covidliabilityinsurance.teldirectory.org Open in urlscan Pro
150.238.58.140 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://covidliabilityinsurance.teldirectory.org/
Submission: On September 14 via automatic, source certstream-urgent (September 14th 2021, 3:15:40 pm UTC) — Scanned from DE

Summary HTTP 47 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 15 IPs in 2 countries across 14 domains to perform 47 HTTP transactions. The main IP is 150.238.58.140, located in United States and belongs to SOFTLAYER, US. The main domain is covidliabilityinsurance.teldirectory.org.
TLS certificate: Issued by R3 on September 14th 2021. Valid for: 3 months.

This is the only time covidliabilityinsurance.teldirectory.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	150.238.58.140 150.238.58.140	36351 (SOFTLAYER) (SOFTLAYER)
1	99.86.4.24 99.86.4.24	16509 (AMAZON-02) (AMAZON-02)
1	13.37.56.179 13.37.56.179	16509 (AMAZON-02) (AMAZON-02)
1	206.25.68.10 206.25.68.10	3561 (CENTURYLI...) (CENTURYLINK-LEGACY-SAVVIS)
1	192.124.249.7 192.124.249.7	30148 (SUCURI-SEC) (SUCURI-SEC)
8	142.250.187.194 142.250.187.194	15169 (GOOGLE) (GOOGLE)
4	142.250.178.2 142.250.178.2	15169 (GOOGLE) (GOOGLE)
1	142.250.200.34 142.250.200.34	15169 (GOOGLE) (GOOGLE)
1	142.250.187.226 142.250.187.226	15169 (GOOGLE) (GOOGLE)
2	216.58.213.2 216.58.213.2	15169 (GOOGLE) (GOOGLE)
1	142.250.200.10 142.250.200.10	15169 (GOOGLE) (GOOGLE)
7	172.217.169.1 172.217.169.1	15169 (GOOGLE) (GOOGLE)
3	142.250.178.3 142.250.178.3	15169 (GOOGLE) (GOOGLE)
1	142.250.178.4 142.250.178.4	15169 (GOOGLE) (GOOGLE)
47	15

14 150.238.58.140 (United States)

ASN36351 (SOFTLAYER, US)
PTR: hs5.name.tools

covidliabilityinsurance.teldirectory.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
helpful.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
brainy.games	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-24.fra6.r.cloudfront.net

media.canadianunderwriter.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.37.56.179 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-37-56-179.eu-west-3.compute.amazonaws.com

media.willistowerswatson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 206.25.68.10 (United States)

ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US)

assets.ibc.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.124.249.7 (Menifee, United States)

ASN30148 (SUCURI-SEC, US)
PTR: cloudproxy10007.sucuri.net

www.millerthomson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.187.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s33-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.178.2 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s27-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.200.34 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s30-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.187.226 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s34-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.213.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s25-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.200.10 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s29-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.217.169.1 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s26-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.178.3 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s27-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.178.4 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s27-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com	233 KB
9	teldirectory.org covidliabilityinsurance.teldirectory.org	780 KB
4	doubleclick.net googleads.g.doubleclick.net	32 KB
3	gstatic.com www.gstatic.com fonts.gstatic.com	54 KB
3	helpful.me helpful.me	195 KB
2	googletagservices.com www.googletagservices.com	65 KB
2	google.com adservice.google.com www.google.com	2 KB
2	brainy.games brainy.games	6 KB
1	googleadservices.com partner.googleadservices.com	662 B
1	googleapis.com fonts.googleapis.com Failed	1 KB
1	millerthomson.com www.millerthomson.com	4 KB
1	ibc.ca assets.ibc.ca
1	willistowerswatson.com media.willistowerswatson.com	27 KB
1	canadianunderwriter.ca media.canadianunderwriter.ca	44 KB
47	14

	Domain	Requested by
9	covidliabilityinsurance.teldirectory.org	covidliabilityinsurance.teldirectory.org
8	pagead2.googlesyndication.com	covidliabilityinsurance.teldirectory.org pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
7	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
4	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
3	helpful.me	covidliabilityinsurance.teldirectory.org
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagservices.com	pagead2.googlesyndication.com googleads.g.doubleclick.net
2	brainy.games	covidliabilityinsurance.teldirectory.org
1	www.google.com	tpc.googlesyndication.com
1	www.gstatic.com	googleads.g.doubleclick.net
1	adservice.google.com	pagead2.googlesyndication.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	fonts.googleapis.com	covidliabilityinsurance.teldirectory.org googleads.g.doubleclick.net
1	www.millerthomson.com	covidliabilityinsurance.teldirectory.org
1	assets.ibc.ca	covidliabilityinsurance.teldirectory.org
1	media.willistowerswatson.com	covidliabilityinsurance.teldirectory.org
1	media.canadianunderwriter.ca	covidliabilityinsurance.teldirectory.org
47	17

This site contains links to these domains. Also see Links.

