holy-violet-5937.on.fleek.co Open in urlscan Pro
2606:4700::6812:791  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 86

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=jvgpYp3KH8vvgQekjKvgBw&sscte=1&crd=CNPgGw&eitems=ChAIgOCmkQYQ3uqtsai2lM1kEh0Ab28nvJd9poLjP_MqhFyZNMePDm7fNmTdvhU3kw HTTP 302
• https://www.google.com/pagead/1p-conversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=jvgpYp3KH8vvgQekjKvgBw&eitems=ChAIgOCmkQYQ3uqtsai2lM1kEh0Ab28nvLdKBA0RYKhgwiGOcYt_LRDnE7TExsBZ7A&random=684075251&resp=GooglemKTybQhCsO HTTP 302
• https://www.google.de/pagead/1p-conversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=jvgpYp3KH8vvgQekjKvgBw&eitems=ChAIgOCmkQYQ3uqtsai2lM1kEh0Ab28nvLdKBA0RYKhgwiGOcYt_LRDnE7TExsBZ7A&random=684075251&resp=GooglemKTybQhCsO&ipr=y&prhg=0

Request Chain 91

• https://googleads.g.doubleclick.net/pagead/id HTTP 302
• https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

118 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response holy-violet-5937.on.fleek.co/	6 KB 2 KB	337ms 296ms	Document text/html	2606:4700::6812:791 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:791 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf6d6433d95e2ca1f934c9011802f9b02e5f9a3a9ae0fcff7475076567cc6997 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Thu, 10 Mar 2022 13:09:31 GMT content-type text/html cf-ray 6e9c49038d39903c-FRA access-control-allow-origin * cache-control max-age=10, stale-while-revalidate=600 expires Thu, 10 Mar 2022 17:09:31 GMT last-modified Thu, 10 Mar 2022 13:09:31 GMT strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding cf-cache-status MISS access-control-allow-headers Content-Type, Range, User-Agent, X-Requested-With access-control-allow-methods GET,HEAD,OPTIONS access-control-expose-headers Content-Range, X-Chunked-Output, X-Stream-Output access-control-max-age 86400 content-security-policy upgrade-insecure-requests expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" referrer-policy strict-origin-when-cross-origin x-cache-status MISS x-content-type-options nosniff x-ipfs-path /ipfs/bafybeigy7o62chyhwy6bzlpdnlmuz2aa77c6jjze66og5tumlhg4isgc3a/ x-request-id 7cbce136c4151ba617fcebd348e4fb98 x-xss-protection 0 server cloudflare content-encoding gzip
GET		/ holy-violet-5937.on.fleek.co/ Frame E6A5	0 0
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/	85 KB 28 KB	40ms 20ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: holy-violet-5937.on.fleek.co URL: https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://holy-violet-5937.on.fleek.co/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 10 Mar 2022 13:09:31 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 1187507 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27433 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-1538f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eFXIGbYNWGB8yr%2B1HF6nVR8tzEUWqDnvXCUiwtRKYfhL7JohZcWDRJPY7xPj4XIPSxQ%2FfzcXaH1xvn%2BAhnzudsl7DJPoK4jalaXRLgrA0AVZvwa2XoV2Lk5GC1Ko5x5Wy9btG8T8KjXb4ViIpOnCeeuG"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 6e9c4905acfe928d-FRA expires Tue, 28 Feb 2023 13:09:31 GMT
GET		/ holy-violet-5937.on.fleek.co/	0 0
GET H2	200	bg.php Show response hemistichal-mislead.000webhostapp.com/ Frame E6A5	81 KB 20 KB	2382ms 2127ms	Document text/html	2a02:4780:dead:e211::1 AWEX
General Check archive.org Show headers Download Go to Full URL https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:e211::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 185fc4045e36c68a8039243d8860f67c95ff17cbc52b1b50a4281e590e8ad99e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://holy-violet-5937.on.fleek.co/ Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-type text/html; charset=UTF-8 server awex x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id 72655a0226cf35d3490672ef74dc0672 content-encoding gzip
GET H2	200	icrc.org logo.clearbit.com/	11 KB 11 KB	46ms 8ms	Image image/png	13.224.195.13 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://logo.clearbit.com/icrc.org Requested by Host: holy-violet-5937.on.fleek.co URL: https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.195.13 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-195-13.fra2.r.cloudfront.net Software envoy / Resource Hash 6df0ca84d4de079544b568db64d7271bcaf67439b695cbca0afe93c0ee6fb0b3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://holy-violet-5937.on.fleek.co/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 03 Mar 2022 15:11:17 GMT via 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront) x-content-type-options nosniff server envoy age 597494 content-security-policy-report-only default-src: 'self'; report-uri https://o13610.ingest.sentry.io/api/6173537/security/?sentry_key=7ac906c405c04da0bad984892f88d1bb x-cache Hit from cloudfront content-type image/png access-control-allow-origin * cache-control public, max-age=2592000 x-amz-cf-pop FRA2-C1 strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-id hlV0TwVJ1TE52dlH4B4kxN0fe4KBWR-8B37EAwRphJYBe6o3i3g0Pw==
GET H2	200	css_lQaZfjVpwP_oGNqdtWCSpJT1EMqXdMiU84ekLLxQnc4.css www.icrc.org/sites/default/files/css/ Frame E6A5	3 KB 1 KB	138ms 73ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_lQaZfjVpwP_oGNqdtWCSpJT1EMqXdMiU84ekLLxQnc4.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 9506997e3569c0ffe818da9db56092a494f510ca9774c894f387a42cbc509dce Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:04 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 1046 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	css_sdyyIuqV_D0sgcuYxlQjQRjXrhAHul_ByaHN6dBpqGw.css www.icrc.org/sites/default/files/css/ Frame E6A5	2 KB 850 B	120ms 55ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_sdyyIuqV_D0sgcuYxlQjQRjXrhAHul_ByaHN6dBpqGw.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash b1dcb222ea95fc3d2c81cb98c654234118d7ae1007ba5fc1c9a1cde9d069a86c Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:05 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 801 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	css_PGbJgHCUCBf4dg7K9Kt8aAwsApndP4GZ9RuToPy3-Fk.css www.icrc.org/sites/default/files/css/ Frame E6A5	494 B 299 B	155ms 91ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_PGbJgHCUCBf4dg7K9Kt8aAwsApndP4GZ9RuToPy3-Fk.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 3c66c98070940817f8760ecaf4ab7c680c2c0299dd3f8199f51b93a0fcb7f859 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:05 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 250 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	css_NJRJTpPS3LHldeSzCOg1r4sOGIeFrPQszBX69GfsWNY.css www.icrc.org/sites/default/files/css/ Frame E6A5	39 KB 8 KB	153ms 89ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_NJRJTpPS3LHldeSzCOg1r4sOGIeFrPQszBX69GfsWNY.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 3494494e93d2dcb1e575e4b308e835af8b0e188785acf42ccc15faf467ec58d6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:05 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 8180 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	css fonts.googleapis.com/ Frame E6A5	10 KB 1 KB	151ms 52ms	Stylesheet text/css	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,400,700&r81sau Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 336b9e18c04ab729a2f86ee62eecd62674f1103e060b9fc91544dc8fe748c3d0 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 10 Mar 2022 12:12:25 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Thu, 10 Mar 2022 13:09:33 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 10 Mar 2022 13:09:33 GMT
GET H2	200	css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css www.icrc.org/sites/default/files/css/ Frame E6A5	465 KB 69 KB	121ms 57ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash c99f95a457dd8b63277ebd70be1346e38c59de7c593e314a65b57fcd77792a85 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:05 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 70161 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	css_47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.css www.icrc.org/sites/default/files/css/ Frame E6A5	0 206 B	119ms 55ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:05 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 20 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	js_2VhVEFDE9rhs4i0J7b0De40o_BTXMNCef5xvqZnrdls.js Show response www.icrc.org/sites/default/files/js/ Frame E6A5	133 KB 46 KB	157ms 94ms	Script text/javascript	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/js/js_2VhVEFDE9rhs4i0J7b0De40o_BTXMNCef5xvqZnrdls.js Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash d958551050c4f6b86ce22d09edbd037b8d28fc14d730d09e7f9c6fa999eb765b Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:57:00 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/javascript cache-control max-age=604800, public accept-ranges bytes content-length 45996 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	js_YQ1E_8VAza9LhUc2x8RsPNa0c57QSG24W1fN5gBggGk.js Show response www.icrc.org/sites/default/files/js/ Frame E6A5	9 KB 3 KB	173ms 110ms	Script text/javascript	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/js/js_YQ1E_8VAza9LhUc2x8RsPNa0c57QSG24W1fN5gBggGk.js Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 610d44ffc540cdaf4b854736c7c46c3cd6b4739ed0486db85b57cde600608069 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:57:00 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/javascript cache-control max-age=604800, public accept-ranges bytes content-length 2764 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	request.umd.js Show response unpkg.com/@esri/arcgis-rest-request@3.0.0/dist/umd/ Frame E6A5	31 KB 9 KB	37ms 19ms	Script application/javascript	2606:4700::6810:7daf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/@esri/arcgis-rest-request@3.0.0/dist/umd/request.umd.js Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd067f47256ff448c10c1eff72bf1c3de022914709986006f33d3cb350f76651 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT via 1.1 fly.io x-content-type-options nosniff cf-cache-status HIT age 3813956 fly-request-id 01FT89X1QT6QS57XW799W8QSKN content-encoding br vary Accept-Encoding last-modified Sat, 26 Oct 1985 08:15:00 GMT server cloudflare etag W/"7c36-B5uMrI2vojojUUC57B6Fo3lwcaM" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6e9c49150cfb929b-FRA
