAt7G&sig=Cg0ArKJSzBdriBbcfyuHEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F349 0
0 74ms
74ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 95C2 0
0 82ms
81ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssgk63_KHPY-x_cH7PdjbiO3TnLqYHyZ6ldGPPqjtvsQqEq2p2ojEUR6IQCj84RfhQV3btJaVJTCiWgsClnMWF5qYHpExf3Sz4V31wuyIyY7txqD3o2nSAtuKaYxhRyVddTgPRxBxlj9jbbIHDSWJ2IJz6hZy2Sd9NWwd_tL0BcOW7VCUDRkok85rxYufgh78jhDARAahPsoOmlrYDcQSePKHCI7l5HKqZBOoHw6qhGuMF5AADqXYgWV4LhnJvoV1oPsKpoq3uQ-GNnReVbG9oIWYtZElNSmsBFvabkF3NMMAR2uo7NYNxbIKXvzqEYgpUQk8d7kqvu04b6yqD9NsgYNchMVj-Kzu7U7Eh-zavNWy57sgDDErW2khCIpw8A0MG4ZBm7RyrT1iUfQ295Kgns-J_SZ1V1mg&sig=Cg0ArKJSzNje42b21gPhEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/ Frame 95C2 23 KB
0 136ms
46ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 1262224488297882673
age: 51608
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 23:34:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 26 Sep 2024 23:34:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9310
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/ Frame 95C2 3 KB
0 0ms
0ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 16544991220582087243
age: 19832
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 08:24:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 08:24:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1229
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 95C2 206 KB
0 139ms
50ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

05de5c8908714cc3dc1dac9ac7659b9bd33257cc1f6b31e6990bc73e950f760a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 11746362072233399066
age: 1142
x-content-type-options: nosniff
expires: Fri, 27 Sep 2024 14:36:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:36:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65415
x-xss-protection: 0
server: cafe

GET
H3 200 17908590528350761321
tpc.googlesyndication.com/simgad/ Frame 95C2 82 KB
82 KB 44ms
43ms Image
image/gif 142.250.186.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17908590528350761321

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.65 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f1.1e100.net

Software

sffe /

Resource Hash

3cfa5cd6f5141614bdad68161f1b759e3a93db9dfabe00c33f722022368e53c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

age: 148700
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 25 Sep 2025 20:36:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 25 Sep 2024 20:36:42 GMT
last-modified: Wed, 17 Jul 2024 15:00:17 GMT
content-type: image/gif
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 84313
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 95C2 0
0 119ms
76ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 95C2 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a984d0eb8e9da5e1d1b131d5fd9df54a7204d6575f74e1c8bc3d44662efc57a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

Content-Type: image/png

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame EC35 0
0 80ms
80ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjssskAGmESCnURu1mknvmwd5Nou_72GmUV5AynQ8EvGRjQ-JGkO8PidwZ_srrdb6PB9HdvJLi6EaBe_psdNx42BBO5Pt6HIDXdkBDASwqGgBtAZxPsZy8OFAotiNbDb11K6sDkiW2r22bng4nkSiz3pFGvXqagEj8V_AZQ8VBKBcHLEfTqlcdOIT8EO-HYIOfTp5rpOs_rxdxmPATyKOMfxkwXqyF0vza_1qFF1n06RaDy3slzMZIxAF7k4vKZR0Po1uen5BRaVom13wbIANgDMAtS6iB1btREyc2dcIzNcjmr42ekYSO-FFy9VGw6QQDYWavoxdTYkOrzCNtrvb3B-rOCsHGAT_rfxx0EjujPWfFczMbQsaXqOmeCny4DcI9SxNMv1enVq7_RMkeDxEaTky7TCXhiLaxg&sig=Cg0ArKJSzHpH-vK1ibUyEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/ Frame EC35 23 KB
0 136ms
46ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 1262224488297882673
age: 51608
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 23:34:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 26 Sep 2024 23:34:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9310
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/ Frame EC35 3 KB
0 0ms
0ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 16544991220582087243
age: 19832
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 08:24:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 08:24:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1229
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame EC35 206 KB
0 139ms
50ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

05de5c8908714cc3dc1dac9ac7659b9bd33257cc1f6b31e6990bc73e950f760a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 11746362072233399066
age: 1142
x-content-type-options: nosniff
expires: Fri, 27 Sep 2024 14:36:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:36:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65415
x-xss-protection: 0
server: cafe

GET
H3 200 16423611277189487515
tpc.googlesyndication.com/simgad/ Frame EC35 32 KB
32 KB 52ms
52ms Image
image/jpeg 142.250.186.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16423611277189487515

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.65 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f1.1e100.net

Software

sffe /

Resource Hash

aac22f498c9b91c66f4c200210a467292237de05ae4c8119aa244a555c1b77e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

age: 115838
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 26 Sep 2025 05:44:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 26 Sep 2024 05:44:24 GMT
last-modified: Thu, 04 Jul 2024 12:43:52 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 32432
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EC35 0
0 161ms
75ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame EC35 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2874e66a77054edaf11e5d56f1b728772d993ad10a11de29bb3513e9f37f3df7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