Domain
brainy.games
pixabay.com
www.canadianunderwriter.ca
www.willistowerswatson.com
www.ibc.ca
www.millerthomson.com
ncov2019.live
printplay.games
hidden.live
www.ontario.ca
twitter.com
www.instagram.com

Subject Issuer	Validity	Valid
covidliabilityinsurance.teldirectory.org R3	`2021-09-14` - `2021-12-13`	3 months	crt.sh
media.canadianunderwriter.ca Amazon	`2020-12-04` - `2022-01-02`	a year	crt.sh
media.willistowerswatson.com GlobalSign RSA OV SSL CA 2018	`2020-02-10` - `2022-02-10`	2 years	crt.sh
membersite.ibc.ca Entrust Certification Authority - L1K	`2020-07-06` - `2022-10-05`	2 years	crt.sh
millerthomson.com DigiCert SHA2 Secure Server CA	`2020-01-23` - `2022-03-24`	2 years	crt.sh
www.cologne.teldirectory.org R3	`2021-08-13` - `2021-11-11`	3 months	crt.sh
mail.brainy.games R3	`2021-08-19` - `2021-11-17`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-23` - `2021-11-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://covidliabilityinsurance.teldirectory.org/
Frame ID: C69E1C589D03AA1B1A8AC537EA6EDB5D
Requests: 28 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/zrt_lookup.html
Frame ID: CF9120322D05E07AC975098C2894CEB0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2675083994143048&output=html&h=280&slotname=7056740040&adk=2037613816&adf=2750130985&pi=t.ma~as.7056740040&w=1200&fwrn=4&fwrnh=100&lmt=1611317491&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532947&bpp=4&bdt=934&idt=82&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&correlator=1013341913261&frm=20&pv=2&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=0&ady=3484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=oSI6b6L53j&p=https%3A//covidliabilityinsurance.teldirectory.org&dtd=99
Frame ID: E19057FFE6EE440ECF273635B0D2C1D8
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2675083994143048&output=html&adk=1812271804&adf=3025194257&lmt=1611317491&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532962&bpp=1&bdt=949&idt=92&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280&nras=1&correlator=1013341913261&frm=20&pv=1&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=99
Frame ID: 4B6CC0683BBC276E452A5D4732A972F3
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/63nx1wftg6VHOR-tiT7SbUA_tgXQN9sjUf-d_JpEnTc.js
Frame ID: A8B5921F33CC54381CD4F69FB5062DB9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: CA03D0BB0ED6865C9B33C2DA3270320A
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A998FD78084CBEB6AF2D39A2DCBEFAC2
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

COVID 19 Liability Insurance

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

47
Requests

96 %
HTTPS

0 %
IPv6

14
Domains

17
Subdomains

15
IPs

2
Countries

1444 kB
Transfer

1985 kB
Size

2
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://brainy.games/
Title: Brainy Games

Search URL Search Domain Scan URL

URL: https://pixabay.com/users/geralt-9301/?utm_source=link-attribution&utm_medium=referral&utm_campaign=image&utm_content=864037
Title: Gerd Altmann

Search URL Search Domain Scan URL

URL: https://pixabay.com/?utm_source=link-attribution&utm_medium=referral&utm_campaign=image&utm_content=864037
Title: Pixabay

Search URL Search Domain Scan URL

URL: https://www.canadianunderwriter.ca/legal/how-a-liability-insurance-responds-or-not-to-covid-19-1004175448/

Search URL Search Domain Scan URL

URL: https://www.willistowerswatson.com/en-US/Insights/2020/03/will-general-liability-insurance-respond-to-covid-19-claims

Search URL Search Domain Scan URL

URL: http://www.ibc.ca/on/business/COVID-19

Search URL Search Domain Scan URL

URL: https://www.millerthomson.com/en/publications/communiques-and-updates/lloyds-brief-canadian-legal-perspectives/march-24-2020-lloyds-brief/coronavirus-covid-19-insurance-policy-issues/

Search URL Search Domain Scan URL

URL: https://ncov2019.live/#Canada
Title: COVID-19 Statistics

Search URL Search Domain Scan URL

URL: http://printplay.games/match.php
Title: Memory Matching Games

Search URL Search Domain Scan URL

URL: https://printplay.games/
Title: Free games

Search URL Search Domain Scan URL

URL: https://hidden.live/
Title: Play From Home

Search URL Search Domain Scan URL

URL: https://www.ontario.ca/form/submit-your-ideas-to-help-fight-coronavirus
Title: Ontario - Submit your ideas to help fight Coronavirus

Search URL Search Domain Scan URL

URL: https://printplay.games/bigrams.php

Search URL Search Domain Scan URL

URL: https://printplay.games/match.php

Search URL Search Domain Scan URL

URL: https://twitter.com/brainy__games

Search URL Search Domain Scan URL

URL: https://www.instagram.com/brainy.games/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

47 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
covidliabilityinsurance.teldirectory.org/ 9 KB
9 KB 393ms
124ms Document
text/html 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 38d5dbf61f36c9caab7b1700c1e1021fb8f99892f40710d5fe29418085d8eeb1

Request headers

Host: covidliabilityinsurance.teldirectory.org
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Server: nginx
Date: Tue, 14 Sep 2021 15:15:31 GMT
Content-Type: text/html
Content-Length: 8913
Connection: keep-alive
Last-Modified: Fri, 22 Jan 2021 12:11:31 GMT
Accept-Ranges: bytes

GET
H/1.1 200
OK bootstrap.min.css
covidliabilityinsurance.teldirectory.org/css/ 120 KB
120 KB 130ms
129ms Stylesheet
text/css 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/css/bootstrap.min.css
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://covidliabilityinsurance.teldirectory.org/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:59 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 122540
Content-Type: text/css

GET
H/1.1 200
OK custom.css
covidliabilityinsurance.teldirectory.org/css/ 8 KB
8 KB 391ms
133ms Stylesheet
text/css 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/css/custom.css
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 83ce7ac7d33c9337860ca3d469d9289f96cf5933d0fcf9e85e7b6e29f11c21dd