GET H2	200	feature-layer.umd.js Show response unpkg.com/@esri/arcgis-rest-feature-layer@3.0.0/dist/umd/ Frame E6A5	22 KB 4 KB	37ms 20ms	Script application/javascript	2606:4700::6810:7daf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/@esri/arcgis-rest-feature-layer@3.0.0/dist/umd/feature-layer.umd.js Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7daf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d9963bf0e7012cd8fff7553387bb9805e186d31b0c73a5c374973930f8f213eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT via 1.1 fly.io x-content-type-options nosniff cf-cache-status HIT age 3813956 fly-request-id 01FT89X1WXEKF95GGS03X472BT content-encoding br vary Accept-Encoding last-modified Sat, 26 Oct 1985 08:15:00 GMT server cloudflare etag W/"5690-eiLBvy+Ss+Dt3oCotf9puOPjsJk" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000 cf-ray 6e9c49150cfc929b-FRA
GET H2	200	optimize.js Show response www.googleoptimize.com/ Frame E6A5	98 KB 38 KB	160ms 51ms	Script application/javascript	2a00:1450:4001:828::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleoptimize.com/optimize.js?id=GTM-TXDH7Z8 Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2b2a5314413f50d3f80da314959e28c24f14017cf5a42a0d4dfb7b190c6d2d4c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 38104 x-xss-protection 0 expires Thu, 10 Mar 2022 13:09:33 GMT
GET H2	404	logo-small.png hemistichal-mislead.000webhostapp.com/sites/default/themes/icrc_theme/images/en/ Frame E6A5	14 KB 14 KB	110ms 110ms	Image text/html	2a02:4780:dead:e211::1 AWEX
General Check archive.org Show headers Download Go to Show image Full URL https://hemistichal-mislead.000webhostapp.com/sites/default/themes/icrc_theme/images/en/logo-small.png Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:e211::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 134ed6d615029fc4909d6ef1daf58e9d96254b7ec1739a739477a30181c127a7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip x-content-type-options nosniff server awex x-xss-protection 1; mode=block x-request-id e8329276a642425eaf1f1f6101c90d55 content-type text/html; charset=UTF-8
GET H2	200	css_H6KHODqZmJUZuNmAahRFhNcnVyUN6d8oYrI4y6b1O0E.css www.icrc.org/sites/default/files/css/ Frame E6A5	9 KB 1 KB	239ms 238ms	Stylesheet text/css	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/css/css_H6KHODqZmJUZuNmAahRFhNcnVyUN6d8oYrI4y6b1O0E.css Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 1fa287383a99989519b8d9806a144584d72757250de9df2862b238cba6f53b41 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:05 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/css cache-control max-age=604800, public accept-ranges bytes content-length 1217 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	icrc-car-syria_1.jpg www.icrc.org/sites/default/files/styles/special_page_image/public/homepage_files/ Frame E6A5	141 KB 141 KB	159ms 156ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/special_page_image/public/homepage_files/icrc-car-syria_1.jpg?itok=sydI4NeT Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 2cc5d9f72b111dcdae6a8e03eae80315cdad43cb63be05d82ec89706d894a87c Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Fri, 13 Apr 2018 03:36:33 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	2022-03-02_ukraine-crisis-east_1.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ Frame E6A5	227 KB 229 KB	74ms 71ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/2022-03-02_ukraine-crisis-east_1.jpg?itok=qQFIWiHg Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash bbeb8e7815f39c600e704c6077290c978403fe74220429f64f12796b61bc12c0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Fri, 04 Mar 2022 09:00:07 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	ukraine_get_help_red_cross.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ Frame E6A5	189 KB 189 KB	146ms 143ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ukraine_get_help_red_cross.jpg?itok=wIQfqfO5 Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 393b76e1de1b9035d617a83b7507f2ea0c65fc2e558e869671656c854905fb09 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Sat, 05 Mar 2022 12:44:14 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	ukraine_appeal_icrc.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ Frame E6A5	301 KB 302 KB	146ms 143ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ukraine_appeal_icrc.jpg?itok=sDlQKQ2G Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash ae08d0f3e6a7214fbb7603a7e52fd252f7fa48275cda33f27c1ab732784086cb Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 15:16:57 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	afg_0.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ Frame E6A5	179 KB 179 KB	179ms 176ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/afg_0.jpg?itok=T4BEyQaL Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash ebc73e7a3908b08324b2a322d93aa6576610af0e3a4e5d4356b2cfdf6b9c9b57 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Fri, 25 Feb 2022 11:40:37 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	ukraine_conflict_escalation_icrc.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ Frame E6A5	230 KB 231 KB	158ms 155ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image/ukraine_conflict_escalation_icrc.jpg?itok=onNnQi_m Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 528e0b240675469122a02c87645c11deba7bb6dbd90621b6616b63eba88c7a9e Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Thu, 24 Feb 2022 15:57:21 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	central-african-republic-conflict-geneva-conventions.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image_thumbnail/ Frame E6A5	146 KB 146 KB	158ms 155ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image_thumbnail/central-african-republic-conflict-geneva-conventions.jpg?itok=V_FO1JLO Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 48905514f2ca98f5650f12346e41cf2a69750480c4f3319d65c29d420da5456d Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Thu, 24 Feb 2022 14:29:21 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	v-p-ua-e-00892.jpg www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image_thumbnail/ Frame E6A5	130 KB 130 KB	158ms 155ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_story_main/public/document_new/image_thumbnail/v-p-ua-e-00892.jpg?itok=IDOmRn6L Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 91bde624dd5a3cfe82fcee570648fa1e698f726cd7c4f54db6e5716be7b9d8d4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Thu, 24 Feb 2022 17:43:12 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	404	homepage-map.png hemistichal-mislead.000webhostapp.com/sites/default/themes/icrc_theme/images/ Frame E6A5	14 KB 14 KB	112ms 109ms	Image text/html	2a02:4780:dead:e211::1 AWEX
General Check archive.org Show headers Download Go to Show image Full URL https://hemistichal-mislead.000webhostapp.com/sites/default/themes/icrc_theme/images/homepage-map.png Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:e211::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 134ed6d615029fc4909d6ef1daf58e9d96254b7ec1739a739477a30181c127a7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip x-content-type-options nosniff server awex x-xss-protection 1; mode=block x-request-id 7401de8442de3e8a624bd1f4b75f5530 content-type text/html; charset=UTF-8
GET H2	404	homepage-map-marker.png hemistichal-mislead.000webhostapp.com/sites/default/themes/icrc_theme/images/ Frame E6A5	14 KB 14 KB	112ms 110ms	Image text/html	2a02:4780:dead:e211::1 AWEX
