www.bagborroworsteal.com Open in urlscan Pro
162.242.193.45 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_15&ems_l=8697087&i=1&d=NDIzMDExNDc5%7CWlRXRFo1Tko0OA%3D%3...
Effective URL:
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Submission: On July 06 via api (July 6th 2021, 12:31:20 pm UTC) from US

Summary HTTP 51 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 21 IPs in 6 countries across 15 domains to perform 51 HTTP transactions. The main IP is 162.242.193.45, located in United States and belongs to RACKSPACE, US. The main domain is www.bagborroworsteal.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on May 26th 2020. Valid for: 2 years.

This is the only time www.bagborroworsteal.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	217.175.192.21 217.175.192.21	1764 (NEXTLAYER-AS) (NEXTLAYER-AS)
2 4	162.242.193.45 162.242.193.45	27357 (RACKSPACE) (RACKSPACE)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
10	93.184.220.20 93.184.220.20	15133 (EDGECAST) (EDGECAST)
1	143.204.98.44 143.204.98.44	16509 (AMAZON-02) (AMAZON-02)
2	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
2	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
10	185.32.241.65 185.32.241.65	30286 (THM) (THM)
1	2600:9000:215... 2600:9000:2156:bc00:0:43cc:80:93a1	16509 (AMAZON-02) (AMAZON-02)
6	143.204.98.59 143.204.98.59	16509 (AMAZON-02) (AMAZON-02)
1	52.202.92.254 52.202.92.254	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM)
51	21

1 217.175.192.21 (Austria)

ASN1764 (NEXTLAYER-AS, AT)

visit.bagborroworsteal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 162.242.193.45 (United States) 2 redirects

ASN27357 (RACKSPACE, US)

www.bagborroworsteal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 93.184.220.20 (London, United Kingdom)

ASN15133 (EDGECAST, US)

secure.avelleassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-44.fra50.r.cloudfront.net

cdn-scripts.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

seal-alaskaoregonwesternwashington.bbb.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 185.32.241.65 (United States)

ASN30286 (THM, US)

imgs.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:bc00:0:43cc:80:93a1 (United States)

ASN16509 (AMAZON-02, US)

iprecon.iglobalstores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 143.204.98.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-59.fra50.r.cloudfront.net

d1vyngmisxigjx.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.202.92.254 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-92-254.compute-1.amazonaws.com

checkout.iglobalstores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (United States)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (United States)

ASN30286 (THM, US)

w2txo5aawptvx6wza6crxs3gbekdvrergnh2wgho19a670ccf3847122am1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	signifyd.com cdn-scripts.signifyd.com imgs.signifyd.com	81 KB
10	avelleassets.com secure.avelleassets.com	128 KB
6	cloudfront.net d1vyngmisxigjx.cloudfront.net	20 KB
5	bagborroworsteal.com 2 redirects visit.bagborroworsteal.com www.bagborroworsteal.com	34 KB
3	online-metrix.net h.online-metrix.net w2txo5aawptvx6wza6crxs3gbekdvrergnh2wgho19a670ccf3847122am1.e.aa.online-metrix.net	15 KB
3	google.de www.google.de	235 B
3	google.com 1 redirects www.google.com	256 B
3	doubleclick.net 1 redirects googleads.g.doubleclick.net stats.g.doubleclick.net	1 KB
2	iglobalstores.com iprecon.iglobalstores.com checkout.iglobalstores.com	12 KB
2	google-analytics.com www.google-analytics.com	19 KB
2	googleadservices.com www.googleadservices.com	18 KB
2	bbb.org seal-alaskaoregonwesternwashington.bbb.org	3 KB
1	gstatic.com fonts.gstatic.com	28 KB
1	googleapis.com fonts.googleapis.com	591 B
0	Failed function sub() { [native code] }. Failed
51	15

	Domain	Requested by
10	imgs.signifyd.com	cdn-scripts.signifyd.com imgs.signifyd.com www.bagborroworsteal.com
10	secure.avelleassets.com	www.bagborroworsteal.com
6	d1vyngmisxigjx.cloudfront.net	www.bagborroworsteal.com
4	www.bagborroworsteal.com	2 redirects www.bagborroworsteal.com
3	www.google.de	www.bagborroworsteal.com
3	www.google.com	1 redirects www.bagborroworsteal.com
2	h.online-metrix.net	imgs.signifyd.com
2	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
2	www.google-analytics.com	www.bagborroworsteal.com www.google-analytics.com
2	www.googleadservices.com	www.bagborroworsteal.com www.googleadservices.com
2	seal-alaskaoregonwesternwashington.bbb.org	www.bagborroworsteal.com
1	w2txo5aawptvx6wza6crxs3gbekdvrergnh2wgho19a670ccf3847122am1.e.aa.online-metrix.net
1	stats.g.doubleclick.net	www.google-analytics.com
1	checkout.iglobalstores.com	www.bagborroworsteal.com
1	iprecon.iglobalstores.com	secure.avelleassets.com
1	fonts.gstatic.com	fonts.googleapis.com
1	cdn-scripts.signifyd.com	www.bagborroworsteal.com
1	fonts.googleapis.com	www.bagborroworsteal.com
1	visit.bagborroworsteal.com
0	ghbmnnjooekpmoecnnnilnnbdlolhkhi Failed	imgs.signifyd.com
51	20

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.pinterest.com
instagram.com
www.bbb.org