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: text/css,*/*;q=0.1
Cache-Control: no-cache
Sec-Fetch-Dest: style
Referer: https://covidliabilityinsurance.teldirectory.org/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:59 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8386
Content-Type: text/css

GET
H2 200 CRC-Legal-Supplement-Gavel.jpg
media.canadianunderwriter.ca/uploads/2018/11/ 44 KB
44 KB 82ms
13ms Image
image/jpeg 99.86.4.24
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.canadianunderwriter.ca/uploads/2018/11/CRC-Legal-Supplement-Gavel.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-24.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 177516477c9dab2e95ff7628497ccf3eb21f7e25028e7c2b6fbe97a181d06543

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:42:55 GMT
via: 1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
last-modified: Wed, 06 Feb 2019 15:42:24 GMT
server: AmazonS3
age: 12758
etag: "dd1073f432882aea6088f9840771036c"
x-cache: Hit from cloudfront
content-type: image/jpeg
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 44809
x-amz-cf-id: d-KjQvIFcnNGZ_f_O6Q8zCM1C83ZDFytXau0ZadijWTVJWjQgc60iw==

GET
H2 200 Covid19_2880x1800.png
media.willistowerswatson.com/-/media/WTW/Content-Hubs-and-Trending-Topics/ 27 KB
27 KB 93ms
29ms Image
image/webp 13.37.56.179
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.willistowerswatson.com/-/media/WTW/Content-Hubs-and-Trending-Topics/Covid19_2880x1800.png?modified=20200324190728&imgeng=meta_true&la=en-US&h=776&w=1242&mw=1242&hash=E42AA370E153430F5D9D9E36911AEA9FFEEC9B93

Requested by

Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.37.56.179 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-37-56-179.eu-west-3.compute.amazonaws.com

Software

ScientiaMobile ImageEngine /

Resource Hash

b3c82f4c17269b6a8bc9eb90807c93d02ebbcd6b38731839d24f1629bcd208b7

Security Headers

Name	Value
Content-Security-Policy	default-src https: *.willistowerswatson data: blob: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src https: *.willistowerswatson data: blob: 'unsafe-eval' 'unsafe-inline'
via: 1.1 varnish (Varnish/6.5)
etag: "0570a5cae6cff974f2f3720a07c23fbc-667e3b1a1d537c3d596facd2a88af5bd"
age: 5277561
x-ie-cache: HIT
content-disposition: inline; filename="Covid19_2880x1800.png"
strict-transport-security: max-age=31536000; includeSubDomains
content-length: 27352
x-xss-protection: 1; mode=block
last-modified: Mon, 06 Apr 2020 18:39:15 GMT
server: ScientiaMobile ImageEngine
x-frame-options: SAMEORIGIN
date: Tue, 14 Sep 2021 15:15:32 GMT
vary: Origin,Dpr,User-Agent,Sec-Fetch-Dest,Width,Viewport-Width,Save-Data,Accept
content-type: image/webp
imgeng-hash: 667e3b1a1d537c3d596facd2a88af5bd
cache-control: public, max-age=28439824, s-maxage=29109471
imgeng-img-status: optimized
accept-ranges: bytes

GET
H/1.1 404
Not Found AUTO__0002_claims%20process.jpg
assets.ibc.ca/PublishingImages/Auto%20Insurance/Icons/ 0
0 1531ms
110ms Image
text/html 206.25.68.10
CENTURYLINK-LEGAC...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ibc.ca/PublishingImages/Auto%20Insurance/Icons/AUTO__0002_claims%20process.jpg?RenditionID=9
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 206.25.68.10 , United States, ASN3561 (CENTURYLINK-LEGACY-SAVVIS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H2 200 logo.svg
www.millerthomson.com/wp-content/themes/millerthomson/img/ 12 KB
4 KB 91ms
8ms Image
image/svg+xml 192.124.249.7
SUCURI-SEC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.millerthomson.com/wp-content/themes/millerthomson/img/logo.svg

Requested by

Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.124.249.7 Menifee, United States, ASN30148 (SUCURI-SEC, US),

Reverse DNS

cloudproxy10007.sucuri.net

Software

nginx /

Resource Hash

3bc88fe5cc25751aa4fb918814b5474c155c702bee00b0c36e4478e8239e10c4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-sucuri-cache: HIT
content-length: 3867
x-xss-protection: 1; mode=block
referrer-policy: unsafe-url
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=315360000
x-sucuri-id: 15007
content-security-policy: upgrade-insecure-requests;
accept-ranges: bytes
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK kssh.jpg
helpful.me/images/ 24 KB
24 KB 525ms
257ms Image
image/jpeg 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://helpful.me/images/kssh.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 9226a118dee5890ba68c870ad0dcab9de47a78c395a33afb43638748142478bd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Thu, 26 Mar 2020 23:29:44 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24190
Content-Type: image/jpeg

GET
H/1.1 200
OK ppg.jpg
helpful.me/images/ 78 KB
78 KB 533ms
264ms Image
image/jpeg 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://helpful.me/images/ppg.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 19101d1e2f2192e9e89bbbe25e9fc7fe5d24d8bba8647db97bc6cd8d50920d34

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Thu, 26 Mar 2020 23:35:54 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 79996
Content-Type: image/jpeg

GET
H/1.1 200
OK 3wb.jpg
helpful.me/images/ 93 KB
93 KB 518ms
259ms Image
image/jpeg 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://helpful.me/images/3wb.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 9729a6ade9ea8d1c873851d125643696e07c01bdee833b1831fa40e7ec258b57