Content-Type: image/png

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 849D 0
0 80ms
80ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsuPhbsfRd5MeY16QGFUi5e9DBgBlPq44raCy5LvqZsDBXPzXUOY-OnToWMhz60T8Zib8sL8ChUnOW-rU6Jxl7R3dQBGD6K7Pyul1X_apIbIS47rQaG0uYiiaSRYnKlj_JGbSE657XZVrbmo6tXPvm8lZV6YrSHrxSdTENczpYZUCA3_zOiocQ36OSWwTO7YhBe23Nz8TWmb9s37zTnmJU8jCZjgQmRGtNpSEEPIsQEXNHxraOzFyL4z4PsH_8_Pl4uOjlB5BdtpAt_fslHco-xOmfBQcQEEeO9gyah-abkNft77B91QqJVt3Pt9IdSYawsZK9MGFI7o31QnD3sTfN7Btl9J079jVsd71FW4I9bQX1H4NMCSUv8qqvJ0PKrFDNbkEXqqGVv7vwqZgfB5_bB-m76b4DMSmQ&sig=Cg0ArKJSzP7ZrcXcRGATEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/ Frame 849D 23 KB
0 136ms
46ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/abg_lite_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 1262224488297882673
age: 51608
x-content-type-options: nosniff
expires: Thu, 10 Oct 2024 23:34:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 26 Sep 2024 23:34:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 9310
x-xss-protection: 0
server: cafe

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/ Frame 849D 3 KB
0 0ms
0ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240925/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 16544991220582087243
age: 19832
x-content-type-options: nosniff
expires: Fri, 11 Oct 2024 08:24:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 08:24:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1229
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 849D 206 KB
0 139ms
50ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

05de5c8908714cc3dc1dac9ac7659b9bd33257cc1f6b31e6990bc73e950f760a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: br
etag: 11746362072233399066
age: 1142
x-content-type-options: nosniff
expires: Fri, 27 Sep 2024 14:36:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 27 Sep 2024 13:36:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65415
x-xss-protection: 0
server: cafe

GET
H3 200 7712832442882095193
tpc.googlesyndication.com/simgad/ Frame 849D 76 KB
76 KB 63ms
63ms Image
image/gif 142.250.186.65
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7712832442882095193

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.65 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f1.1e100.net

Software

sffe /

Resource Hash

c26476e49111380d715cfcbb4a33d5d7c474adc0f39734de6f00ce77e7143f5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

age: 5947
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Sat, 27 Sep 2025 12:15:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 27 Sep 2024 12:15:55 GMT
last-modified: Wed, 17 Jul 2024 15:04:09 GMT
content-type: image/gif
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 78085
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 849D 0
0 215ms
75ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 849D 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 47d98326fbf1746050b15114a5215ebb14994d74e46ff2914567297a20fbf079

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

Content-Type: image/png

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame EC35 0
0 77ms
77ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvhRw7HHMGQt_TG6l7mLnVtgp3WLmt7KLtCQTa35wcj8oYNLdxCnINp3yzYXyGlAtMJDdBszrpl2iy0uD2Osukd-HuS-ZIANS9-unogepmiWgH2UQhUmshY77ubN5nPRGGD7tp36NVa_imR_oecXVYn3eXP_9bO9_aovUoAoqA3pbCFzG2hB7a5EzoKfyCQPBc50IbcqDaLNdsCIbJoZ39yqyV-uh0EDR0dLULgq6c5PCyws24LeDmfstL3vEw3GkDCR54cpcSEUiGyegEOex1-c5kZ057pz28tuvl4nA2zdwOkA0TqiOytq1JvfyGsXtlA96kUnCJciZky4VVlAFT_LW4amxNH2N7ZBcfWY4tpo1oZObWpG-VLQ6xJ8zFSZDxfTdJ6cM4PQGS8ixsn5rus6qb1IwN2oDpy&sig=Cg0ArKJSzD9Am7jDG5OBEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 95C2 0
0 77ms
77ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsuwCUcdfK3QcjcYH8Y4nRhF5ncdnDJuTrPQhcYBkGXPhBiH707JNFJZAEgEy-06YIBnv3o4q89Pybk_rYfMz34L9R4vRet2uKznQqM7_Iwt-Z5PYXDJZuR3fs3xU4MFr5L0NB4Suc9N61LSjEPc4NcCmr8ZFUdYUMT7-FlQkzH4f9W3InZOyz3DWMlr5fZrgc09zVCY9KIPZJkEwrIiiSPmIX8IhBqT4tiEgpdISkRaA9SJ6MPKxf3iYgC0stpBF9zooQyjETLdIjC1_fBS7jy--fReXVb_wx4s-pcZVXlvLi8omLsLYbrlaRkFGea4EEQJwOIhdmR-sKfGfjkcQuirr4WUj0zv6T4pVVTQlbgandpYApavfJoNq_9ENLuJtlpmQ3GHWUhF_rZF-W7VJqCH0ajm2zaeCuTy&sig=Cg0ArKJSzN955ZG4U1v6EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

collect
www.google-analytics.com/
Redirect Chain

http://www.google-analytics.com/collect?v=1&_v=j41&a=1531430009&t=pageview&_s=1&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb2...
https://www.google-analytics.com/collect?v=1&_v=j41&a=1531430009&t=pageview&_s=1&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb...