General Check archive.org Show headers Download Go to Show image Full URL https://hemistichal-mislead.000webhostapp.com/sites/default/themes/icrc_theme/images/homepage-map-marker.png Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:4780:dead:e211::1 , United States, ASN204915 (AWEX, CY), Reverse DNS Software awex / Resource Hash 134ed6d615029fc4909d6ef1daf58e9d96254b7ec1739a739477a30181c127a7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip x-content-type-options nosniff server awex x-xss-protection 1; mode=block x-request-id ca823177a844aa31f009ca4faa8b1e17 content-type text/html; charset=UTF-8
GET H2	200	helping-detainees.jpg www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/ Frame E6A5	17 KB 16 KB	74ms 72ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/helping-detainees.jpg?itok=yJZciEEb Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash f66cdce096f2817ec10691d375067d67428f3a5def4a6132e5463bb337cff1be Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 19 Dec 2017 18:45:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	restoring-links-nigeria-icrc.jpg www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/ Frame E6A5	25 KB 25 KB	73ms 71ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/restoring-links-nigeria-icrc.jpg?itok=0UZQem2R Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash ca21b91008f358de071b0917c7199e1d2209204ae52370059bcef8a20b1707e7 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 19 Dec 2017 18:45:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	protected-civilians.jpg www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/ Frame E6A5	31 KB 31 KB	144ms 142ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/protected-civilians.jpg?itok=VMp_rrSP Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash e1a583f5656b8f8da2d12c1f1a96d61646479752e412d8600ddff65e59b76ba9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 19 Dec 2017 18:45:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes content-length 31542 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	addressing-sexual-violence.jpg www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/ Frame E6A5	19 KB 19 KB	145ms 143ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/addressing-sexual-violence.jpg?itok=9mCyEI_2 Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 338a2b02e83b35a326b21462ca2ffd8363ceefc893fda6fcb47d34af31c9fa95 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 19 Dec 2017 18:45:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	enabling-people-with-disabilities.jpg www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/ Frame E6A5	29 KB 29 KB	240ms 239ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/enabling-people-with-disabilities.jpg?itok=7G_pmLT6 Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 49ffbb9f452ba973d0cfa977fe6df31e671b837ae43e3916fb763d08fde60bc1 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 19 Dec 2017 18:45:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	healthcareindanger_0.jpg www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/ Frame E6A5	26 KB 26 KB	241ms 239ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_key_operation/public/homepage_files/healthcareindanger_0.jpg?itok=X6QQsyKV Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 99bc4e3734743cd9e5ce0712ca7869f703ad638378a83adaf9da4880332eb370 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 19 Dec 2017 18:45:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	emergency_ukraine_icrc_help.png www.icrc.org/sites/default/files/styles/special_page_image/public/donation_form/image/ Frame E6A5	221 KB 222 KB	241ms 239ms	Image image/png	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/special_page_image/public/donation_form/image/emergency_ukraine_icrc_help.png?itok=hLRJgjyG Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 5059bdc2c90d88e29e541d02c6786350314e0638dbeefe7776466dec2fd98e2c Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Fri, 18 Feb 2022 09:33:56 GMT server Secured Gateway vary Accept-Encoding content-type image/png cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	screen1.jpg www.icrc.org/sites/default/files/styles/home_custom_block/public/home_custom_block/image/ Frame E6A5	77 KB 77 KB	258ms 257ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_custom_block/public/home_custom_block/image/screen1.jpg?itok=HFbTuC-8 Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash f9c41ae6a769bca0ac6d18f34288ad79073b034201c279ab58415976dce15d4c Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Thu, 09 Sep 2021 14:52:46 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	1.jpg www.icrc.org/sites/default/files/styles/home_custom_block/public/home_custom_block/image/ Frame E6A5	35 KB 35 KB	255ms 254ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_custom_block/public/home_custom_block/image/1.jpg?itok=cZ2HaNaW Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 261a74f3f44446e04f2b779a6c77a6d7ac872ba9c0340373f432430fa11806cc Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Wed, 04 Apr 2018 08:06:03 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	internal_displacement.jpg www.icrc.org/sites/default/files/styles/home_custom_block/public/home_custom_block/image/ Frame E6A5	42 KB 42 KB	240ms 239ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/home_custom_block/public/home_custom_block/image/internal_displacement.jpg?itok=_5dU-yQF Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash b52b71b9366626064f98faee64cbfbfe09a1654948e034cc9607f1417594486b Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 06 Feb 2018 10:11:27 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	js_ii9fnXHKWGpVoDCnZ8dCJZEC0N15XRpCNm632hnp6AM.js Show response www.icrc.org/sites/default/files/js/ Frame E6A5	1 MB 298 KB	61ms 61ms	Script text/javascript	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/files/js/js_ii9fnXHKWGpVoDCnZ8dCJZEC0N15XRpCNm632hnp6AM.js Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 8a2f5f9d71ca586a55a030a767c742259102d0dd795d1a42366eb7da19e9e803 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 01 Mar 2022 03:56:59 GMT server Secured Gateway vary User-Agent,Accept-Encoding content-type text/javascript cache-control max-age=604800, public accept-ranges bytes content-length 303329 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	api.js Show response www.recaptcha.net/recaptcha/ Frame E6A5	853 B 970 B	142ms 51ms	Script text/javascript	2a00:1450:4001:800::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.recaptcha.net/recaptcha/api.js?hl=en Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash c3b2092ea1b9f21b27c4c58979987c531e9c560d27d13a99b065eea6ed2b76ae Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin content-security-policy frame-ancestors 'self' alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 557 x-xss-protection 1; mode=block expires Thu, 10 Mar 2022 13:09:33 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v28/ Frame E6A5	44 KB 44 KB	159ms 74ms	Font font/woff2	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v28/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,400,700&r81sau Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 22:45:07 GMT x-content-type-options nosniff age 138266 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44656 x-xss-protection 0 last-modified Tue, 01 Mar 2022 22:03:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Mar 2023 22:45:07 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2 fonts.gstatic.com/s/opensans/v28/ Frame E6A5	24 KB 25 KB	115ms 37ms	Font font/woff2	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v28/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTSumu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,400,700&r81sau Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fcbd587432f5e88fc926d1cde0d375084b7f3e711f9ff34571dec52f70fb27cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 22:47:37 GMT x-content-type-options nosniff age 138116 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24756 x-xss-protection 0 last-modified Tue, 01 Mar 2022 22:00:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Mar 2023 22:47:37 GMT