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Fri, 27 Mar 2020 14:46:48 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 94987
Content-Type: image/jpeg

GET
H/1.1 200
OK tw.jpg
brainy.games/ 3 KB
3 KB 402ms
130ms Image
image/jpeg 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brainy.games/tw.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 06304820c87d64d081d9ac38e48892b25eec8cfe78648e6e69c0d0d75638a35c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 11 Mar 2020 12:22:42 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2640
Content-Type: image/jpeg

GET
H/1.1 200
OK ig.jpg
brainy.games/ 3 KB
3 KB 403ms
129ms Image
image/jpeg 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://brainy.games/ig.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 2e712cf691ccc017a471574279eaf6621d357bc29c3fe183f6f2473914c32eab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 11 Mar 2020 12:20:08 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3222
Content-Type: image/jpeg

GET
H/1.1 200
OK jquery-1.11.3.min.js Show response
covidliabilityinsurance.teldirectory.org/js/ 94 KB
94 KB 516ms
260ms Script
application/javascript 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/js/jquery-1.11.3.min.js
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://covidliabilityinsurance.teldirectory.org/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:57 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 95957
Content-Type: application/javascript

GET
H/1.1 200
OK bootstrap.min.js Show response
covidliabilityinsurance.teldirectory.org/js/ 36 KB
36 KB 513ms
258ms Script
application/javascript 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/js/bootstrap.min.js
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://covidliabilityinsurance.teldirectory.org/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:56 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 36816
Content-Type: application/javascript

GET
H/1.1 200
OK jquery.easing.min.js Show response
covidliabilityinsurance.teldirectory.org/js/ 5 KB
6 KB 389ms
133ms Script
application/javascript 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/js/jquery.easing.min.js
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: ecfc183e33d25d24aa7c06218e0a413488fff8774e4b4b87543c766db9b0b8ba

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://covidliabilityinsurance.teldirectory.org/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:57 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5564
Content-Type: application/javascript

GET
H/1.1 200
OK custom.js Show response
covidliabilityinsurance.teldirectory.org/js/ 79 B
300 B 388ms
132ms Script
application/javascript 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/js/custom.js
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: 8aaee4d6282fe9fb122b24017bbea1e7bd5d3f2bbc1eceddd89092e3ffa913ff

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: script
Referer: https://covidliabilityinsurance.teldirectory.org/
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:56 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 79
Content-Type: application/javascript

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 136 KB
48 KB 126ms
75ms Script
text/javascript 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

cafe /

Resource Hash

1947bbfa54a1079d10e73adaccdcc21952faa0d6d5929e567eee24f902076fd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48927
x-xss-protection: 0
server: cafe
etag: 6340949852821719840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 14 Sep 2021 15:15:32 GMT

GET css
fonts.googleapis.com/ 0
0

GET
H/1.1 200
OK header.jpg
covidliabilityinsurance.teldirectory.org/images/ 489 KB
489 KB 130ms
130ms Image
image/jpeg 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://covidliabilityinsurance.teldirectory.org/images/header.jpg
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/css/custom.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: aa09b335a465dc74cdcd197c08b1f495c80b02a9e7c6cddd19189d979ecc1809

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://covidliabilityinsurance.teldirectory.org/css/custom.css
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/css/custom.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:42:00 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 500386
Content-Type: image/jpeg

GET
H/1.1 200
OK glyphicons-halflings-regular.woff2
covidliabilityinsurance.teldirectory.org/fonts/ 18 KB
18 KB 132ms
131ms Font
font/woff2 150.238.58.140
SOFTLAYER

General

Check archive.org

Show headers Download Go to

Full URL: https://covidliabilityinsurance.teldirectory.org/fonts/glyphicons-halflings-regular.woff2
Requested by: Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/css/bootstrap.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 150.238.58.140 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS: hs5.name.tools
Software: nginx /
Resource Hash: fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Origin: https://covidliabilityinsurance.teldirectory.org
Accept-Encoding: gzip, deflate, br
Host: covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: font
Referer: https://covidliabilityinsurance.teldirectory.org/css/bootstrap.min.css
Connection: keep-alive
Referer: https://covidliabilityinsurance.teldirectory.org/css/bootstrap.min.css
Origin: https://covidliabilityinsurance.teldirectory.org
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Tue, 14 Sep 2021 15:15:32 GMT
Last-Modified: Wed, 24 Jun 2020 08:41:58 GMT
Server: nginx
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18028
Content-Type: font/woff2

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/ 251 KB
93 KB 42ms
41ms Script
text/javascript 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

cafe /

Resource Hash

e43fa40c6832cda017315748d54516cc55c2d4785529f682248cd1f474389f3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 94967
x-xss-protection: 0
server: cafe
etag: 3426842561966430038
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Tue, 14 Sep 2021 15:15:32 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/ Frame CF91 10 KB
5 KB 90ms
25ms Document
text/html 142.250.178.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210908/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.178.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f2.1e100.net

Software

cafe /

Resource Hash

bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210908/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://covidliabilityinsurance.teldirectory.org/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Mon, 13 Sep 2021 18:19:09 GMT
expires: Mon, 27 Sep 2021 18:19:09 GMT
content-type: text/html; charset=UTF-8
etag: 13836150016441684253
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4591
x-xss-protection: 0
age: 75384
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 206 B
662 B 103ms
39ms Script
text/javascript 142.250.200.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=covidliabilityinsurance.teldirectory.org&callback=_gfp_s_&client=ca-pub-2675083994143048