35 B
600 B

158ms
46ms

Image
image/gif

2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j41&a=1531430009&t=pageview&_s=1&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&ul=en-gb&de=UTF-8&dt=Terra%20Mail&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SCCAgEABG~&jid=234489052&cid=1354747732.1727445301&tid=UA-54936151-1&cd1=comunidad&cd2=email&cd3=&cd4=comunidades&cd5=300264&cd6=novo&cd7=srv&cd9=terra&cd10=N&cd11=&cd15=br&cd18=&cd19=&cd20=other&cd21=T&cd22=desktop&cd34=&cd35=&cd44=reply-move-l-terraa%3Acomercial%3Aws%3Aterra2%3Aadm&cd8=Direct%20Load&cd12=&cd14=&cd16=&cd17=&cd23=&cd40=&cd41=&cd48=&cd49=false&cd52=default&cd60=10&cd61=100&cd62=4g&cd63=false&cd64=browser&z=2106195977

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Server

2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

age: 20656
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 08:10:46 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://www.google-analytics.com/collect?v=1&_v=j41&a=1531430009&t=pageview&_s=1&dl=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&ul=en-gb&de=UTF-8&dt=Terra%20Mail&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=SCCAgEABG~&jid=234489052&cid=1354747732.1727445301&tid=UA-54936151-1&cd1=comunidad&cd2=email&cd3=&cd4=comunidades&cd5=300264&cd6=novo&cd7=srv&cd9=terra&cd10=N&cd11=&cd15=br&cd18=&cd19=&cd20=other&cd21=T&cd22=desktop&cd34=&cd35=&cd44=reply-move-l-terraa%3Acomercial%3Aws%3Aterra2%3Aadm&cd8=Direct%20Load&cd12=&cd14=&cd16=&cd17=&cd23=&cd40=&cd41=&cd48=&cd49=false&cd52=default&cd60=10&cd61=100&cd62=4g&cd63=false&cd64=browser&z=2106195977
Non-Authoritative-Reason: HSTS

GET
H2 200 collect
stats.g.doubleclick.net/r/ 35 B
405 B 45ms
44ms Image
image/gif 2a00:1450:400c:c00::9c
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j41&tid=UA-54936151-1&cid=1354747732.1727445301&jid=234489052&_u=SCCAgEABG~&z=1527599068

Requested by

Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:143:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 13:55:02 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:143:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 35
server: Golfe2

GET
H/1.1 204
No Content b
b.scorecardresearch.com/ 0
331 B 111ms
55ms Image
text/plain 108.157.4.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://b.scorecardresearch.com/b?c1=2&c2=3000033&ns__t=1727445302593&ns_c=UTF-8&c8=Terra%20Mail&c7=http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255&c9=
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 108.157.4.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-38.dus51.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

Via: 1.1 5db4f6b1c04035a37ba6548e89b362be.cloudfront.net (CloudFront)
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: rgeEjWuyy3F5-N14DjL4bBc78T-8m1ndT2DXvtfpmK4998o9A16dsw==
Date: Fri, 27 Sep 2024 13:55:02 GMT
Accept-CH: UA, Platform, Arch, Model, Mobile
X-Amz-Cf-Pop: DUS51-P2
Connection: keep-alive

GET
H3 200 view
pagead2.googlesyndication.com/pcs/ Frame 849D 0
0 77ms
77ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/view?xai=AKAOjsvmKoB9ZZ2F2DqPudsBijmPsWSFL8QUAV2brmmXKCY_t71rVLVdiK3NHarkk9VFvn2O7u_vgPiF-LFBbsKQ7Ty37tq5BvL8l_gjeSb1R8O-pmsky0AxqX9f0HnxsSOuIA664-ggSGVaQfFj3IHkw_bEOiFeW-Cn8o4Yl7sTMRMma2WiwDmZjtiaI5WP9LvF6ybsZ0R_tlOdunIiGjb-hp2MFfJL4G1yLF0WVL43VKqiMfJUTNDZ3cHdHJr_ZGoUNnFECf8EBpcQfXhLEJf4dkWbPhW5qL6IW0LPYnK8R29Hxuht7xC08jDDzgusr02T9ii_mPyjnUWE17gSKmvub15IK8ZYuU4YOZeNQ99QC06Q0w_KYED1T4f1wrlBzC3jJnuXKpzLGQ89sRMAEb_2E-ODpqpyEgMS0X9X&sig=Cg0ArKJSzNlrmsGE7sT5EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 zaz-mod-carousel.min.js Show response
s1.trrsf.com/update-1674586306/fe/zaz-mod-carousel/_js/ 15 KB
4 KB 56ms
56ms Fetch
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.trrsf.com/update-1674586306/fe/zaz-mod-carousel/_js/zaz-mod-carousel.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: 79a6813135d263cc370b2be8bfaa33c3d84efc3258fc9cd125a3e4f94eadc30d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=315360000, stale-while-revalidate=3600, stale-if-error=864000, immutable
timing-allow-origin: *
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,OPTIONS
x-cdnterra-cache-status: HIT
access-control-allow-origin: *
content-length: 3650
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: application/javascript
last-modified: Tue, 24 Jan 2023 18:51:46 GMT
server: Terra Web Server
access-control-allow-headers: Content-Type