GET H2	200	icons.woff www.icrc.org/sites/default/themes/icrc_theme/fonts/icons/ Frame E6A5	44 KB 25 KB	124ms 84ms	Font application/font-woff	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/themes/icrc_theme/fonts/icons/icons.woff Requested by Host: www.icrc.org URL: https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 0196170674a28b06cdf876aef798444cb31b9f8ac84923f96040da05cb8101e2 Request headers Referer https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 18 Jan 2022 10:01:43 GMT server Secured Gateway vary Accept-Encoding content-type application/font-woff access-control-allow-origin * cache-control max-age=604800, public accept-ranges bytes content-length 25640 expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	wm0TYebjyHQ Show response www.youtube.com/embed/ Frame DA25	59 KB 26 KB	171ms 84ms	Document text/html	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/wm0TYebjyHQ Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f595b6325b6ac0f8b084cfe18372552f16a489c2429b9a45897595d004e06cb2 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ Response headers content-type text/html; charset=utf-8 x-content-type-options nosniff cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Thu, 10 Mar 2022 13:09:33 GMT strict-transport-security max-age=31536000 cross-origin-opener-policy-report-only same-origin; report-to="ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=* report-to {"group":"ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94"}]} p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info." content-encoding br server ESF x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	ukraine_people_fleeing.jpg www.icrc.org/sites/default/files/styles/special_page_image/public/home_carousel_slide/image/ Frame E6A5	358 KB 361 KB	210ms 210ms	Image image/jpeg	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Show image Full URL https://www.icrc.org/sites/default/files/styles/special_page_image/public/home_carousel_slide/image/ukraine_people_fleeing.jpg?itok=6_Y592zc Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 5e9db8212a52ed0a73aa23b5418c6f056ecd950e891be5d35c0aa23470261122 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Tue, 08 Mar 2022 13:14:21 GMT server Secured Gateway vary Accept-Encoding content-type image/jpeg cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 fonts.gstatic.com/s/opensans/v28/ Frame E6A5	47 KB 47 KB	121ms 97ms	Font font/woff2	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v28/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:400italic,700italic,400,700&r81sau Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f57a038a716263766ff4d7f7d8a6ea13b22701ae6fc91e8b1b52fd8784844d23 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 22:53:33 GMT x-content-type-options nosniff age 137760 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 47836 x-xss-protection 0 last-modified Tue, 01 Mar 2022 22:01:28 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Mar 2023 22:53:33 GMT
GET H2	200	Merriweather-Regular.ttf www.icrc.org/sites/default/themes/icrc_theme/fonts/merriweather/ Frame E6A5	175 KB 86 KB	132ms 131ms	Font application/font-sfnt	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/themes/icrc_theme/fonts/merriweather/Merriweather-Regular.ttf Requested by Host: www.icrc.org URL: https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 93fc8bdd56e2000b7dfee9e350a6c52cca1a4d546ff23b2b11ffd36879351f1d Request headers Referer https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Thu, 20 May 2021 06:26:39 GMT server Secured Gateway vary Accept-Encoding content-type application/font-sfnt access-control-allow-origin * cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	Merriweather-Bold.ttf www.icrc.org/sites/default/themes/icrc_theme/fonts/merriweather/ Frame E6A5	161 KB 83 KB	132ms 132ms	Font application/font-sfnt	195.70.1.223 DFINET Geneva
General Check archive.org Show headers Download Go to Full URL https://www.icrc.org/sites/default/themes/icrc_theme/fonts/merriweather/Merriweather-Bold.ttf Requested by Host: www.icrc.org URL: https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 195.70.1.223 Geneva, Switzerland, ASN12333 (DFINET Geneva, Switzerland, CH), Reverse DNS 223.1.70.195.rev.dfinet.net Software Secured Gateway / Resource Hash 07c866cc42802badf0a880658041570acf606eb2525bbd26ac4db202a2e129ad Request headers Referer https://www.icrc.org/sites/default/files/css/css_fcGblGucWj8SN913y03lmiNx7MNZ54Od9QOFPyyjWJo.css Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip last-modified Thu, 20 May 2021 06:26:33 GMT server Secured Gateway vary Accept-Encoding content-type application/font-sfnt access-control-allow-origin * cache-control max-age=604800, public accept-ranges bytes expires Thu, 17 Mar 2022 13:09:33 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/ Frame E6A5	341 KB 90 KB	138ms 52ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-FVTRGQ Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0ff8f17fca8d406391c99b1bc202e069ffbceccf4c8ab5808901dd8419a8d765 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 91889 x-xss-protection 0 last-modified Thu, 10 Mar 2022 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 10 Mar 2022 13:09:34 GMT
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/_exWVY_hlNJJl2Abm8pI9i1L/ Frame E6A5	356 KB 141 KB	127ms 39ms	Script text/javascript	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/_exWVY_hlNJJl2Abm8pI9i1L/recaptcha__en.js Requested by Host: www.recaptcha.net URL: https://www.recaptcha.net/recaptcha/api.js?hl=en Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d526e08d2f18f7fea947247c440cf46473ed39655b4931e959939c383291f665 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://hemistichal-mislead.000webhostapp.com/ Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 07:03:26 GMT content-encoding gzip x-content-type-options nosniff age 21968 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 143652 x-xss-protection 0 last-modified Mon, 28 Feb 2022 23:43:01 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Fri, 10 Mar 2023 07:03:26 GMT
GET H2	200	www-player.css www.youtube.com/s/player/6d3a4914/ Frame DA25	338 KB 46 KB	40ms 39ms	Stylesheet text/css	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2476db472bf1df970adab62d57f3a0b552319b91459a39a728b10130ed10c817 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 47168 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H2	200	www-embed-player.js Show response www.youtube.com/s/player/6d3a4914/www-embed-player.vflset/ Frame DA25	279 KB 86 KB	64ms 63ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a9d79ededb315b264c9a08d890fb258fff9ea733c75e01cf47e545ebcb12afe8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 88128 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H2	200	base.js Show response www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/ Frame DA25	2 MB 523 KB	91ms 90ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1cc5a28f3c8ebca4c1e5114b70b0284ca2bb9e36b47c643804ad3b9d56f2f078 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 535572 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H2	200	fetch-polyfill.js Show response www.youtube.com/s/player/6d3a4914/fetch-polyfill.vflset/ Frame DA25	9 KB 3 KB	108ms 107ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2786 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame DA25	15 KB 15 KB	39ms 39ms	Font font/woff2	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 17:06:41 GMT x-content-type-options nosniff age 158573 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 08 Mar 2023 17:06:41 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/ Frame E6A5	49 KB 20 KB	39ms 39ms	Script text/javascript	2a00:1450:4001:828::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-FVTRGQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 3882 date Thu, 10 Mar 2022 12:04:52 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Thu, 10 Mar 2022 14:04:52 GMT
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/ Frame E6A5	39 KB 15 KB	134ms 51ms	Script text/javascript	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-FVTRGQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14889 x-xss-protection 0 server cafe etag 11178597599353190569 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 10 Mar 2022 13:09:34 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/ Frame E6A5	14 KB 6 KB	35ms 6ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-FVTRGQ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip last-modified Sat, 05 Feb 2022 00:44:37 GMT etag "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip" vary Accept-Encoding,Host x-tw-cdn FT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" cache-control no-cache x-cache HIT, HIT accept-ranges bytes content-type application/javascript; charset=utf-8 content-length 5410 x-served-by cache-iad-kcgs7200157-IAD, cache-fra19180-FRA
GET H2	200	2537822.js Show response js.hs-analytics.net/analytics/1646917800000/ Frame E6A5	62 KB 20 KB	56ms 23ms	Script text/javascript	2606:4700::6811:46b0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1646917800000/2537822.js Requested by Host: holy-violet-5937.on.fleek.co URL: https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 445ea445082a3fd10ca0c7930aa11ff79180536cc3277611ddbca000770fd904 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding br cf-cache-status HIT age 223 x-amz-server-side-encryption AES256 x-amz-request-id W6FY0DJD3VF0ZQM3 x-amz-id-2 Vtw6iAm7PamrgtLeaHmIVEoijVp9APMsEYGcR9BY7Gc01awagOA9aMTiHU3L1F3fufPmua8hrm0= last-modified Sun, 27 Feb 2022 20:00:20 GMT server cloudflare etag W/"3633aa160aa1f3d8d6fd5da2768e5773" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript cache-control max-age=300, public access-control-allow-credentials false x-amz-version-id null cf-ray 6e9c49198d279189-FRA expires Thu, 10 Mar 2022 13:10:51 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/ Frame E6A5	99 KB 27 KB	26ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: holy-violet-5937.on.fleek.co URL: https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f2649db29712c0b6bb0702c7c4b1187b10ec39f238ddee4f17a614fa64ce31f3 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 26291 x-xss-protection 0 pragma public x-fb-debug 1d3pMggUz4O8bCBx7FmLUC1C/Fe70pMbLlRRRkvRIeV4qts7Ba4VQUtdIwxvYLIovEG93MyuMS35Q51GsJhLfw== x-fb-trip-id 917726464 x-frame-options DENY cross-origin-opener-policy same-origin-allow-popups cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Thu, 10 Mar 2022 13:09:34 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/ Frame E6A5	100 KB 39 KB	95ms 50ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-779809802 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-FVTRGQ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 79b724c2d392cf011d65e045dbb142b4e10f65842df3ca222b5be4f10398fa27 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40418 x-xss-protection 0 last-modified Thu, 10 Mar 2022 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 10 Mar 2022 13:09:34 GMT