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.200.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s30-in-f2.1e100.net

Software

cafe /

Resource Hash

5e9a7edaf6306dc69b8da88eec7307255d1a282f0f8fae79ff351e4be2d2da22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 196
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 86ms
27ms Script
application/javascript 142.250.187.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=covidliabilityinsurance.teldirectory.org

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.187.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s34-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 14 Sep 2021 15:15:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E190 81 KB
27 KB 263ms
263ms Document
text/html 142.250.178.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2675083994143048&output=html&h=280&slotname=7056740040&adk=2037613816&adf=2750130985&pi=t.ma~as.7056740040&w=1200&fwrn=4&fwrnh=100&lmt=1611317491&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532947&bpp=4&bdt=934&idt=82&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&correlator=1013341913261&frm=20&pv=2&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=0&ady=3484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=oSI6b6L53j&p=https%3A//covidliabilityinsurance.teldirectory.org&dtd=99

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.178.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f2.1e100.net

Software

cafe /

Resource Hash

904695805d0784e45f3b48586ed7d49143ee70c3d912b3c91eab060abb4c0a03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2675083994143048&output=html&h=280&slotname=7056740040&adk=2037613816&adf=2750130985&pi=t.ma~as.7056740040&w=1200&fwrn=4&fwrnh=100&lmt=1611317491&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532947&bpp=4&bdt=934&idt=82&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&correlator=1013341913261&frm=20&pv=2&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=0&ady=3484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=oSI6b6L53j&p=https%3A//covidliabilityinsurance.teldirectory.org&dtd=99
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://covidliabilityinsurance.teldirectory.org/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Tue, 14 Sep 2021 15:15:33 GMT
server: cafe
content-length: 27238
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 14-Sep-2021 15:30:33 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 14 Sep 2021 15:15:33 GMT
cache-control: private

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
28 KB 79ms
29ms Script
text/javascript 216.58.213.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.213.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s25-in-f2.1e100.net

Software

sffe /

Resource Hash

74696de7db3cfc983f841facfdca75dbf4c114af467b05e23fe6d95694cab0fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27627
x-xss-protection: 0
server: sffe
etag: "1631273431406706"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 14 Sep 2021 15:15:33 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&tn=NAV&id=siteNav&cls=navbar%20navbar-default%20navbar-fixed-top%20affix-top&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: covidliabilityinsurance.teldirectory.org
URL: https://covidliabilityinsurance.teldirectory.org/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Sep 2021 15:15:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4B6C 0
19 B 58ms
32ms Document
text/html 142.250.178.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2675083994143048&output=html&adk=1812271804&adf=3025194257&lmt=1611317491&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532962&bpp=1&bdt=949&idt=92&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280&nras=1&correlator=1013341913261&frm=20&pv=1&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=99

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.178.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-2675083994143048&output=html&adk=1812271804&adf=3025194257&lmt=1611317491&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532962&bpp=1&bdt=949&idt=92&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280&nras=1&correlator=1013341913261&frm=20&pv=1&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=99
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://covidliabilityinsurance.teldirectory.org/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Tue, 14 Sep 2021 15:15:33 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Tue, 14-Sep-2021 15:30:33 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 14 Sep 2021 15:15:33 GMT
cache-control: private

GET
H2 200 css
fonts.googleapis.com/ Frame E190 3 KB
1 KB 111ms
37ms Stylesheet
text/css 142.250.200.10
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2675083994143048&output=html&h=280&slotname=7056740040&adk=2037613816&adf=2750130985&pi=t.ma~as.7056740040&w=1200&fwrn=4&fwrnh=100&lmt=1611317491&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532947&bpp=4&bdt=934&idt=82&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&correlator=1013341913261&frm=20&pv=2&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=0&ady=3484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=oSI6b6L53j&p=https%3A//covidliabilityinsurance.teldirectory.org&dtd=99

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.200.10 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s29-in-f10.1e100.net

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 14 Sep 2021 13:15:35 GMT
server: ESF
date: Tue, 14 Sep 2021 15:15:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 14 Sep 2021 15:15:33 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210909/r20110914/client/ Frame E190 1 KB
937 B 87ms
35ms Script
text/javascript 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210909/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

cafe /

Resource Hash

5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:13:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 830
x-xss-protection: 0
server: cafe
etag: 3558876194914413708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Sep 2021 15:13:06 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E190 0
0 32ms
32ms Fetch
text/html 142.250.178.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CgroElbxAYbLnBIOG1fAPuuO1oALN4-C3ZPvp0vuoDvzBtauuARABINSK1Apg-QWgAb2QgN4CyAEJqAMByAPLBKoE9gFP0KVyEL6zSzOxrloS2FJIO7NjEldIBNMSQHXLBITFQC2i9deqnQPbVp9Ln7HcvlgDCyG6Pao6omLvLhwDNp8Spc2gvJHa3cVM8qPvOmMNDFxhzXChHAkUAt94ue7n6ABuPKottxKsK_LpHlGfWdDm1o0sYd10t7cfQPp1c0VBGQQFTGnglWufj4rZwCUPEDFwN2DH_4dmioYNTYyFtRap41sJBYoSe4Q31rDnc3VQmNtdozkuk06LID-nwZ1eD_6KfBqQhVg2fCDEtJRezLfAhJ73Bq9wKBy_OKLtYBeX8AcloKMfcrKuOKYD7HCBlNlJJNRuwrHABPf35KbfA5IFBAgEGAGSBQQIBRgEoAYugAer7_-hAagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQhtIL0ggHCIBhEAEYH4AKAcgLAbgTiCfYEw2IFAHQFQGAFwGyFxwKGggAEhRwdWItMjY3NTA4Mzk5NDE0MzA0OBgA&sigh=ZCw94LQ_rPU&template_id=5000