GET
H/1.1 200
OK conversion.js Show response
d.tailtarget.com/ 15 KB
7 KB 82ms
34ms Script
application/javascript 35.201.123.184
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: http://d.tailtarget.com/conversion.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255
Protocol: HTTP/1.1
Server: 35.201.123.184 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 184.123.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: f3d70165d1438b13b94b2aebf55f853777b6f44c8ca0b3473728bfefa90b115f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

x-goog-metageneration: 1
Content-Encoding: gzip
x-goog-hash: crc32c=SdVkEQ==, md5=w5RR5d7Cvn/H1t92tVvmYg==
ETag: "c39451e5dec2be7fc7d6df76b55be662"
Age: 5511
x-goog-stored-content-encoding: gzip
Expires: Sat, 28 Sep 2024 12:23:11 GMT
x-goog-stored-content-length: 6116
Date: Fri, 27 Sep 2024 12:23:11 GMT
Last-Modified: Thu, 14 Sep 2023 12:59:30 GMT
Content-Type: application/javascript
X-GUploader-UploadID: AD-8ljsknPPnr1ktc_EhYDPNfz9oQHW6Jb-Pqf2XrCUfDECDjVstUHwamLhCFgw3cPyWjhHBj78
Cache-Control: public, max-age=86400,no-transform
x-goog-storage-class: STANDARD
Accept-Ranges: bytes
x-goog-generation: 1694696370171925
Content-Length: 6116
Content-Language: en
Server: UploadServer

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 17 KB
13 KB 58ms
58ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202409230101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

7007f22bb7ade02d9a8a2ff396146d18eb8fe465b4715a653717049807919aa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12883
date: Fri, 27 Sep 2024 13:55:02 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H/1.1 200
OK favicon.ico
reply-move-l-terraa.comercial.ws/terra2/adm/ 3 KB
3 KB 42ms
41ms Other
image/x-icon 157.173.106.69
CONTABO

General

Check archive.org

Show headers Download Go to

Full URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/favicon.ico
Protocol: HTTP/1.1
Server: 157.173.106.69 , United Kingdom, ASN51167 (CONTABO, DE),
Reverse DNS: mail.meuacessonovomail.store
Software: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33 /
Resource Hash: 89b78d8bee0649d2669c3c50407756027c4b873383a27ce29c7c65484104c8c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/terra2/adm/index.php?id=9e405475-4eae-479d-8417-cb3b508cb255

Response headers

ETag: "b7a-53bc23c9a6980"
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 2938
Keep-Alive: timeout=5, max=97
Date: Fri, 27 Sep 2024 13:55:02 GMT
Last-Modified: Mon, 05 Sep 2016 12:58:30 GMT
Content-Type: image/x-icon
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.33

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 18 KB
6 KB 144ms
144ms Script
text/javascript 142.250.186.65
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409230101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.65 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f1.1e100.net

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 27 Sep 2024 13:55:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 base.js Show response
d.tailtarget.com/ 20 KB
9 KB 100ms
33ms Script
application/javascript 35.201.123.184
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://d.tailtarget.com/base.js
Requested by: Host: d.tailtarget.com
URL: http://d.tailtarget.com/conversion.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.123.184 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 184.123.201.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 54930f8d5930ea73a5643b6e7cd4f3e5142609ed371fd9d1969ad38dba591ab4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=yMCztg==, md5=IN48kLLZVBsGInbgefDqpw==
etag: "20de3c90b2d9541b062276e079f0eaa7"
age: 5915
x-goog-stored-content-encoding: gzip
expires: Sat, 28 Sep 2024 12:16:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 8334
date: Fri, 27 Sep 2024 12:16:27 GMT
last-modified: Thu, 14 Sep 2023 12:59:30 GMT
content-type: application/javascript
x-guploader-uploadid: AD-8ljsy-qFwz7xqIbPl9SGQ7GghUvI5J91GbI2SldbmLrVMSNghaJAExu36LO3UGrTAAcgsYgA
cache-control: public, max-age=86400,no-transform
x-goog-storage-class: STANDARD
accept-ranges: bytes
x-goog-generation: 1694696370056280
content-length: 8334
content-language: en
server: UploadServer

GET
H2 200 trk
tt-10969-0.seg.t.tailtarget.com/ 70 B
647 B 207ms
122ms Image
image/png 34.102.185.99
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tt-10969-0.seg.t.tailtarget.com/trk?tA=TT-10969-0&tJ=_channel:bratargettecinformaticaapple:1|_channel:bratargetdiversidade:1&tK=1727445303&tM=direct&tL=direct&tN=direct&tY=3&tZ=715875876
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.185.99 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 99.185.102.34.bc.googleusercontent.com
Software: nginx/1.17.8 /
Resource Hash: e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, private, proxy-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 13:55:02 GMT
content-type: image/png
content-disposition: inline
server: nginx/1.17.8

GET
H/1.1 200
OK include Show response
p1.trrsf.com/api/includer/ 3 KB
879 B 591ms
591ms Fetch
application/json 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: http://p1.trrsf.com/api/includer/include?component=mod.adManager&country=br&env=prod&format=json&group=web
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: HTTP/1.1
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: b41eebd927976578d14a7bd65b11a50f1d1aad2c8d67829216f353f5795f487e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

x-includer-uuid: a1a367d7-8f1a-463e-b207-084d61721613
Cache-Control: max-age=60, stale-while-revalidate=300, stale-if-error=86400
Content-Encoding: gzip
Connection: keep-alive
X-CDNTerra-Cache-Status: STALE
Access-Control-Allow-Origin: *
Content-Length: 462
Date: Fri, 27 Sep 2024 13:55:03 GMT
Content-Type: application/json; charset=utf-8
Vary: Accept-Encoding
Server: Terra Web Server