Subject Issuer	Validity	Valid
visit.bagborroworsteal.com R3	`2021-05-12` - `2021-08-10`	3 months	crt.sh
bagborroworsteal.com Go Daddy Secure Certificate Authority - G2	`2020-05-26` - `2022-07-25`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
gp1.wac.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-03-10` - `2022-04-06`	a year	crt.sh
cdn-scripts.signifyd.com Amazon	`2020-09-30` - `2021-10-30`	a year	crt.sh
*.bbb.org GeoTrust RSA CA 2018	`2020-05-15` - `2022-07-03`	2 years	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
imgs.signifyd.com Go Daddy Secure Certificate Authority - G2	`2021-04-02` - `2022-05-04`	a year	crt.sh
*.iglobalstores.com Amazon	`2020-10-05` - `2021-11-05`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2021-01-21` - `2022-01-21`	a year	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh

This page contains 6 frames:

Primary Page: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Frame ID: 6C3EB4FE99F8C6C23618222E13EF99BA
Requests: 37 HTTP requests in this frame

Frame: https://www.bagborroworsteal.com/blank_for_iframe.html
Frame ID: AA2C0EAA4DF3A6075DEF549A6DFA9D3D
Requests: 1 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/check.js;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&jb=3337262e6a716f7d35446b667570266a71673544616c7570246a7b623d416a706d6f672532303831
Frame ID: 663FAB2AD64311675D97456BECDB5135
Requests: 9 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/ls_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122
Frame ID: BE5B91A7126EE34C01A63F92B0EFA37E
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122
Frame ID: F987A6D758980D38C1B21156276A1A2C
Requests: 2 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/top_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122
Frame ID: FDA3D9918EBB8EB32C5884DBD83F6958
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_15&ems_l=8697087&i=1&d=NDIzMDExNDc5%7... Page URL
https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011479&sc_uid=ZTWDZ5NJ48&sc_l... HTTP 302
https://www.bagborroworsteal.com/failedPermission HTTP 302
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination= Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

51
Requests

98 %
HTTPS

52 %
IPv6

15
Domains

20
Subdomains

21
IPs

6
Countries

360 kB
Transfer

1008 kB
Size

10
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://www.facebook.com/bagborroworsteal

Search URL Search Domain Scan URL

URL: http://twitter.com/bagborrowsteal

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/bagborroworsteal/
Title:

Search URL Search Domain Scan URL

URL: http://instagram.com/bagborroworsteal
Title:

Search URL Search Domain Scan URL

URL: http://www.bbb.org/western-washington/business-reviews/handbags/bag-borrow-or-steal-in-seattle-wa-22027217#bbbseal

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_15&ems_l=8697087&i=1&d=NDIzMDExNDc5%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_8e92fa091b2b3972a838503742cefbce81a053335a9d4b22bb03583b0c5181ae Page URL
https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011479&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438 HTTP 302
https://www.bagborroworsteal.com/failedPermission HTTP 302
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070221345/?random=292147790&cv=9&fst=1625574663477&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=B03kYK6zHuGxlQfb8peoBw&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1070221345/?random=292147790&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2859880824&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/1070221345/?random=292147790&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2859880824&resp=GooglemKTybQhCsO&ipr=y

51 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK nrd.php Show response
visit.bagborroworsteal.com/u/ 847 B
807 B 313ms
217ms Document
text/html 217.175.192.21
NEXTLAYER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_15&ems_l=8697087&i=1&d=NDIzMDExNDc5%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_8e92fa091b2b3972a838503742cefbce81a053335a9d4b22bb03583b0c5181ae

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

217.175.192.21 , Austria, ASN1764 (NEXTLAYER-AS, AT),

Reverse DNS

Software

Apache /

Resource Hash

045feec00e1cb1b30e16a8c607d701a87e807ed5b31cb958224c85c6af6cb90a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: visit.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:01 GMT
server: Apache
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
content-encoding: gzip
x-af: suite16-web5
cache-control: max-age=0, no-cache, no-store, must-revalidate
pragma: no-cache
content-length: 429
content-type: text/html; charset=utf-8
x-hf: suite-haproxy01b

GET
H/1.1

200
OK

Primary Request signinInput Show response
www.bagborroworsteal.com/
Redirect Chain

https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011479&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2...
https://www.bagborroworsteal.com/failedPermission
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

31 KB
32 KB

213ms
212ms

Document
text/html

162.242.193.45
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.242.193.45 , United States, ASN27357 (RACKSPACE, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

7c362d12604efa0755c8a2b37a569788f61713ca988a1ce02822ca458e4d0bfe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://visit.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: JSESSIONID=0A3E58BA8B9C3AFEE94E05DBE54BD9EC.workerA; UBID=""; SESSION=51490be9-9f9a-45c8-886d-c59d0fff3f7a; adTrackId=null; destination="/sell/configInfo?sc_src=email_7092609&sc_lid=423011479&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_15&ems_l=8697087&i=1&d=NDIzMDExNDc5%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_8e92fa091b2b3972a838503742cefbce81a053335a9d4b22bb03583b0c5181ae

Response headers

Date: Tue, 06 Jul 2021 12:31:02 GMT
Server: Apache-Coyote/1.1
X-Frame-Options: SAMEORIGIN
Content-Type: text/html;charset=UTF-8
Keep-Alive: timeout=5, max=498
Connection: Keep-Alive
Transfer-Encoding: chunked

Redirect headers

Date: Tue, 06 Jul 2021 12:31:02 GMT
Server: Apache-Coyote/1.1
X-Frame-Options: SAMEORIGIN
Location: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Content-Length: 0
Keep-Alive: timeout=5, max=499
Connection: Keep-Alive