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.178.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2675083994143048&output=html&h=280&slotname=7056740040&adk=2037613816&adf=2750130985&pi=t.ma~as.7056740040&w=1200&fwrn=4&fwrnh=100&lmt=1611317491&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fcovidliabilityinsurance.teldirectory.org%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1631632532947&bpp=4&bdt=934&idt=82&shv=r20210908&mjsv=m202109130101&ptt=9&saldr=aa&abxe=1&correlator=1013341913261&frm=20&pv=2&ga_vid=379010791.1631632533&ga_sid=1631632533&ga_hid=56081131&ga_fc=0&u_tz=0&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&adx=0&ady=3484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062519%2C44748552%2C31062297&oid=3&pvsid=3900636634860461&pem=388&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=oSI6b6L53j&p=https%3A//covidliabilityinsurance.teldirectory.org&dtd=99
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 14 Sep 2021 15:15:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Tue, 14 Sep 2021 15:15:33 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210909/r20110914/ Frame E190 18 KB
8 KB 61ms
19ms Script
text/javascript 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210909/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

cafe /

Resource Hash

cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:14:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7641
x-xss-protection: 0
server: cafe
etag: 14368791910870210898
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Sep 2021 15:14:47 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210909/r20110914/client/ Frame E190 2 KB
1 KB 77ms
35ms Script
text/javascript 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210909/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Sep 2021 15:15:22 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E190 125 KB
38 KB 69ms
36ms Script
text/javascript 216.58.213.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.213.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s25-in-f2.1e100.net

Software

sffe /

Resource Hash

1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:33 GMT
content-encoding: gzip
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
server: sffe
etag: "1631273423644667"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
x-content-type-options: nosniff
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38649
x-xss-protection: 0
expires: Tue, 14 Sep 2021 15:15:33 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210909/r20110914/client/ Frame E190 14 KB
6 KB 64ms
22ms Script
text/javascript 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210909/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

cafe /

Resource Hash

114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:12:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6183
x-xss-protection: 0
server: cafe
etag: 901432759052127119
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 28 Sep 2021 15:12:38 GMT

GET
H2 200 8b8c639f95e935c054a6465040a495ee.js Show response
www.gstatic.com/mysidia/ Frame E190 26 KB
11 KB 95ms
25ms Script
text/javascript 142.250.178.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8b8c639f95e935c054a6465040a495ee.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.178.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f3.1e100.net

Software

sffe /

Resource Hash

42dc9aece188c290c3303813e9f91c1d596f1267899f3b3357280be43c16ab53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 12:57:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 526666
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10883
x-xss-protection: 0
last-modified: Fri, 03 Sep 2021 02:45:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 07 Dec 2021 12:57:47 GMT

GET
H2 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/1807451510717720593/ Frame E190 29 KB
29 KB 75ms
35ms Image
image/jpeg 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1807451510717720593/downsize_200k_v1?w=600&h=314

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

sffe /

Resource Hash

ba7d36604fcc8a9d88e1d6a7493a5c169000b0dac9a9ad2c5e6dcd0feb5cfe6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 11:34:51 GMT
x-content-type-options: nosniff
age: 13242
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29712
x-xss-protection: 0
last-modified: Thu, 12 Aug 2021 15:26:28 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 11:34:51 GMT

GET
DATA 200
OK truncated
/ Frame E190 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 386ba437e826700e717a26173aa9e192fb08efecc99925a411a3ebd2a1c218d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame E190 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 212b9f1ebe88c6dc355f3b42fa5c5c6a0a7a4de698e476e57745093076c22e3d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame E190 21 KB
22 KB 69ms
19ms Font
font/woff2 142.250.178.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.178.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f3.1e100.net

Software

sffe /

Resource Hash

1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 17:11:53 GMT
x-content-type-options: nosniff
age: 165820
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21660
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:07:18 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 12 Sep 2022 17:11:53 GMT

GET
H2 200 4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
fonts.gstatic.com/s/googlesans/v36/ Frame E190 21 KB
21 KB 86ms
37ms Font
font/woff2 142.250.178.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.178.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f3.1e100.net

Software

sffe /

Resource Hash

c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 08:12:57 GMT
x-content-type-options: nosniff
age: 25356
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21424
x-xss-protection: 0
last-modified: Wed, 01 Sep 2021 18:08:24 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 08:12:57 GMT

GET
H3 200 63nx1wftg6VHOR-tiT7SbUA_tgXQN9sjUf-d_JpEnTc.js Show response
pagead2.googlesyndication.com/bg/ Frame A8B5 35 KB
13 KB 28ms
28ms Script
text/javascript 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/63nx1wftg6VHOR-tiT7SbUA_tgXQN9sjUf-d_JpEnTc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

sffe /

Resource Hash

eb79f1d707ed83a547391fad893ed26d403fb605d037db2351ff9dfc9a449d37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 19:41:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 588815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13458
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 19:41:58 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 66ms
40ms XHR
application/json 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210908&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

cafe /

Resource Hash

10ff3ef8193beb1f8b73fcc19f13a211d29f7938a50f5cc893c850609a05480e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 14 Sep 2021 15:15:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8559
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 143ms
33ms Script
text/javascript 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109130101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 15:15:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
expires: Tue, 14 Sep 2021 15:15:33 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame CA03 12 KB
5 KB 20ms
20ms Document
text/html 172.217.169.1
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.169.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f1.1e100.net