GET
H2 200 u Show response
b.t.tailtarget.com/ 72 B
345 B 128ms
122ms Script
application/x-javascript 34.102.185.99
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://b.t.tailtarget.com/u?env=_ttqtt_terra
Requested by: Host: d.tailtarget.com
URL: https://d.tailtarget.com/base.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.185.99 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 99.185.102.34.bc.googleusercontent.com
Software: nginx/1.17.8 /
Resource Hash: e0205219c7e4cda93fdf2b2a59fc1c83e1e271df873a4512ba642a6ccd866bcd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: private, proxy-revalidate
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 13:55:03 GMT
content-type: application/x-javascript
vary: Accept-Encoding, Accept-Encoding
server: nginx/1.17.8

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame EB0A 0
0 136ms
42ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://reply-move-l-terraa.comercial.ws/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 218331
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 Sep 2024 01:16:12 GMT
expires: Thu, 25 Sep 2025 01:16:12 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 b Show response
b.t.tailtarget.com/ 145 B
572 B 124ms
123ms Script
application/javascript 34.102.185.99
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://b.t.tailtarget.com/b?tA=TT-10969-0&tY=1&tS=3&tU=0100007F37B9F666A206EE210240E610&tX=b.52&tZ=738120392&env=_ttqtt_terra
Requested by: Host: d.tailtarget.com
URL: https://d.tailtarget.com/base.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.185.99 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 99.185.102.34.bc.googleusercontent.com
Software: nginx/1.17.8 /
Resource Hash: b6f0eb134d776ca8ca590c8c555ee77aa7e6017d42d3e45d28fc834b03daf2ed

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, private, proxy-revalidate
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 13:55:03 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
server: nginx/1.17.8

GET
H3 200 ca Show response
tt-10969-0.seg.t.tailtarget.com/ 99 B
134 B 124ms
123ms Script
application/javascript 34.102.185.99
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tt-10969-0.seg.t.tailtarget.com/ca?tZ=708859050&env=_ttqtt_terra
Requested by: Host: d.tailtarget.com
URL: https://d.tailtarget.com/base.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.102.185.99 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 99.185.102.34.bc.googleusercontent.com
Software: nginx/1.17.8 /
Resource Hash: 33a63fe52d136be06ddefd4c90917cb271c7664e36bb5cd97b4b24f1bb301935

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, private, proxy-revalidate
content-encoding: gzip
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 13:55:03 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
server: nginx/1.17.8

GET
H2 200 mod-manager.min.js Show response
s1.trrsf.com/update-1726594060/fe/zaz-mod-manager/ 43 KB
11 KB 56ms
56ms Fetch
application/javascript 2a02:26f0:e300::5f64:9233
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.trrsf.com/update-1726594060/fe/zaz-mod-manager/mod-manager.min.js
Requested by: Host: reply-move-l-terraa.comercial.ws
URL: http://reply-move-l-terraa.comercial.ws/terra2/adm/update-1724276855/fe/zaz-cerebro/prd/scripts/zaz.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:e300::5f64:9233 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Terra Web Server /
Resource Hash: 1bdb9ea9ece8b286fea9bc60fe106fa3a5055e753154060dc73699d932fd681c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: max-age=315360000, stale-while-revalidate=3600, stale-if-error=864000, immutable
timing-allow-origin: *
content-encoding: br
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,OPTIONS
x-cdnterra-cache-status: MISS
access-control-allow-origin: *
content-length: 11244
date: Fri, 27 Sep 2024 13:55:03 GMT
content-type: application/javascript
last-modified: Tue, 17 Sep 2024 17:27:40 GMT
server: Terra Web Server
access-control-allow-headers: Content-Type

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 95C2 42 B
65 B 85ms
84ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssMWejsZlAXSqit3b8lLXbq-cRaUAaQOQVg_LzImiK0mne99k8HHYzeE-Iv4OH3Wn0kyJnW72xKPffgqLeIztLHZ7WJlXj1UvBXWidwlq0F3jQaJEaA2IYo8ffE_jYbqk6VkQsPTYWJmGEzWbxdIAguZFFXzhVND1b5wP3JD_H6hTZrfIgGA33yxvao2RmwcCSH&sig=Cg0ArKJSzFJ2TFrdVvsREAE&id=lidar2&mcvt=1000&p=80,651,330,951&tm=1159.4000000953674&tu=159.69999980926514&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20240925&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=3&adk=3093060894&rs=4&la=0&cr=0&vs=4&r=v&co=2337810200&rst=1727445302417&rpt=159&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 27 Sep 2024 13:55:03 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 __tt.gif
t.tailtarget.com/ 43 B
290 B 140ms
122ms Image
image/gif 34.102.185.99
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.tailtarget.com/__tt.gif?tA=TT-10969-0&tE=0&tF=&tI=_manchester_england_gb_1727445303254_3649750121&tJ=CA6935,CA4723,CA4729&tQ=bratargettecinformaticaapple,bratargetdiversidade&tU=0100007F37B9F666A206EE210240E610&tX=b.52&tY=1&tZ=178412583
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.185.99 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 99.185.102.34.bc.googleusercontent.com
Software: nginx/1.17.8 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, private, proxy-revalidate
via: 1.1 google
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 27 Sep 2024 13:55:03 GMT
content-type: image/gif
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
server: nginx/1.17.8