GET
H2 200 css
fonts.googleapis.com/ 1 KB
591 B 19ms
17ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Playfair+Display

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9d83121a5242fd08642d5791a2c7536b9f20291498977184992a6a1db5808f05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 12:08:28 GMT
server: ESF
date: Tue, 06 Jul 2021 12:31:03 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Jul 2021 12:31:03 GMT

GET
H2 200 global.min.css
secure.avelleassets.com/TNT1930/css/ 29 KB
7 KB 89ms
21ms Stylesheet
text/css 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/css/global.min.css

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CF2) /

Resource Hash

87755777f5ef22d9f1963138aec8eff9577c8d6c4dacfbc208ff4842194999fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 04 May 2020 16:34:51 GMT
server: ECS (mil/6CF2)
age: 428712
etag: "73cc-5a4d51c2920c0+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
content-length: 6894

GET
H2 200 concat_global.min.js Show response
secure.avelleassets.com/TNT1930/js_prod/ 118 KB
39 KB 92ms
23ms Script
text/javascript 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/js_prod/concat_global.min.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CE0) /

Resource Hash

df095f2eeccde5bd77d3d845d3c1a077d9f72f2c757d7a77bd2ef540af9c234f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 10 Mar 2016 19:20:10 GMT
server: ECS (mil/6CE0)
age: 428712
etag: "1d940-52db6b3f48e80+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/javascript
content-length: 39856

GET
H2 200 ig_welcome_mat_bagborrowsteal.css
secure.avelleassets.com/TNT1930/css/ 4 KB
2 KB 91ms
23ms Stylesheet
text/css 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/css/ig_welcome_mat_bagborrowsteal.css

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CEC) /

Resource Hash

01708dc7992dc288a868c11571d919e7d474d4936cac11735c2f7d363f3d2d6f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 03 Jun 2019 21:43:27 GMT
server: ECS (mil/6CEC)
age: 427102
etag: "f14-58a72411eddc0+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
content-length: 1456

GET
H2 200 ig_welcome_mat_bagborrowsteal.js Show response
secure.avelleassets.com/TNT1930/js_dev/ 30 KB
10 KB 108ms
40ms Script
text/javascript 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/js_dev/ig_welcome_mat_bagborrowsteal.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CF8) /

Resource Hash

63302d1db7161aa5add476568458cccf5d85ed30a615b8a29df686deb5d42245

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 01 Aug 2019 20:27:21 GMT
server: ECS (mil/6CF8)
age: 428712
etag: "7790-58f14119a5c40+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/javascript
content-length: 9951

GET
H2 200 script-tag.js Show response
cdn-scripts.signifyd.com/api/ 7 KB
7 KB 82ms
34ms Script
application/javascript 143.204.98.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/script-tag.js
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-44.fra50.r.cloudfront.net
Software: /
Resource Hash: e17857cb74ff8bb8c18929844a2d0ff42bd36dee42113f85a8831ad42ef6eb79

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:26:44 GMT
via: 1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
age: 259
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-cf-pop: FRA50-C1
content-length: 7199
x-amz-cf-id: DIqeL6VIgAR_HB2SCOp6Iby3NmQOcIccoPx3Ze80S89uEHQp27dLyw==

GET
H2 200 spacer.gif
secure.avelleassets.com/images/ 43 B
148 B 23ms
21ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/spacer.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CF9) /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Wed, 30 Nov 2005 01:15:09 GMT
server: ECS (mil/6CF9)
age: 563625
etag: "2b-406be1133c140"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 43

GET
H2 200 sign_in_pink.gif
secure.avelleassets.com/images/icons/buttons/ 2 KB
2 KB 433ms
431ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/icons/buttons/sign_in_pink.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache/2.4.41 (IUS) /

Resource Hash

3276b3d1db11c0bf2d0115055682512dc39716d2f1dccf07f529ddae440e3317

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Wed, 07 Aug 2019 21:29:43 GMT
server: Apache/2.4.41 (IUS)
etag: "77d-58f8da3b0ffc0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 1917

GET
H2 200 accessibility.gif
secure.avelleassets.com/images/icons/ 5 KB
6 KB 23ms
22ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/icons/accessibility.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CED) /

Resource Hash

d61f1e577b16aefc5029d0642694c25da422759e1ba766ca6d675dcc47d02ddc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Fri, 10 Jan 2020 23:14:59 GMT
server: ECS (mil/6CED)
age: 144235
etag: "15bc-59bd14b6602c0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 5564

GET
H2 200 bag-borrow-or-steal-22027217.png
seal-alaskaoregonwesternwashington.bbb.org/logo/rbvtbas/ 2 KB
2 KB 26ms
6ms Image
image/png 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://seal-alaskaoregonwesternwashington.bbb.org/logo/rbvtbas/bag-borrow-or-steal-22027217.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine / ASP.NET
Resource Hash: cec1bbe9694e8380d5d11e528292f347622be1e2fac7064d2dd987aa8ccda177

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Tue, 06 Jul 2021 06:00:07 GMT
server: keycdn-engine
x-aspnet-version: 4.0.30319
x-edge-location: defr
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
x-shield: active
content-length: 2073
expires: Tue, 06 Jul 2021 16:31:03 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 44 KB
17 KB 30ms
29ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

c9bbe54cc78a632348c9558a96db5aee6e21b70aaea571c1129a412701424a24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17350
x-xss-protection: 0
server: cafe
etag: 18373535751127286480
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Jul 2021 12:31:03 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 3918
date: Tue, 06 Jul 2021 11:25:45 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Tue, 06 Jul 2021 13:25:45 GMT