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://covidliabilityinsurance.teldirectory.org/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5029
date: Tue, 14 Sep 2021 14:48:16 GMT
expires: Wed, 14 Sep 2022 14:48:16 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1637
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame A998 783 B
1 KB 79ms
27ms Document
text/html 142.250.178.4
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.178.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s27-in-f4.1e100.net

Software

GSE /

Resource Hash

c0e5591db15a256d0662bdf60c01b4ee9343744daca159f051d7945727d3343d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DQVtKTrUffx7NWyFRAVkiQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://covidliabilityinsurance.teldirectory.org/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/

Response headers

expires: Tue, 14 Sep 2021 15:15:33 GMT
date: Tue, 14 Sep 2021 15:15:33 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-DQVtKTrUffx7NWyFRAVkiQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 63nx1wftg6VHOR-tiT7SbUA_tgXQN9sjUf-d_JpEnTc.js Show response
pagead2.googlesyndication.com/bg/ Frame CA03 35 KB
13 KB 29ms
28ms Script
text/javascript 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/63nx1wftg6VHOR-tiT7SbUA_tgXQN9sjUf-d_JpEnTc.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

sffe /

Resource Hash

eb79f1d707ed83a547391fad893ed26d403fb605d037db2351ff9dfc9a449d37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 19:41:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 588815
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13458
x-xss-protection: 0
last-modified: Mon, 06 Sep 2021 10:38:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 07 Sep 2022 19:41:58 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame A998 0
0 70ms
70ms Image
text/html 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20210908&jk=3900636634860461&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.187.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lhr25s33-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
41ms Image
image/gif 142.250.187.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20210908&jk=3900636634860461&bg=!g4ClgMTNAAYT0U73E9E7ACkAdvg8WjoS9rU_16YaERwewVP8XqoK4Q8lSMSaGBaRx6txjQwiTNVHlwIAAACeUgAAAApoAQeZApdDfGiNq0XSQ4QywQ6DCaiv1cV2y4jCAwPRERgqf9u4onCpVv_iCaetIeACLziEiYloBEfeJl_huBD4bzPf4Bhe-gxYPFSeKwANaMxoq8O_9vvD2_uSG5px_rkP1JWx9JIHVyIgAoDNv3lG2NW7JA7QaetwezH0QgEQlyXI4uZM_73hrYyZwMCnjUED0kVS0xb-_Wft2p3fbsXWPp31oqdhzccAk0DAv2XtHeMkYSRUHb4swX3z23Tz2G84xFEbam62OvNsIecuKvfq6BuESz31w4jAkcLY72QWA6wlIAiu8vrcoQurpUfLkE_bD3uaqypZxiU4T_pzWNMmD-S70hdX-3ATZ-B7q5N8s-Ol3Sgeojc97soEFFJ_1WMm-jql8qJsXBhPWTQl_svjYgFpfq2UmDGTMTywHCkfMWKxHZTZLbkZwrmJWhZp_S7weMqBKcacTu61dXeefwU7uZaJxGmSXdU8VdjLNq-P6fY1Eb-AvJoahclL2tlnNGFi9QCDoYyLlnI7xhk2G1_YnCZkc4b8xnkJwfEaHcnDOvuDaArTP-xLKGfR8jDZ9pz22TJKTGEu7wQKrc3XpwLAGGT6Hc1M-VSdVyIpZouMVXkIGW9aGhjfp2cG4M0T8EYZw4fPt5zaQ1-sb7-h9UDApcX2tv4V-zvepyyQqdDiR1Zi7yOkYj7Gk_IYSY2pHZZ9e5AGzb4GmlYR5XmVIFoTb6L0h3FTuNoQb3YqJLLwO0fgQ21JA_7K85dx06MCYFKb5yAq5THq7wUjuSGMgtBlHj7OH2Mdw-RIjSntW3p_idsM6UJ3ESKInDXnPV7C2NW5HyHF0tO5RFCdA1wKNWyM05tNJs1QG9Ya9XanrLthdje_GB77Gbxvx1SfYTQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://covidliabilityinsurance.teldirectory.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 14 Sep 2021 15:15:34 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Verdicts & Comments Add Verdict or Comment

52 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.teldirectory.org/	1970-01-20 06:35:28	Name: __gads Value: ID=474d3c51506a8eb9-22409e321dcb00ef:T=1631632533:RT=1631632533:S=ALNI_MauHENwrG3Jq0s0fypU8lnGlsrAiA
			.doubleclick.net/	1970-01-20 14:45:04	Name: IDE Value: AHWqTUnDmZFWP86iPWjtUdc_M8u_vnX_rapZfw6HymQwWBJasqikvuvnzldM3HOpP5w