GET sodar
pagead2.googlesyndication.com/pagead/ 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EC35 42 B
65 B 81ms
80ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstTQn4Y9swZqKQWOEYxNYJ2nd_gt3tmgASdI-RIL7wuHwR5VseOrtfkfRjbryYqE1VTzjrgf3KQkztae7Uy59jmdLEtHBrpBrfQ7Ggxpc_6CUVJQgAQWWW-BwnGC3Dkfwc7qj8pkLgENtqv4zqkIMZZnPuWWzWwiC_TjLYboN7DmX7LMuh5fEmGNGqS_evJO-oj&sig=Cg0ArKJSzK6VoDB8WJnBEAE&id=lidar2&mcvt=1000&p=830,651,1080,951&tm=1568.9000000953674&tu=569.3000001907349&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20240925&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=3&adk=1666632028&rs=4&la=0&cr=0&vs=4&r=v&co=2337810200&rst=1727445302458&rpt=104&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 27 Sep 2024 13:55:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F349 42 B
65 B 78ms
77ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstjFELDkDB-Emyfx93ZdWdoTAQRu3eVM64CwZf8SWe_pL5sA5RANP1QWzpO8PX-PAPR0C6v9oLh_n_MY1kFzgkPwO2imCwR1rVAetUMqhFB1BMdUAHSkzldGf3lnJLQCbLGa--wcow__x_1dtPbAC0UynGyqkKS7heCq4yfS1RHFMRmboJjo61rxC0qlEjaimj0&sig=Cg0ArKJSzKmQ-R8JmP5eEAE&id=lidar2&mcvt=1002&p=80,651,330,951&tm=1637.5999999046326&tu=541.7000002861023&mtos=0,1002,1002,1002,1002&tos=0,1036,0,0,60&v=20240925&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=3&adk=1379904896&rs=4&la=0&cr=0&vs=4&r=v&co=2337810200&rst=1727445302170&rpt=235&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 27 Sep 2024 13:55:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 849D 42 B
65 B 80ms
79ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvldCE98Z3QiIyduOS7gzdq7eS9VuWzIR9oIFzcnFXsiq6k01Qpa3VI43BzM34vopttWd9UkHISFuKeWEMkw3I4-rmSQ8oMcM7smhJlQuXaw6NgED0Icy9gZSf86DXcp9mTgEoeqrRzhyFUUWr3Fponk1ecI6DBvFl0yJn9VCXhfEA-PUS_qL47loZsUcSsEO4j&sig=Cg0ArKJSzK-Z7aNhomH6EAE&id=lidar2&mcvt=1004&p=330,651,580,951&tm=1548.5&tu=111.19999980926514&mtos=0,1004,1004,1004,1437&tos=0,1004,0,0,433&v=20240925&bin=7&avms=nio&bs=1600,1200&mc=0.99&vu=1&app=0&itpl=3&adk=3310595515&rs=4&la=0&cr=0&vs=4&r=v&co=2337810200&rst=1727445302483&rpt=117&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: http://reply-move-l-terraa.comercial.ws/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 27 Sep 2024 13:55:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202409230101&jk=3603701336521198&bg=!QkGlQQ7NAAbzZSz302U7ADQBe5WfOP5wma4R7UwW5TXCVSNZIsh4Tb7uEds6GtuitrAO4x0PENO_wK5uMjVJIy9eG6XNAgAAACpSAAAAAmgBB34ANvaJxoAtSFJHKXMtgr9eKenHNw044rFUrCcFZ-qQ6Y0p_SlQAiYFDhv_I5kVJ05yfXXRh9mfLZkCnQ-UG_2NUPXWZqRgqs3SuRfsunCOf0TxA1J-S8Qx-0N34KYveQV54gD0rHNVVGs2bDsdsW1jK7MPULZC9R_RknJBzg36KoGikDH-2Squ7vjPmfOt-1m9NLwcwVMIr8J5un2GnsdNUhOyJ8SmZST09CvJJ1IkdTODYn7wcJC5n2iCKPj0mPiRRskm-Gxsr7oVTTvVvYymZAHawMaeaq5w8ua5pQ5J61eJRw4n_zTBCWzNumhJBxlwGbdlIO3UAGWUN2YwiqxQAMVufHc1ezBM_W9_YMp0jhVyIvWX3VvbHocbOVaZwFqq6nsC9SPJRRpuUDzsYRZIpKiXbvMVNwccvfAU8duNXhZPdNCv5GCx-S8XmzdL_H8HdPdsuHnyG2s0EfBN8Sx5EGN2fus25AVCnC0XPK2kos36lB1NNyPsBQhaYT006b4_T4lrSc3hMAoI5YNFMc1k8xWGyq4LfqpuS5hDRLXg_jjUtz4chrGKbchDvEc3td7koM8J6z9kPUqzOOhuEOFGZ4mMXHiu3-MB5mKgJ8dQSVOu4qiWV-zSduMIPdImZ_pexdS3MIi58ZvrOBrbKPbtwhkayagp1ALEWDRoBEiAlzqFVvuM6KSDD_c1XmqtMQR_hsHkicMZtcY1XIxsrI56HNhlzPrIKTDAmtZNLI8r9HLyMUWkhgW0yQfs08aSvqwAw4ZS4m42uHxyZmfFlKU9PjTqqLcj3gaX5pzIWmDfVOU0wPBEGxMkhgKzuZ42eqTMSuA_8AIJdpY-3updiZJoa1FgK4CZ4opBq9u8DfOVPKMicWt6GxeI7eQnJWko7ee-TxnzqMExLVJVUTyDWukE3NeFnwGAzmKu12pEKjnZli8qAYvBKT5pL_eJKF3LqlUuhh-nT-JZOA