GET
H2 200 global_sprites.png
secure.avelleassets.com/TNT1930/css/sprites/ 62 KB
62 KB 25ms
24ms Image
image/png 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/TNT1930/css/sprites/global_sprites.png

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CF5) /

Resource Hash

1fa823896b863bc6bf90a0e3b122db129a337a98b16364fd72018549e1184600

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Mon, 03 Jun 2019 21:43:27 GMT
server: ECS (mil/6CF5)
age: 428711
etag: "f748-58a72411eddc0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/png
accept-ranges: bytes
content-length: 63304

GET
H2 200 search_vert.gif
secure.avelleassets.com/images/navigation/mainnav/ 1 KB
1 KB 23ms
22ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/navigation/mainnav/search_vert.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CE2) /

Resource Hash

91ddf1744d48128e8279b661f1c36bcae9eed12b542c420ae8de883a6d2002c9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Fri, 10 Jan 2014 02:00:08 GMT
server: ECS (mil/6CE2)
age: 427102
etag: "452-4ef9415df5a00"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 1106

GET
H2 200 search_arrow.gif
secure.avelleassets.com/images/navigation/mainnav/ 68 B
161 B 23ms
22ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/navigation/mainnav/search_arrow.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (mil/6CFA) /

Resource Hash

1319095e503185318684b65d6a8eda0cf1efb19028b35d3f966c154019df9c69

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
last-modified: Wed, 08 Jan 2014 23:28:21 GMT
server: ECS (mil/6CFA)
age: 428711
etag: "44-4ef7dd9362f40"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 68

GET
H2 200 nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.woff2
fonts.gstatic.com/s/playfairdisplay/v22/ 28 KB
28 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/playfairdisplay/v22/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Playfair+Display

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5348e4d76366efc13f2bcb5a5ce138e581e90d570a09d0ec66a8cab4920be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bagborroworsteal.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 01:54:51 GMT
x-content-type-options: nosniff
age: 38172
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28568
x-xss-protection: 0
last-modified: Thu, 28 Jan 2021 20:30:38 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 01:54:51 GMT

GET
H2 200 bag-borrow-or-steal-22027217.js Show response
seal-alaskaoregonwesternwashington.bbb.org/logo/ 3 KB
980 B 6ms
6ms Script
application/javascript 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://seal-alaskaoregonwesternwashington.bbb.org/logo/bag-borrow-or-steal-22027217.js
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine / ASP.NET
Resource Hash: 716c18fda50474e76ea9e81fd08eb20024fe490ccb77b21b22e513bf8b673d78

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
x-edge-location: defr
x-powered-by: ASP.NET
x-cache: HIT
content-length: 659
last-modified: Tue, 08 Dec 2015 18:58:11 GMT
server: keycdn-engine
etag: "80e33162ea31d11:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
x-shield: active
expires: Tue, 06 Jul 2021 16:31:03 GMT

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=1930486418&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&dr=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&dp=Sign%20In&ul=en-us&de=UTF-8&dt=Account%20Sign%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1333948695&gjid=1562422979&cid=51961956.1625574663&tid=UA-238171-1&_gid=964162859.1625574663&_r=1&_slc=1&z=115798990

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bagborroworsteal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK blank_for_iframe.html Show response
www.bagborroworsteal.com/ Frame AA2C 293 B
619 B 110ms
109ms Document
text/html 162.242.193.45
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bagborroworsteal.com/blank_for_iframe.html

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.242.193.45 , United States, ASN27357 (RACKSPACE, US),

Reverse DNS

Software

Apache/2.4.41 (IUS) /

Resource Hash

56f9b2160d7519c225d7455901a249f231349ee1ab51ba38377370f098d9f46d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: JSESSIONID=0A3E58BA8B9C3AFEE94E05DBE54BD9EC.workerA; UBID=""; SESSION=51490be9-9f9a-45c8-886d-c59d0fff3f7a; adTrackId=null; destination="/sell/configInfo?sc_src=email_7092609&sc_lid=423011479&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"; _ga=GA1.2.51961956.1625574663; _gid=GA1.2.964162859.1625574663; _gat=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Response headers

Date: Tue, 06 Jul 2021 12:31:03 GMT
Server: Apache/2.4.41 (IUS)
X-Frame-Options: SAMEORIGIN
Last-Modified: Fri, 30 May 2014 19:30:53 GMT
ETag: "125-4faa3156e3540"
Accept-Ranges: bytes
Content-Length: 293
Keep-Alive: timeout=5, max=497
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 / Show response
www.googleadservices.com/pagead/conversion/1070221345/ 2 KB
1 KB 28ms
27ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1070221345/?random=1625574663477&cv=9&fst=1625574663477&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

90fd1498842e7c42e5113b5d036d4ef749c1004c7c7b1416f66ca2c8fb054d7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1179
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/972814219/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/972814219/?random=1625574663485&cv=9&fst=1625574663477&num=2&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9e4b2d4da09c7785879cdc49548a87a490ad17640c880c4625bebc07978cfeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1097
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK tags.js Show response
imgs.signifyd.com/fp/ 80 KB
11 KB 76ms
27ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/tags.js?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&pageid=2

Requested by

Host: cdn-scripts.signifyd.com
URL: https://cdn-scripts.signifyd.com/api/script-tag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