GET H3	200	wm0TYebjyHQ Show response www.youtube.com/embed/ Frame DA25	59 KB 25 KB	88ms 87ms	Document text/html	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Requested by Host: holy-violet-5937.on.fleek.co URL: https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 79928a8b475fe99b1c11cbea155bcb06ec9e03e2c480325b503e57f37f463675 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ Response headers content-type text/html; charset=utf-8 x-content-type-options nosniff cache-control no-cache, no-store, max-age=0, must-revalidate pragma no-cache expires Mon, 01 Jan 1990 00:00:00 GMT date Thu, 10 Mar 2022 13:09:34 GMT strict-transport-security max-age=31536000 cross-origin-opener-policy-report-only same-origin; report-to="ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=* report-to {"group":"ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94"}]} content-encoding br server ESF x-xss-protection 0 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	iframe_api Show response www.youtube.com/ Frame E6A5	980 B 514 B	59ms 59ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: holy-violet-5937.on.fleek.co URL: https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 760e1b95dee60adaa80052d895edb956e9686a81837394950862a0bed2b7423a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding br x-content-type-options nosniff p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 server ESF x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 report-to {"group":"ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94"}]} content-type text/javascript; charset=utf-8 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version cache-control private, max-age=0 permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=* cross-origin-opener-policy-report-only same-origin; report-to="ATmXEA_XZXH6CdbrmjUzyTbVgxu22C8KYH7NsxKbRt94" expires Thu, 10 Mar 2022 13:09:34 GMT
GET H2	404	45687980.js extend.vimeocdn.com/ga/ Frame E6A5	0 0	37ms 6ms	Script text/html	151.101.114.109 FASTLY
General Check archive.org Show headers Download Go to Full URL https://extend.vimeocdn.com/ga/45687980.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-FVTRGQ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers
GET H3	200	1152626968150232 Show response connect.facebook.net/signals/config/ Frame E6A5	307 KB 87 KB	17ms 8ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1152626968150232?v=2.9.55&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 800dfd90f5865d2e95df01c8247d9aaa5b522b2b6bb512d7b2c80313f6055781 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 89215 x-xss-protection 0 pragma public x-fb-debug 6oTzlWqrikFpcYlG4u5GfjI+SMuSZ4lslMYzpq1C5ANOznDKZNuDsfaWAB35LIfrCjexw95tWtCgU0glphaAng== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 10 Mar 2022 13:09:34 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	adsct Show response analytics.twitter.com/i/ Frame E6A5	31 B 238 B	146ms 123ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o5nwp&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&event_id=90f342da-47fe-485f-9f99-e5424bd8577c&tw_document_referrer=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tw_document_href=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&tpx_cb=twttr.conversion.loadPixels Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-response-time 117 date Thu, 10 Mar 2022 13:09:33 GMT content-encoding gzip server tsa_o strict-transport-security max-age=631138519 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" cache-control no-cache, no-store, max-age=0 x-connection-hash bc5ec252d7ff1824f76b8ccb566863ed1b2c2e2f4bb19d5bc23f24b45077f3f8 content-type application/javascript;charset=utf-8 content-length 57
GET H2	200	adsct Show response analytics.twitter.com/i/ Frame E6A5	31 B 459 B	136ms 114ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nzlxi&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&event_id=8c1a4e5e-3707-4a25-8629-1f2db041be7f&tw_document_referrer=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tw_document_href=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&tpx_cb=twttr.conversion.loadPixels Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-response-time 107 date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip server tsa_o strict-transport-security max-age=631138519 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" cache-control no-cache, no-store, max-age=0 x-connection-hash bc5ec252d7ff1824f76b8ccb566863ed1b2c2e2f4bb19d5bc23f24b45077f3f8 content-type application/javascript;charset=utf-8 content-length 57
GET H2	200	adsct t.co/i/ Frame E6A5	43 B 337 B	134ms 112ms	Image image/gif	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=o5nwp&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&event_id=90f342da-47fe-485f-9f99-e5424bd8577c&tw_document_referrer=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tw_document_href=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-response-time 104 date Thu, 10 Mar 2022 13:09:33 GMT server tsa_o strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, max-age=0 x-connection-hash cd888d1ee6451ce5bc858e7d1c0b1ff26cdeda68b03adabf8b8de11db8c8a07b content-length 43
GET H2	200	adsct t.co/i/ Frame E6A5	43 B 188 B	142ms 120ms	Image image/gif	104.244.42.133 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nzlxi&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=1&event_id=8c1a4e5e-3707-4a25-8629-1f2db041be7f&tw_document_referrer=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tw_document_href=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.133 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers x-response-time 111 date Thu, 10 Mar 2022 13:09:33 GMT server tsa_o strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, max-age=0 x-connection-hash cd888d1ee6451ce5bc858e7d1c0b1ff26cdeda68b03adabf8b8de11db8c8a07b content-length 43
GET H3	200	www-widgetapi.js Show response www.youtube.com/s/player/6d3a4914/www-widgetapi.vflset/ Frame E6A5	151 KB 49 KB	39ms 39ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/www-widgetapi.vflset/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2c91d25920725d8c0aa577bf2e24118287a91ee00afa6c8a0ad79c5572543926 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 10:47:46 GMT content-encoding br x-content-type-options nosniff age 8508 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 50160 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Fri, 10 Mar 2023 10:47:46 GMT
GET H3	200	188661792126228 Show response connect.facebook.net/signals/config/ Frame E6A5	307 KB 87 KB	8ms 8ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/188661792126228?v=2.9.55&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 44e6800bbd7b6795ba77044b3f4a2f37105ca5337be3303d2d743234abc9d54a Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 89181 x-xss-protection 0 pragma public x-fb-debug 9t4h5wK1JEnH3x23X2AzeYOCCTYsOCmT0V5+9XI0ju4NG+yU0AnhxgDrAHE8yzugnL8DOJZYIy5nX8GFd4tgyg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 10 Mar 2022 13:09:34 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/ Frame E6A5	44 B 297 B	23ms 7ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1152626968150232&ev=PageView&dl=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&rl=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&if=true&ts=1646917774378&sw=1600&sh=1200&v=2.9.55&r=stable&ec=0&o=30&it=1646917774330&coo=false&rqm=GET Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 44 expires Thu, 10 Mar 2022 13:09:34 GMT