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.comercial.ws/	1970-01-21 09:26:45	Name: _ga_S4K1JZJDZF Value: GS1.1.1727445300.1.0.1727445300.60.0.1988826942
.comercial.ws/	1969-12-31 23:59:59	Name: gvo Value: http%3A%2F%2Freply-move-l-terraa.comercial.ws%2Fterra2%2Fadm%2Findex.php%3Fid%3D9e405475-4eae-479d-8417-cb3b508cb255%7C
.comercial.ws/	1970-01-21 09:26:45	Name: _ga Value: GA1.2.1354747732.1727445301
.comercial.ws/	1970-01-20 23:50:45	Name: _gat Value: 1
reply-move-l-terraa.comercial.ws/	1970-01-20 23:50:47	Name: tt_c_vmt Value: 1727445303
reply-move-l-terraa.comercial.ws/	1970-01-20 23:50:47	Name: tt_c_c Value: direct
reply-move-l-terraa.comercial.ws/	1970-01-20 23:50:47	Name: tt_c_s Value: direct
reply-move-l-terraa.comercial.ws/	1970-01-20 23:50:47	Name: tt_c_m Value: direct
reply-move-l-terraa.comercial.ws/	1970-01-21 09:26:45	Name: _ttuu.s Value: 1727445302949
.tt-10969-0.seg.t.tailtarget.com/	1970-01-21 00:33:57	Name: trk Value: xFt8p5z7xq3XNtnckTOfDXPM2nTqFHDvK22AfFXVwvaGUF3g4FnGUksaf+rtohnnRSck4I1OkG8smHuDNPAVtQ==
.t.tailtarget.com/	1970-01-20 23:53:38	Name: _ssc Value: y
.t.tailtarget.com/	1970-01-21 08:36:21	Name: u Value: fwAAAWb2uTch7gaiEOZAAgB=
reply-move-l-terraa.comercial.ws/	1970-01-21 08:36:21	Name: tt.u Value: 0100007F37B9F666A206EE210240E610
.t.tailtarget.com/	1970-01-21 00:33:57	Name: ttbprf Value: _manchester_england_gb_1727445303254_3649750121
.t.tailtarget.com/	1970-01-20 23:50:47	Name: ttc Value: 1
.t.tailtarget.com/	1970-01-21 00:33:57	Name: ttnprf Value:
reply-move-l-terraa.comercial.ws/	1970-01-20 23:52:11	Name: tt.nprf Value:
.tt-10969-0.seg.t.tailtarget.com/	1970-01-20 23:50:48	Name: ttca Value: CA6935,CA4723,CA4729_1727445303
.t.tailtarget.com/	1970-01-21 00:33:57	Name: n Value: 1727445303