110cb192eb2447f1e7f931ba3b3c440b75de28c6b82a6f9d319deb7ea822f743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iGlobalIp.js Show response
iprecon.iglobalstores.com/ 18 B
439 B 29ms
8ms Script
text/javascript 2600:9000:2156:bc00:0:43cc:80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://iprecon.iglobalstores.com/iGlobalIp.js?p=igcCallback&_1625574663500=
Requested by: Host: secure.avelleassets.com
URL: https://secure.avelleassets.com/TNT1930/js_dev/ig_welcome_mat_bagborrowsteal.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:bc00:0:43cc:80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4406332ec7167767030f8f3f0561af1bc97ce03b13b86370736f1654e742c09b

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:20:44 GMT
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
age: 619
x-amzn-requestid: 7f3c9ac3-0434-458c-bbcb-8f07879500b6
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=1800
x-amzn-trace-id: Root=1-60e44a9c-70bcb4216518ca05735f3c5f;Sampled=0
x-amz-cf-pop: FRA50-C1
access-control-allow-credentials: true
x-amz-apigw-id: CDCYcEodIAMFyfw=
content-length: 18
x-amz-cf-id: gS2GYO8W7ofCsNoln4DEBnGjcQwRQKoFD6YK39bD4ox0-7wjiz7ftA==

GET
H/1.1 200
OK close-square.png
d1vyngmisxigjx.cloudfront.net/images/ 1 KB
2 KB 63ms
19ms Image
image/png 143.204.98.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/close-square.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-59.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: c4a749be78ebdf7a12353556c362cd7a5b63fdfdb0b65306e8968576ed1ffe87

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 11:20:15 GMT
Via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:47 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 4248
ETag: "554-59d396f2cb8e5"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 1364
X-Amz-Cf-Id: 2SmrR_DbrgWq7riaSgbXw0-z8j9887r2ZBYTUitOY6El_Qjhxd7CdQ==

GET
H/1.1 200
OK bagborroworsteel.png
checkout.iglobalstores.com/images/ 11 KB
12 KB 437ms
109ms Image
image/png 52.202.92.254
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://checkout.iglobalstores.com/images/bagborroworsteel.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.92.254 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-92-254.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 65dafcdaae3b766bb4cf47d6ff72f49eeda9af3363a7efae97d48ef76cc22d01

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:31:03 GMT
Last-Modified: Tue, 28 Jan 2020 20:54:08 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "2d3b-59d396cd56bb4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11579

GET
H/1.1 200
OK US.png
d1vyngmisxigjx.cloudfront.net/images/flags/96x64/ 3 KB
4 KB 69ms
25ms Image
image/png 143.204.98.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/flags/96x64/US.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-59.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 58cdce9d9fa5d1b29625c051c2976d9914d2ddb70fdc6c83bc5c543816453720

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 01:50:17 GMT
Via: 1.1 6b4954a8411e7b2a232537f8000c5c9d.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:48 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 38446
ETag: "d23-59d396f3ce581"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 3363
X-Amz-Cf-Id: 0dPPBYiwOcv7JBsXSgsw_tFSPehHvemLltEeW1mTou3dbpwAib3SHg==

GET
H/1.1 200
OK payment-methods-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 4 KB
4 KB 78ms
35ms Image
image/png 143.204.98.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/payment-methods-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-59.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: de6198ebfb4c6f439366c804fa711983cfcbb0c694432d2e5fb1f8e541ecd804

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 10:16:59 GMT
Via: 1.1 d55780b776b171387055eca956ae29a9.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:46 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 8044
ETag: "fc4-59d396f228788"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 4036
X-Amz-Cf-Id: LiHRfhR3Lh3zGF0VAT5P1s5Cjb7vDAcgSzdgUoeqTzOIvWOIG4fmCw==

GET
H/1.1 200
OK prepay-duty-tax-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 2 KB
3 KB 66ms
22ms Image
image/png 143.204.98.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/prepay-duty-tax-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-59.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 7446767437b0174b01820e3eb0d2202fa8e67f1753296ab5c97c21bc2dd20147

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 10:16:59 GMT
Via: 1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:50 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 8044
ETag: "9a5-59d396f5e57f7"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 2469
X-Amz-Cf-Id: Xd3oPnl-iKxuCaCE5dBA9hVRjvby2DMUqPtoYRdx35kCrMgFVDn7FQ==

GET
H/1.1 200
OK shipping-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 4 KB
5 KB 65ms
22ms Image
image/png 143.204.98.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/shipping-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-59.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 4389239d90f66985ca942fc833a14f1f2269581a37b804843846954e056f8036

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 10:16:59 GMT
Via: 1.1 80c1ad5f9352d00b95a9da73eb6b6be5.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:50 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 8044
ETag: "1133-59d396f5c7398"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 4403
X-Amz-Cf-Id: 4To9omoJRSkIaVGuCUYNk4a_HoWfFi4cnKOCQKB2MXox0s_vVPhsiA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
94 B 17ms
15ms XHR
text/plain 2a00:1450:400c:c04::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-238171-1&cid=51961956.1625574663&jid=1333948695&gjid=1562422979&_gid=964162859.1625574663&_u=IEBAAEAAAAAAAC~&z=1992348872

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 06 Jul 2021 12:31:03 GMT
content-type: text/plain
access-control-allow-origin: https://www.bagborroworsteal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/972814219/ 42 B
115 B 20ms
19ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/972814219/?random=1625574663485&cv=9&fst=1625572800000&num=2&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&is_vtc=1&random=515434772&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/972814219/ 42 B
108 B 19ms
18ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/972814219/?random=1625574663485&cv=9&fst=1625572800000&num=2&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&is_vtc=1&random=515434772&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

/
www.google.de/pagead/1p-user-list/1070221345/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070221345/?random=292147790&cv=9&fst=1625574663477&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTyb...
https://www.google.com/pagead/1p-user-list/1070221345/?random=292147790&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=...
https://www.google.de/pagead/1p-user-list/1070221345/?random=292147790&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1...