GET H3	200	3720234441403848 Show response connect.facebook.net/signals/config/ Frame E6A5	307 KB 87 KB	8ms 8ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/3720234441403848?v=2.9.55&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 43c2bac9bc33cc1e79c12e9d1bf0ba344cdaa66efd51d8d5c0e97f5ba507d1be Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 89217 x-xss-protection 0 pragma public x-fb-debug Kig//+KIf5iy9/kneLqYjnvq6rCBTV4rWGF3gZU/B5B3sGmpd24J6OSFLBU4O5wTP0bgJos5Iff+dBLRWS+nmQ== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 10 Mar 2022 13:09:34 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	/ www.facebook.com/tr/ Frame E6A5	44 B 91 B	17ms 7ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=188661792126228&ev=PageView&dl=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&rl=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&if=true&ts=1646917774405&sw=1600&sh=1200&v=2.9.55&r=stable&ec=0&o=30&it=1646917774330&coo=false&rqm=GET Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin content-length 44 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=3,i expires Thu, 10 Mar 2022 13:09:34 GMT
GET H3	200	www-player.css www.youtube.com/s/player/6d3a4914/ Frame DA25	338 KB 46 KB	41ms 41ms	Stylesheet text/css	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2476db472bf1df970adab62d57f3a0b552319b91459a39a728b10130ed10c817 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 47168 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame DA25	15 KB 15 KB	39ms 39ms	Font font/woff2	2a00:1450:4001:827::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Tue, 08 Mar 2022 17:06:41 GMT x-content-type-options nosniff age 158573 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 08 Mar 2023 17:06:41 GMT
GET H3	200	www-embed-player.js Show response www.youtube.com/s/player/6d3a4914/www-embed-player.vflset/ Frame DA25	279 KB 86 KB	46ms 46ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a9d79ededb315b264c9a08d890fb258fff9ea733c75e01cf47e545ebcb12afe8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 88128 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H3	200	base.js Show response www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/ Frame DA25	2 MB 523 KB	52ms 52ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1cc5a28f3c8ebca4c1e5114b70b0284ca2bb9e36b47c643804ad3b9d56f2f078 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 535572 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H3	200	fetch-polyfill.js Show response www.youtube.com/s/player/6d3a4914/fetch-polyfill.vflset/ Frame DA25	9 KB 3 KB	58ms 58ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:48 GMT content-encoding br x-content-type-options nosniff age 72286 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2786 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:48 GMT
GET H3	200	232213835381557 Show response connect.facebook.net/signals/config/ Frame E6A5	307 KB 87 KB	8ms 8ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/232213835381557?v=2.9.55&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c0da5d84e2c2505d913dd326ed29e014fff304cb7c977ccd6afe62b0679d6a50 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 89246 x-xss-protection 0 pragma public x-fb-debug vJLLlO6HWddzhEc17K7lE+TUI2o5AxMxQSdXLBpqtDC/DcxZPPDJXWkvIUtXBD1YlB+SPdN4QgngCZspFm/Mvw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Thu, 10 Mar 2022 13:09:34 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	/ www.facebook.com/tr/ Frame E6A5	44 B 88 B	7ms 7ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=3720234441403848&ev=PageView&dl=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&rl=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&if=true&ts=1646917774445&sw=1600&sh=1200&v=2.9.55&r=stable&a=tmgoogletagmanager&ec=0&o=30&it=1646917774330&coo=false&rqm=GET Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin content-length 44 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=3,i expires Thu, 10 Mar 2022 13:09:34 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/779809802/ Frame E6A5	2 KB 2 KB	136ms 51ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/779809802/?random=1646917774447&cv=9&fst=1646917774447&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa370&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash bf9a6a3e53f2fca44bb708ac5b4482db0116a889a4f05115956c8efeabe8cde3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1108 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/987909199/ Frame E6A5	2 KB 1 KB	143ms 59ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/987909199/?random=1646917774450&cv=9&fst=1646917774450&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash cc2fcdffcb11d6ef11d5336c18c817183c2663b61820804caaae95ef1f75a147 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1091 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ Show response www.googleadservices.com/pagead/conversion/987909199/ Frame E6A5	2 KB 1 KB	98ms 49ms	Script text/javascript	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion/987909199/?random=1646917774451&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&bttype=purchase&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash 4232fff11e85ec46ab68c47e7b6feef3f3e7d18afa3a435af3e1a7cf4bbd2bb2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1273 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.facebook.com/tr/ Frame E6A5	44 B 88 B	7ms 7ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=232213835381557&ev=PageView&dl=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&rl=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&if=true&ts=1646917774492&sw=1600&sh=1200&v=2.9.55&r=stable&ec=0&o=30&it=1646917774330&coo=false&rqm=GET Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin content-length 44 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=3,i expires Thu, 10 Mar 2022 13:09:34 GMT
GET H3	200	/ www.google.de/pagead/1p-conversion/987909199/ Frame E6A5 Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO... https://www.google.com/pagead/1p-conversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_... https://www.google.de/pagead/1p-conversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_a...	42 B 64 B	106ms 57ms	Image image/gif	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-conversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=jvgpYp3KH8vvgQekjKvgBw&eitems=ChAIgOCmkQYQ3uqtsai2lM1kEh0Ab28nvLdKBA0RYKhgwiGOcYt_LRDnE7TExsBZ7A&random=684075251&resp=GooglemKTybQhCsO&ipr=y&prhg=0 Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif location https://www.google.de/pagead/1p-conversion/987909199/?random=1998932072&cv=9&fst=1646917774451&num=1&value=0&label=CHGtCN7t__kCEM-YidcD&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=CNPgGw&is_vtc=1&ocp_id=jvgpYp3KH8vvgQekjKvgBw&eitems=ChAIgOCmkQYQ3uqtsai2lM1kEh0Ab28nvLdKBA0RYKhgwiGOcYt_LRDnE7TExsBZ7A&random=684075251&resp=GooglemKTybQhCsO&ipr=y&prhg=0 cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/779809802/ Frame E6A5	42 B 548 B	135ms 52ms	Image image/gif	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/779809802/?random=1646917774447&cv=9&fst=1646917200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa370&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&async=1&fmt=3&is_vtc=1&random=2137599736&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/779809802/ Frame E6A5	42 B 108 B	140ms 53ms	Image image/gif	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/779809802/?random=1646917774447&cv=9&fst=1646917200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa370&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&async=1&fmt=3&is_vtc=1&random=2137599736&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/987909199/ Frame E6A5	42 B 108 B	130ms 56ms	Image image/gif	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/987909199/?random=1646917774450&cv=9&fst=1646917200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&async=1&fmt=3&is_vtc=1&random=1479491262&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/987909199/ Frame E6A5	42 B 548 B	129ms 52ms	Image image/gif	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/987909199/?random=1646917774450&cv=9&fst=1646917200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg370&sendb=1&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&async=1&fmt=3&is_vtc=1&random=1479491262&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	id Show response googleads.g.doubleclick.net/pagead/ Frame DA25 Redirect Chain https://googleads.g.doubleclick.net/pagead/id https://googleads.g.doubleclick.net/pagead/id?slf_rd=1	100 B 146 B	43ms 43ms	XHR application/json	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0d0ab7488cbc1ab71abadf017e2f8625bc67baf9a0d64ee50615d705607cd1fb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 120 x-xss-protection 0 pragma no-cache server cafe content-type application/json; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers date Thu, 10 Mar 2022 13:09:34 GMT x-content-type-options nosniff access-control-allow-origin https://www.youtube.com p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 pragma no-cache server cafe content-type text/html; charset=UTF-8 location https://googleads.g.doubleclick.net/pagead/id?slf_rd=1 cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ad_status.js Show response static.doubleclick.net/instream/ Frame DA25	29 B 588 B	127ms 39ms	Script text/javascript	2a00:1450:4001:813::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://static.doubleclick.net/instream/ad_status.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/6d3a4914/www-embed-player.vflset/www-embed-player.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 12:59:18 GMT x-content-type-options nosniff age 616 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29 x-xss-protection 0 last-modified Thu, 12 Dec 2013 23:40:16 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=900 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Thu, 10 Mar 2022 13:14:18 GMT