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://covidliabilityinsurance.teldirectory.org/(Line 6) Message: Mixed Content: The page at 'https://covidliabilityinsurance.teldirectory.org/' was loaded over HTTPS, but requested an insecure element 'http://assets.ibc.ca/PublishingImages/Auto%20Insurance/Icons/AUTO__0002_claims%20process.jpg?RenditionID=9'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://covidliabilityinsurance.teldirectory.org/(Line 32) Message: Mixed Content: The page at 'https://covidliabilityinsurance.teldirectory.org/' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800'. This request has been blocked; the content must be served over HTTPS.
security	warning	URL: https://covidliabilityinsurance.teldirectory.org/ Message: Mixed Content: The page at 'https://covidliabilityinsurance.teldirectory.org/' was loaded over HTTPS, but requested an insecure element 'http://assets.ibc.ca/PublishingImages/Auto%20Insurance/Icons/AUTO__0002_claims%20process.jpg?RenditionID=9'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network	error	URL: https://assets.ibc.ca/PublishingImages/Auto%20Insurance/Icons/AUTO__0002_claims%20process.jpg?RenditionID=9 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
assets.ibc.ca
brainy.games
covidliabilityinsurance.teldirectory.org
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
helpful.me
media.canadianunderwriter.ca
media.willistowerswatson.com
pagead2.googlesyndication.com
partner.googleadservices.com
tpc.googlesyndication.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.millerthomson.com
fonts.googleapis.com
13.37.56.179
142.250.178.2
142.250.178.3
142.250.178.4
142.250.187.194
142.250.187.226
142.250.200.10
142.250.200.34
150.238.58.140
172.217.169.1
192.124.249.7
206.25.68.10
216.58.213.2
99.86.4.24
06304820c87d64d081d9ac38e48892b25eec8cfe78648e6e69c0d0d75638a35c
10ff3ef8193beb1f8b73fcc19f13a211d29f7938a50f5cc893c850609a05480e
114dabe187311ee2e303549831223ef80d06385cb854e2aa1647ec1e0ca148f5
177516477c9dab2e95ff7628497ccf3eb21f7e25028e7c2b6fbe97a181d06543
19101d1e2f2192e9e89bbbe25e9fc7fe5d24d8bba8647db97bc6cd8d50920d34
1947bbfa54a1079d10e73adaccdcc21952faa0d6d5929e567eee24f902076fd1
1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d
1b6abcd01d2337e70b8fdde5a150175d2d4a3231d464e25b9cbdb5bac2bfcd2c
212b9f1ebe88c6dc355f3b42fa5c5c6a0a7a4de698e476e57745093076c22e3d
2e712cf691ccc017a471574279eaf6621d357bc29c3fe183f6f2473914c32eab
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb
386ba437e826700e717a26173aa9e192fb08efecc99925a411a3ebd2a1c218d5
38d5dbf61f36c9caab7b1700c1e1021fb8f99892f40710d5fe29418085d8eeb1
3bc88fe5cc25751aa4fb918814b5474c155c702bee00b0c36e4478e8239e10c4
42dc9aece188c290c3303813e9f91c1d596f1267899f3b3357280be43c16ab53
4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5d1f3a4ee5a02abdbc66a11aad769dd81cbe4d07f0b3799ff0940ad7b7d6cc1a
5e9a7edaf6306dc69b8da88eec7307255d1a282f0f8fae79ff351e4be2d2da22
74696de7db3cfc983f841facfdca75dbf4c114af467b05e23fe6d95694cab0fa
83ce7ac7d33c9337860ca3d469d9289f96cf5933d0fcf9e85e7b6e29f11c21dd
8aaee4d6282fe9fb122b24017bbea1e7bd5d3f2bbc1eceddd89092e3ffa913ff
904695805d0784e45f3b48586ed7d49143ee70c3d912b3c91eab060abb4c0a03
9226a118dee5890ba68c870ad0dcab9de47a78c395a33afb43638748142478bd
9729a6ade9ea8d1c873851d125643696e07c01bdee833b1831fa40e7ec258b57
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
aa09b335a465dc74cdcd197c08b1f495c80b02a9e7c6cddd19189d979ecc1809
b3c82f4c17269b6a8bc9eb90807c93d02ebbcd6b38731839d24f1629bcd208b7
b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11
ba7d36604fcc8a9d88e1d6a7493a5c169000b0dac9a9ad2c5e6dcd0feb5cfe6b
bf5230ffb8745d28c11ae8b743868364f9be8379300bd59d235f402a53ea96ee
c0e5591db15a256d0662bdf60c01b4ee9343744daca159f051d7945727d3343d
c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f
cc4cb1016499eb5d88379d9cdf358b0083b7c1b80f00889ce86649a88c746e10
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43fa40c6832cda017315748d54516cc55c2d4785529f682248cd1f474389f3e
eb79f1d707ed83a547391fad893ed26d403fb605d037db2351ff9dfc9a449d37
ecb916133a9376911f10bc5c659952eb0031e457f5df367cde560edbfba38fb8
ecfc183e33d25d24aa7c06218e0a413488fff8774e4b4b87543c766db9b0b8ba
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

covidliabilityinsurance.teldirectory.org Open in urlscan Pro 150.238.58.140 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

47 Requests

96 %HTTPS

0 %IPv6

14 Domains

17 Subdomains

15 IPs

2 Countries

1444 kBTransfer

1985 kBSize

2 Cookies

16 Outgoing links

Redirected requests

47 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

covidliabilityinsurance.teldirectory.org Open in urlscan Pro
150.238.58.140 Public Scan

Screenshot
Live screenshot

Full Image

47
Requests

96 %
HTTPS

0 %
IPv6

14
Domains

17
Subdomains

15
IPs

2
Countries

1444 kB
Transfer

1985 kB
Size

2
Cookies

47 HTTP transactions
2 data transactions