42 B
64 B

21ms
20ms

Image
image/gif

2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1070221345/?random=292147790&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2859880824&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1070221345/?random=292147790&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=2859880824&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
114 B 29ms
28ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-238171-1&cid=51961956.1625574663&jid=1333948695&_u=IEBAAEAAAAAAAC~&z=1943014831

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ga-audiences
www.google.de/ads/ 42 B
63 B 30ms
30ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-238171-1&cid=51961956.1625574663&jid=1333948695&_u=IEBAAEAAAAAAAC~&z=1943014831

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:31:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK DE.png
d1vyngmisxigjx.cloudfront.net/images/flags/96x64/ 1 KB
2 KB 43ms
23ms Image
image/png 143.204.98.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/flags/96x64/DE.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-59.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a02b3ffbb8805d295bb9ef2b5676ac97189736203b6779ab848ceb7b9008e67c

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 05:40:25 GMT
Via: 1.1 bab8148a65b29113f79cf2725076287d.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:48 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 24638
ETag: "592-59d396f3a7481"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 1426
X-Amz-Cf-Id: PjhF2EFppdDRS1w3MCmZmuxuYIG8E0-K2G1mXXy0mL7uyV8-EdTeXg==

GET
H/1.1 200
OK check.js;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717 Show response
imgs.signifyd.com/fp/ Frame 663F 219 KB
36 KB 32ms
30ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/check.js;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&jb=3337262e6a716f7d35446b667570266a71673544616c7570246a7b623d416a706d6f672532303831

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/fp/tags.js?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&pageid=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

99db8f5c30589a4e81662f25a5f0534a10861e96c54a21ffa1a80e67c190dbd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: 19a670ccf3847122
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
imgs.signifyd.com/fp/ Frame 663F 81 B
475 B 74ms
23ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:04 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
imgs.signifyd.com/fp/ Frame 663F 81 B
475 B 75ms
24ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&ck=0&m=1

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:04 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
imgs.signifyd.com/fp/ Frame 663F 81 B
540 B 72ms
24ms XHR
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/fp/check.js;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&jb=3337262e6a716f7d35446b667570266a71673544616c7570246a7b623d416a706d6f672532303831

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, w2txo5aa/19a670ccf384712251490be9-9f9a-45c8-886d-c59d0fff3f7a
Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:31:04 GMT
Last-Modified: Tue, 06 Jul 2021 12:31:04 GMT
Server: Apache
Etag: 4312e6ea06644923b1c21cde800bb66a
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://www.bagborroworsteal.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sun, 05 Jul 2026 12:31:04 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717 Show response
imgs.signifyd.com/fp/ Frame BE5B 82 KB
13 KB 28ms
26ms Document
text/html 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/ls_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e0458420d02c69985ce30b6587f63a369673e80cf3acc122a113252131c7d123

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: imgs.signifyd.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: thx_guid=042e64d1fd4e491899ecec62beb71b79
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:31:04 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 200
OK sid_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717 Show response
h.online-metrix.net/fp/ Frame F987 95 KB
14 KB 100ms
29ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

4b1d6470bed937c7b562f8ac2805a5607cb131d74d708fed66cba5a9f378f069

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:31:04 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET page_embed_script.js
ghbmnnjooekpmoecnnnilnnbdlolhkhi/ Frame 663F 0
0

GET
H/1.1 200
OK top_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717 Show response
imgs.signifyd.com/fp/ Frame FDA3 82 KB
13 KB 32ms
31ms Document
text/html 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/top_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

038057041ba0f06219640e3331a41b0a71133e82404384bdb49fce1e01a3d67f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: imgs.signifyd.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: thx_guid=042e64d1fd4e491899ecec62beb71b79
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:31:04 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=98
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
imgs.signifyd.com/fp/ Frame 663F 0
218 B 32ms
30ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&ja=3733312e26613d3e382e7835363826663f393e38387a313a32302e61663f333432327a313230302e737a79353870322e6478723d3324393e38322c393030382c313432322e333030302c313e30322c393a383224313e30302e393a38382e302432267b63643f3036246e6a3d68747478732733492d3a442d324e777775266a696f606f7a706f7f6f72717667636e2c636f6d253a4671696f66616c416e787574273b4e787a6d647d617441642531463227303473697a652d3346253a3e7a676674696c54677a65416c27334c27323e646571766b6c6376696f6e253b4424647a3560767c707b2533432d3a4e2d30467e6b7361742e606365606d70726f776f7a73766569642661676d2d3246246060353137303131633b6534613b3261333b396239613b6564393f3e3a323d643c326524627b67354e696677782e6a73603f416a706d6d65253238383b26627b6777354c616e757a2e66606b3f313e246e6c6d3d3a247678663f4575726f786527324e4a6d70646966266d637c607a353630383164396332606761323067366363353e3032383a696c333d353c3031646c3c3d303a313c33643e656163303666613b346166626c373033393b393b3e612e703d72647d6f616c5f6e6e617b685e64636e716723706c7567616e5d7761666c6d7f73576d6566616957786e617167725666616e716723726e7567696e5761666f6a6d57636b7267626176566e6964716529726c7d67696c5d73776b616b74696d6d5e6461647b6d23786c7d67696c577b6067616b7f63766d5e66636e716723726c756769665f70656964786e69796d725e6469647b6d2370647767616e5f746e615d726e617965725666636c7b6d297264756f696e5d6c6d7e696e767a5c66696c736723726e7765696e5f737e675d76616d7f677a5e6e616c716d2978647767616c5f626176635c64636e71652665783b3d61383c6e3c356c373e3963603b3f693b36633a32653a643933646435313a343063613f3037613c6b2e616b643535&jb=3135332e6c733d4567726b646c692532443d26382d303020556966646f75712730324c5425323039302c302d3b4a273a305f696e343c2d3b4a2732387a363c292530324372726e65576562436976253a4e3d313f2e3b36253038204340564d4427324b2532326e6b696727323047656b6b6d292d3a38416072676d65273a4e30312c3026363330392e35302730325161666172612530463d3b3f2c3b36