GET H3	200	remote.js Show response www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/ Frame DA25	119 KB 37 KB	41ms 40ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/remote.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92232b7cf8520e616debed228708fd3c14b0154288b52cc625d6b2a5da08b8e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:49 GMT content-encoding br x-content-type-options nosniff age 72285 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37929 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:49 GMT
GET H2	200	lgrQep_cHvWFMgJTnyMczGzKq0lFy3dFEtoDT0eWErg.js Show response www.google.com/js/th/ Frame DA25	35 KB 14 KB	41ms 41ms	Script text/javascript	2a00:1450:4001:808::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/js/th/lgrQep_cHvWFMgJTnyMczGzKq0lFy3dFEtoDT0eWErg.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 960ad07a9fdc1ef5853202539f231ccc6ccaab4945cb774512da034f479612b8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 08:37:44 GMT content-encoding br x-content-type-options nosniff age 16310 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13675 x-xss-protection 0 last-modified Tue, 01 Mar 2022 18:00:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Fri, 10 Mar 2023 08:37:44 GMT
GET H3	200	embed.js Show response www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/ Frame DA25	26 KB 8 KB	40ms 39ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/embed.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7d0e63b68198b0d27f333edfdb18d596993bc86c90c2ee14cc5981cb51f8834a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 17:04:49 GMT content-encoding br x-content-type-options nosniff age 72285 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7796 x-xss-protection 0 last-modified Wed, 09 Mar 2022 01:22:50 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 09 Mar 2023 17:04:49 GMT
GET DATA	200 OK	truncated / Frame DA25	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers Content-Type image/png
GET H2	200	AKedOLRnmHf3Fwbsm8otT5iWseuHy0TkALyfG9YlGhXJTQ=s68-c-k-c0x00ffffff-no-rj yt3.ggpht.com/ytc/ Frame DA25	2 KB 2 KB	126ms 40ms	Image image/jpeg	2a00:1450:4001:811::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://yt3.ggpht.com/ytc/AKedOLRnmHf3Fwbsm8otT5iWseuHy0TkALyfG9YlGhXJTQ=s68-c-k-c0x00ffffff-no-rj Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash cbe4dcc03ff372c53318a8d45b3dff4e49a570b6456951932e65b3c8205bc53f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 10:01:54 GMT x-content-type-options nosniff age 11260 content-disposition inline;filename="unnamed.jpg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1694 x-xss-protection 0 server fife etag "v2188" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Thu, 18 Nov 2021 15:59:57 GMT
GET H2	200	maxresdefault.webp i.ytimg.com/vi_webp/wm0TYebjyHQ/ Frame DA25	30 KB 30 KB	150ms 38ms	Image image/webp	2a00:1450:4001:813::2016 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://i.ytimg.com/vi_webp/wm0TYebjyHQ/maxresdefault.webp Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7dece86c0693bd514a47e5b22896bbb54fede086f3720e1962a3fdff544833ea Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 12:52:47 GMT x-content-type-options nosniff age 1007 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30528 x-xss-protection 0 server sffe etag "1646391104" vary Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type image/webp cache-control public, max-age=7200 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Thu, 10 Mar 2022 14:52:47 GMT
GET H3	200	cast_sender.js Show response www.gstatic.com/cv/js/sender/v1/ Frame DA25	4 KB 2 KB	89ms 45ms	Script text/javascript	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/cv/js/sender/v1/cast_sender.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/6d3a4914/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2007 x-xss-protection 0 last-modified Tue, 16 Feb 2021 23:57:06 GMT server sffe cross-origin-opener-policy same-origin; report-to="cloudview" vary Accept-Encoding report-to {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Thu, 10 Mar 2022 13:09:34 GMT
GET H3	204	generate_204 www.youtube.com/ Frame DA25	0 9 B	41ms 40ms	Image text/plain	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.youtube.com/generate_204?vG1SuA Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/wm0TYebjyHQ?enablejsapi=1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:34 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0
GET H3	200	cast_sender.js Show response www.gstatic.com/eureka/clank/99/ Frame DA25	53 KB 15 KB	37ms 36ms	Script text/javascript	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/eureka/clank/99/cast_sender.js Requested by Host: www.gstatic.com URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6c31dcc878ab2e52cea5f38b4c3f1d1cfec4dbae070da4e460b336b3705bc423 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Wed, 09 Mar 2022 19:08:57 GMT content-encoding gzip x-content-type-options nosniff age 64837 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15479 x-xss-protection 0 last-modified Mon, 10 Jan 2022 16:05:27 GMT server sffe cross-origin-opener-policy same-origin; report-to="cloudview-release" vary Accept-Encoding report-to {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]} content-type text/javascript cache-control public, max-age=86400 accept-ranges bytes expires Thu, 10 Mar 2022 19:08:57 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame C27D	0 15 B	8ms 7ms	Document text/plain	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 Origin https://hemistichal-mislead.000webhostapp.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ Response headers content-type text/plain access-control-allow-origin https://hemistichal-mislead.000webhostapp.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=0 date Thu, 10 Mar 2022 13:09:34 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 47ED	0 15 B	7ms 7ms	Document text/plain	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 Origin https://hemistichal-mislead.000webhostapp.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ Response headers content-type text/plain access-control-allow-origin https://hemistichal-mislead.000webhostapp.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=0 date Thu, 10 Mar 2022 13:09:34 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 83E9	0 15 B	7ms 7ms	Document text/plain	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 Origin https://hemistichal-mislead.000webhostapp.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ Response headers content-type text/plain access-control-allow-origin https://hemistichal-mislead.000webhostapp.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=0 date Thu, 10 Mar 2022 13:09:35 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 6063	0 15 B	7ms 7ms	Document text/plain	2a03:2880:f11c:8083:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: hemistichal-mislead.000webhostapp.com URL: https://hemistichal-mislead.000webhostapp.com/bg.php?domain=http://icrc.org Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Upgrade-Insecure-Requests 1 Origin https://hemistichal-mislead.000webhostapp.com Content-Type application/x-www-form-urlencoded User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ Response headers content-type text/plain access-control-allow-origin https://hemistichal-mislead.000webhostapp.com access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin content-length 0 server proxygen-bolt alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=0 date Thu, 10 Mar 2022 13:09:35 GMT
GET H2	200	2537822.js Show response js-na1.hs-scripts.com/ Frame E6A5	2 KB 983 B	343ms 302ms	Script application/javascript	2606:4700::6811:d6cc
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/2537822.js Requested by Host: js.hs-analytics.net URL: https://js.hs-analytics.net/analytics/1646917800000/2537822.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:d6cc -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 9258f195913cac2326537c0bcb57b8e02dcbfc79b72f14e0fae753765ecc88a4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT content-encoding br cf-cache-status EXPIRED last-modified Thu, 10 Mar 2022 13:08:09 GMT server cloudflare x-hubspot-correlation-id e2c99505-ea55-4297-a101-b1b5adcb690e x-trace 2B490CBD99B0C386B856A7DE985A1C470C4EE4E2F3000000000000000000 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript;charset=utf-8 access-control-allow-origin https://hemistichal-mislead.000webhostapp.com access-control-max-age 3600 cache-control public, max-age=30 access-control-allow-credentials true cf-ray 6e9c491e5aea9162-FRA