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4a781b09a2ec88ffa067740fba3ad2d3.safeframe.googlesyndication.com
b.scorecardresearch.com
b.t.tailtarget.com
d.tailtarget.com
p1.trrsf.com
pagead2.googlesyndication.com
region1.analytics.google.com
reply-move-l-terraa.comercial.ws
s1.trrsf.com
securepubads.g.doubleclick.net
static.hotjar.com
stats.g.doubleclick.net
t.tailtarget.com
tags.t.tailtarget.com
tpc.googlesyndication.com
tt-10969-0.seg.t.tailtarget.com
www.google-analytics.com
www.google.co.uk
www.googletagmanager.com
pagead2.googlesyndication.com
108.157.4.118
108.157.4.38
142.250.181.226
142.250.184.195
142.250.186.65
142.250.186.66
157.173.106.69
2001:4860:4802:34::36
2a00:1450:4001:80e::2001
2a00:1450:4001:811::200e
2a00:1450:4001:827::2001
2a00:1450:4001:82a::2008
2a00:1450:400c:c00::9c
2a02:26f0:e300::5f64:9233
2a02:26f0:e300::5f64:924a
34.102.185.99
35.201.123.184
044ebbd0a887ffce575bef7a00aa81536aea2d1f8cfa7894c1618f6101067e72
05de5c8908714cc3dc1dac9ac7659b9bd33257cc1f6b31e6990bc73e950f760a
060ea6fb0a0d34227dbb38764e0ead50d20e4db5f82df2e0db04b7fce90c0d05
1880f161170e6d2c37c221b38cc655ce5795f63cbfc428a4e6e0c52ac7acbf7a
1bdb9ea9ece8b286fea9bc60fe106fa3a5055e753154060dc73699d932fd681c
2874e66a77054edaf11e5d56f1b728772d993ad10a11de29bb3513e9f37f3df7
2be8209fa8ebaad19ffb07f96caa1c2552e50405d046aac7b0bff9bf2470e066
2c961680e1618b81e56e91ea24b45272a4a10071b83891e5e8ae41aacbc18c0c
33a63fe52d136be06ddefd4c90917cb271c7664e36bb5cd97b4b24f1bb301935
361aa05152f542b113c0fe41d1213876018d3822cf8be35f3c33c3325c141f13
36fb0d8d6b55034c41405e7f1f43f33b1f6ea30aa778768dcb6324a94cb78cd5
3c682d9d35660ae21ce151813d396a05e016e880aa9fabae6178ea48b194264a
3cfa5cd6f5141614bdad68161f1b759e3a93db9dfabe00c33f722022368e53c8
46b9f8d3285f9ea9bea3526220cf5c31bc85d848e3851a650daabe23aaaaea06
47d98326fbf1746050b15114a5215ebb14994d74e46ff2914567297a20fbf079
54930f8d5930ea73a5643b6e7cd4f3e5142609ed371fd9d1969ad38dba591ab4
5a984d0eb8e9da5e1d1b131d5fd9df54a7204d6575f74e1c8bc3d44662efc57a
635e6036f5ed2dc391350d81313627530c106ff7620bb1492f8bce820b1912f8
66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a
67fccdae17efddc3f8526e8944871040b47fe6f33471f6da6d8abf10c78f774d
6965cc9d2c66264e6e4b14391c837f870d70df730f4ce5d7d7cc4cb96c588d2b
6bdc7d7becbe58088a6e88e2991fcf1885bf42848af9a692e855b57694717abb
7007f22bb7ade02d9a8a2ff396146d18eb8fe465b4715a653717049807919aa5
71f3d8c5ab2df141b8ab9a2334c640abc0c471a2713995d39ccb7023197306a4
7293cb6c783664d5c75ba0849ebd053185c5b6f143edd54cebd773c9931f669a
79a6813135d263cc370b2be8bfaa33c3d84efc3258fc9cd125a3e4f94eadc30d
7fe5dfe9b951fe9ddee37f99254350e7bdb68d1cc2794a98a849a45aa2ca0ec1
80eecc4ca283f6b956f83048a72fdd54bf3689b539c283c3469721d99d7e4eb7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
85e4188b25b24de4bf37da81ab15a17904b787f2bbceb3599e47f9d5d5535e24
89b78d8bee0649d2669c3c50407756027c4b873383a27ce29c7c65484104c8c6
8d024882fc0a0be1957836a13cd7875b0e15a057ffd5542eca0f569cdb6779b6
8f05c230721feace4a3da1d3ed64ba613af37d718088b7ba7327a5895f8558b6
90afb74195e81e6793afa165089b5dcc5b06105443d169dd7607200556cf36da
99086e62bdecf75871885758da9ff25e5ad37ac52bc4df3e8c5518a0432f9825
99db4a43da4533df1bf084c76e0e2c8b3ea2fbe53b0c6016e8ec904db35ebed9
a68a20ead95255e7c07a40da2351f85ee78ca3db1365d1cf21c149f59cf75a10
aa3b66cc46e7b15d1cdf78e3dc02b9088bc39ed3f230eec1e0678e7e3dd6488b
aac22f498c9b91c66f4c200210a467292237de05ae4c8119aa244a555c1b77e6
b41eebd927976578d14a7bd65b11a50f1d1aad2c8d67829216f353f5795f487e
b6a2c2d3f5281e8f7c1f1a3bfa1e5f2296b55cb059f24a8c4d5a97d46b3275ce
b6f0eb134d776ca8ca590c8c555ee77aa7e6017d42d3e45d28fc834b03daf2ed
ba5f8d3b5cd5d1a9d01d0f07c1bf82b4f422d963ab1a406e2deca0074cf5f32f
bc85f834278c0cbf9809bfb7ff69e4a215fd01d427cfc70ed3ead44d8cb7982e
be6aa02c22c27b168673040e96b0bb0e978fa0a96fb51d07a6043a8eda31410b
c26476e49111380d715cfcbb4a33d5d7c474adc0f39734de6f00ce77e7143f5c
c84e1580d17203d51cf86ae25d38c994b97b318a77726aee15df98ee2a967d93
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d086be30d5f8bc168f0aefa2fdaed02c8352bcb2e3b7df32574d4cddcca33433
d64f7ed99731057d7f934c492dd86d3bde044ccb38de703fdec11a30c1b39be6
d9a7c8135615a93df41b35bf91766fbffd5419fde7896ee2990d6d2a7adb143b
dccdf122a89a2920fcfe55987a614815229d59893b2ce13fbfcf4258e71d05c9
e0205219c7e4cda93fdf2b2a59fc1c83e1e271df873a4512ba642a6ccd866bcd
e3849fdc1eab88579b20b1b56875d6ef8299c4ad165e03921400ccae69149861
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7c830884fcf4bff019e1588004e72e97fde70bbd28e94bbdea801b24f011bf9
edc3c02a5b2d68ee89e7f4fbe3645eb8f3f065a2cff0fca1de4e3df755155bbb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3d70165d1438b13b94b2aebf55f853777b6f44c8ca0b3473728bfefa90b115f
f458a36ffaa366ccb695128ad7014f03b55deb42eaef112bd6872ae27c2d4d6a
f75b19906923788d52022ce4e94e0934147e8f46f388fb3ab08c593192a9d0ec
f9a528c274b711eef7e75e59912ea81f5f4e4672d5cf02783e1e90ca89dcfab4
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

reply-move-l-terraa.comercial.ws Open in urlscan Pro 157.173.106.69 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

91 Requests

73 %HTTPS

47 %IPv6

11 Domains

19 Subdomains

18 IPs

5 Countries

2462 kBTransfer

4776 kBSize

19 Cookies

5 Outgoing links

Page URL History

Redirected requests

91 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

reply-move-l-terraa.comercial.ws Open in urlscan Pro
157.173.106.69 Public Scan

Screenshot
Live screenshot

Full Image

91
Requests

73 %
HTTPS

47 %
IPv6

11
Domains

19
Subdomains

18
IPs

5
Countries

2462 kB
Transfer

4776 kB
Size

19
Cookies

91 HTTP transactions
4 data transactions