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:31:04 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
w2txo5aawptvx6wza6crxs3gbekdvrergnh2wgho19a670ccf3847122am1.e.aa.online-metrix.net/fp/ Frame 663F 81 B
438 B 106ms
24ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://w2txo5aawptvx6wza6crxs3gbekdvrergnh2wgho19a670ccf3847122am1.e.aa.online-metrix.net/fp/clear.png?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:04 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717
imgs.signifyd.com/fp/ Frame 663F 0
400 B 26ms
26ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear1.png;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&jf=3431362e736b64577a666635746c725f534451434f77794c587159783056326624716b645f64617c653f313e3a3d373f343e3634247b616c57767978673d7f656238676166716326736964576b6779353b38373133383133323e383f3a63383e36386b65336632303233323630383269383434306b6d316c303b3031323f383b3c3030383234386438663232676030643139376b3561376b3a6d666d306a61393b6c6d6e6a32653a64633c343861313a323230613737663d613436696a3f3630353e6262376c3e6a3034343860646d3835356333613631663063666b3834626e6e3e323c66396635663c383b6c3531386139386366663130673036323931636a3566643f6b3d247b696c5f736b6f353b38363538303238336266633661673464653636393030336e3e383130636e356531693e6c3a31613e33346e39643466613b3a6034366335316530303f693e643937316337616c3f383a30313832383c373764333b353060396534316d656137393e3b3a6c32303236356a6e393861623064656e386332603060323a353331616d3032333b3e6a353939316665632e7b616e703d38

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:04 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=173C9A4D9BAC6E13B4FE9D64DB4DCAE4
h.online-metrix.net/fp/ Frame F987 0
400 B 33ms
32ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=173C9A4D9BAC6E13B4FE9D64DB4DCAE4?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&jf=3431362e736b64577a666635746c725f4a5e6e6a7c56397a65425d4852746f4c24716b645f64617c653f313e3a3d373f343e3634247b616c57767978673d7f656238676166716326736964576b6779353b38373133383133323e383f3a63383e36386b65336632303233323630383269383434306b6d316c303b3031323f383b3c3030383234383739313a31373761656334366c3866326c3c31673c383a3766323c3a3c3b67623b35633d3038673b34616763316566313e6331646e386c333c36306237313b30316c37396d6131303435603260376466393938336d3267363e6939353a326d6139366a3e3a6e3a396c63393f3336633a3a3b3164623964376e623b656a6c69247b696c5f736b6f353b383635383032383632676032306637333138356c3931366a3e313630313932666169313a6964333c3b663f383264323a343236326234366e66343939386e303a656d6666363c38383a30313832643e6361673764366166643033313a6333336b383d303d306937663b3c3d3e693b383e643730326567303a353163666232356d6131626b6e3c376c643061373a2e7b616e703d39

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=FC60CFADA7CDA44236519DE16D5D3717?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:04 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
imgs.signifyd.com/fp/ Frame 663F 0
387 B 24ms
24ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=51490be9-9f9a-45c8-886d-c59d0fff3f7a&nonce=19a670ccf3847122&jac=1&je=3137372e2675656a7a7c61576570746570666964576b703533383d2e3137342c3335372e3130372e776b6d357f6d607a746b5f696c7c6d7a66636c576f64667326726f3f6c6d24626174737c3d7922646d7e67642232312e3238242a7b76617c77732a3a22616a6370656b6e67227d2e61776460356b676e6269653435303e3f3f64303a64626a6439353134333534393264626c3961363c3d38606e353e3431343e316d6a67663937393d61623536376330333137

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:31:04 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ghbmnnjooekpmoecnnnilnnbdlolhkhi
URL: chrome-extension://ghbmnnjooekpmoecnnnilnnbdlolhkhi/page_embed_script.js

Verdicts & Comments Add Verdict or Comment

171 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.bagborroworsteal.com/	1970-01-19 19:42:59	Name: igSplash Value: igSplash
.www.bagborroworsteal.com/	1970-01-20 04:18:30	Name: igCountry Value: DE
.bagborroworsteal.com/	1970-01-19 19:34:21	Name: _gid Value: GA1.2.964162859.1625574663
.bagborroworsteal.com/	1970-01-20 13:04:06	Name: _ga Value: GA1.2.51961956.1625574663
www.bagborroworsteal.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0A3E58BA8B9C3AFEE94E05DBE54BD9EC.workerA
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: destination Value: "/sell/configInfo?sc_src=email_7092609&sc_lid=423011479&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: adTrackId Value: null
.bagborroworsteal.com/	1970-01-30 18:20:54	Name: UBID Value: ""
.bagborroworsteal.com/	1970-01-19 19:32:54	Name: _gat Value: 1
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: SESSION Value: 51490be9-9f9a-45c8-886d-c59d0fff3f7a

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-scripts.signifyd.com
checkout.iglobalstores.com
d1vyngmisxigjx.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
ghbmnnjooekpmoecnnnilnnbdlolhkhi
googleads.g.doubleclick.net
h.online-metrix.net
imgs.signifyd.com
iprecon.iglobalstores.com
seal-alaskaoregonwesternwashington.bbb.org
secure.avelleassets.com
stats.g.doubleclick.net
visit.bagborroworsteal.com
w2txo5aawptvx6wza6crxs3gbekdvrergnh2wgho19a670ccf3847122am1.e.aa.online-metrix.net
www.bagborroworsteal.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
ghbmnnjooekpmoecnnnilnnbdlolhkhi
142.250.185.194
143.204.98.44
143.204.98.59
162.242.193.45
185.32.241.65
217.175.192.21
2600:9000:2156:bc00:0:43cc:80:93a1
2a00:1450:4001:803::2003
2a00:1450:4001:808::200e
2a00:1450:4001:809::2004
2a00:1450:4001:827::2003
2a00:1450:4001:828::2002
2a00:1450:4001:829::200e
2a00:1450:4001:82f::200a
2a00:1450:4001:831::2002
2a00:1450:400c:c04::9d
2a0b:4d07:102::1
52.202.92.254
91.235.132.130
91.235.134.131
93.184.220.20
01708dc7992dc288a868c11571d919e7d474d4936cac11735c2f7d363f3d2d6f
038057041ba0f06219640e3331a41b0a71133e82404384bdb49fce1e01a3d67f
045feec00e1cb1b30e16a8c607d701a87e807ed5b31cb958224c85c6af6cb90a
110cb192eb2447f1e7f931ba3b3c440b75de28c6b82a6f9d319deb7ea822f743
1319095e503185318684b65d6a8eda0cf1efb19028b35d3f966c154019df9c69
1fa823896b863bc6bf90a0e3b122db129a337a98b16364fd72018549e1184600
3276b3d1db11c0bf2d0115055682512dc39716d2f1dccf07f529ddae440e3317
4389239d90f66985ca942fc833a14f1f2269581a37b804843846954e056f8036
4406332ec7167767030f8f3f0561af1bc97ce03b13b86370736f1654e742c09b
4b1d6470bed937c7b562f8ac2805a5607cb131d74d708fed66cba5a9f378f069
56f9b2160d7519c225d7455901a249f231349ee1ab51ba38377370f098d9f46d
58cdce9d9fa5d1b29625c051c2976d9914d2ddb70fdc6c83bc5c543816453720
63302d1db7161aa5add476568458cccf5d85ed30a615b8a29df686deb5d42245
65dafcdaae3b766bb4cf47d6ff72f49eeda9af3363a7efae97d48ef76cc22d01
716c18fda50474e76ea9e81fd08eb20024fe490ccb77b21b22e513bf8b673d78
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7446767437b0174b01820e3eb0d2202fa8e67f1753296ab5c97c21bc2dd20147
7c362d12604efa0755c8a2b37a569788f61713ca988a1ce02822ca458e4d0bfe
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87755777f5ef22d9f1963138aec8eff9577c8d6c4dacfbc208ff4842194999fa
90fd1498842e7c42e5113b5d036d4ef749c1004c7c7b1416f66ca2c8fb054d7b
91ddf1744d48128e8279b661f1c36bcae9eed12b542c420ae8de883a6d2002c9
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
99db8f5c30589a4e81662f25a5f0534a10861e96c54a21ffa1a80e67c190dbd6
9c5348e4d76366efc13f2bcb5a5ce138e581e90d570a09d0ec66a8cab4920be6
9d83121a5242fd08642d5791a2c7536b9f20291498977184992a6a1db5808f05
a02b3ffbb8805d295bb9ef2b5676ac97189736203b6779ab848ceb7b9008e67c
a9e4b2d4da09c7785879cdc49548a87a490ad17640c880c4625bebc07978cfeb
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c4a749be78ebdf7a12353556c362cd7a5b63fdfdb0b65306e8968576ed1ffe87
c9bbe54cc78a632348c9558a96db5aee6e21b70aaea571c1129a412701424a24
cec1bbe9694e8380d5d11e528292f347622be1e2fac7064d2dd987aa8ccda177
d61f1e577b16aefc5029d0642694c25da422759e1ba766ca6d675dcc47d02ddc
de6198ebfb4c6f439366c804fa711983cfcbb0c694432d2e5fb1f8e541ecd804
df095f2eeccde5bd77d3d845d3c1a077d9f72f2c757d7a77bd2ef540af9c234f
e0458420d02c69985ce30b6587f63a369673e80cf3acc122a113252131c7d123
e17857cb74ff8bb8c18929844a2d0ff42bd36dee42113f85a8831ad42ef6eb79
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.bagborroworsteal.com Open in urlscan Pro 162.242.193.45 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

51 Requests

98 %HTTPS

52 %IPv6

15 Domains

20 Subdomains

21 IPs

6 Countries

360 kBTransfer

1008 kBSize

10 Cookies

5 Outgoing links

Page URL History

Redirected requests

51 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bagborroworsteal.com Open in urlscan Pro
162.242.193.45 Public Scan

Screenshot
Live screenshot

Full Image

51
Requests

98 %
HTTPS

52 %
IPv6

15
Domains

20
Subdomains

21
IPs

6
Countries

360 kB
Transfer

1008 kB
Size

10
Cookies

51 HTTP transactions
0 data transactions