GET H2	200	__ptq.gif track.hubspot.com/ Frame E6A5	45 B 968 B	167ms 135ms	Image image/gif	2606:4700::6813:9b53
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2203515711&v=1.1&a=2537822&rcu=https%3A%2F%2Fwww.icrc.org%2Fen&r=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&pu=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&t=International+Committee+of+the+Red+Cross&cts=1646917775053&vi=f018a00bcebddd643b40ee11f87681e3&nc=true&ce=false&cc=0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9b53 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT vary Accept-Encoding cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id b32c769e-9b1f-4e8c-a1a6-034180a9cf33 cf-ray 6e9c491e4cb09b94-FRA p3p CP="NOI CUR ADM OUR NOR STA NID" alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 45 server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U03jNyM33FaYWJvjZNMPDwdJrurONMGO%2BAI9RFnXlOtWJHNm05cXHcxSUPq%2BGCxWj4nWAPq5SQpy7xCFED3x5ylCnuU5w1U1yGYrOHvS4nv8nymQD1K8sAhvf6GyU%2B4krxOr5SqLf%2BZvP7mdNPT7"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control no-cache, no-store, no-transform access-control-allow-credentials false x-robots-tag none
GET H2	200	fb.js Show response js.hsadspixel.net/ Frame E6A5	6 KB 3 KB	268ms 29ms	Script application/javascript	2606:4700::6811:71b0
General Check archive.org Show headers Download Go to Full URL https://js.hsadspixel.net/fb.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/2537822.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:71b0 -, , ASN (), Reverse DNS Software cloudflare / Resource Hash eb225958987016b36f094989fbe48ad4a7ce3bba2d0e7b37959201882e1221ed Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT via 1.1 3d65275b81abaf880be10de6f2c71e9a.cloudfront.net (CloudFront) cf-cache-status HIT age 64 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=adsscriptloaderstatic/static-1.269/bundles/pixels-release.js&cfRay=6e9c478daa7d9022-IAD x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 x-amz-replication-status COMPLETED content-encoding br last-modified Mon, 07 Mar 2022 01:20:12 UTC server cloudflare etag W/"cd6791191c766c4b4cd5212993b31719" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-amz-version-id En6lmXZtHf0knKuoSy740cltB31X5OXh cache-control max-age=600 x-hs-cache-status HIT x-amz-cf-pop IAD89-P1 cf-ray 6e9c4921cd309028-FRA x-amz-cf-id dJne2ubWsQWApNXAUDlYyZgO7sO55YBtzcz5ucgvbsllii8gngMpng== x-hs-target-asset adsscriptloaderstatic/static-1.269/bundles/pixels-release.js
GET H2	200	2537822.js Show response js.hs-banner.com/ Frame E6A5	61 KB 16 KB	262ms 24ms	Script text/javascript	2606:4700::6812:14bf
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/2537822.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/2537822.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:14bf -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 049213df658f238a2cbc2e4e3256f936339a2a32d7d84d22a2daa2d80d9a22a9 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT content-encoding br cf-cache-status HIT age 245 x-amz-server-side-encryption AES256 content-type text/javascript; charset=UTF-8 access-control-max-age 604800 x-amz-request-id KS8CSNBX3ECJVTM8 x-amz-id-2 K1tt4gM+pssdu8r8MDKibsapsudC3nCZqT6rnzFSxp4JVRsNyhoKN9ibpDtILgnV5DhGbUN+5wo= timing-allow-origin * last-modified Sun, 27 Feb 2022 20:00:21 GMT server cloudflare etag W/"7b1ede4bf5e7f959c84555728b0560fb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-amz-version-id hd_MmEvUBRPVpIfFW98HUN0oPqjf9gkQ access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300, public access-control-allow-credentials true cf-ray 6e9c4921bf679975-FRA access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id expires Thu, 10 Mar 2022 13:10:30 GMT
GET H2	200	leadflows.js Show response js.hsleadflows.net/ Frame E6A5	534 KB 87 KB	276ms 37ms	Script application/javascript	2606:4700::6811:e7cc
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/2537822.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:e7cc -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 947d6c755989ac2b8e761deb8f7c3d38c30f9e01ce86b4ce1c8f3a2e1d1e5221 Request headers Referer https://hemistichal-mislead.000webhostapp.com/ Origin https://hemistichal-mislead.000webhostapp.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT via 1.1 8c1cde7cef0a6f5dc839234d2bb2bca4.cloudfront.net (CloudFront) cf-cache-status HIT age 1445 x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://exceptions.hubspot.com/csp/report?resource=lead-flows-js/static-1.1080/bundle/main/lead-flows-release.js&cfRay=6e9c25db2aeb9b5d-FRA x-cache Hit from cloudfront access-control-max-age 3000 x-amz-replication-status COMPLETED content-encoding br cf-ray 6e9c4921ce6a90dc-FRA last-modified Tue, 01 Mar 2022 09:57:40 UTC server cloudflare etag W/"57a8210ba9519a68ae76dcc1857db0f9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET x-amz-version-id qE7M39zrJ2dCa.o34UdW.NnTPVZDG9U3 access-control-allow-origin * cache-control s-maxage=86400, max-age=0 x-hs-cache-status MISS x-amz-cf-pop IAD89-P1 content-type application/javascript; charset=utf-8 x-amz-cf-id wYA5cH50soOd4W5-IRIIbxqy_j6dX4dh4GKe0C_m9BubKFiaXpyUxQ== x-hs-target-asset lead-flows-js/static-1.1080/bundle/main/lead-flows-release.js
GET H2	200	json Show response api.hubapi.com/hs-script-loader-public/v1/config/pixel/ Frame E6A5	67 B 921 B	185ms 151ms	XHR application/json	2606:4700::6811:cacc
General Check archive.org Show headers Download Go to Full URL https://api.hubapi.com/hs-script-loader-public/v1/config/pixel/json?portalId=2537822 Requested by Host: js.hsadspixel.net URL: https://js.hsadspixel.net/fb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:cacc -, , ASN (), Reverse DNS Software cloudflare / Resource Hash 400e42641199a2d7c69948c42dbd58ac92b0785b5e5e16bdea1d46f73bd8b719 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT content-encoding br vary Accept-Encoding cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-hubspot-correlation-id 71be83c5-f9a5-419b-8eb6-8a554e063f7f access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 server cloudflare x-trace 2B3177CE78953BBE296EFEAFE5914765971D9A1E7F000000000000000000 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" access-control-max-age 180 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JZnyRtcEvfN40PvJgXRTcPc5mMFUlUdZ559ynBbif7f5u9D7fEcUtMVE9kaN%2BPNUXu0GDhFDNz2O5dYPkDYfKx4yRnU%2BA884eBs5Fzd8mKCV9GB7R2SpMn5l7p%2BOe%2BgBdUTamCG5Dr%2BxAOBe"}],"group":"cf-nel","max_age":604800} content-type application/json;charset=utf-8 access-control-allow-origin https://hemistichal-mislead.000webhostapp.com access-control-allow-credentials false cf-ray 6e9c492248c39bd4-FRA access-control-allow-headers *
GET H3	200	js Show response www.googletagmanager.com/gtag/ Frame E6A5	100 KB 40 KB	47ms 46ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-987909199 Requested by Host: js.hsadspixel.net URL: https://js.hsadspixel.net/fb.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 10491bfbd79e67142821f71f63c3707890ee4103f5550fb484f2450dbc160bc3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40420 x-xss-protection 0 last-modified Thu, 10 Mar 2022 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 10 Mar 2022 13:09:35 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/ Frame E6A5	100 KB 40 KB	55ms 55ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-987909199&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-779809802 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d89ebe89a44cf22a330a3900485c00d815d09bf8791ed67333ee1c41b424fbe9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 40423 x-xss-protection 0 last-modified Thu, 10 Mar 2022 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 10 Mar 2022 13:09:35 GMT
GET H3	200	conversion_async.js Show response www.googleadservices.com/pagead/ Frame E6A5	39 KB 15 KB	58ms 58ms	Script text/javascript	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-987909199 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers date Thu, 10 Mar 2022 13:09:35 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14889 x-xss-protection 0 server cafe etag 11178597599353190569 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Thu, 10 Mar 2022 13:09:35 GMT
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/987909199/ Frame E6A5	2 KB 1 KB	55ms 55ms	Script text/javascript	2a00:1450:4001:800::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/987909199/?random=1646917776011&cv=9&fst=1646917776011&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa370&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c8b601ce4ce99b479d0c6b9430c35997864f0708f2755cd7514e13bd87c18e0d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:36 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1109 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET		/ www.google.com/pagead/1p-user-list/987909199/ Frame E6A5	0 0
GET H3	200	/ www.google.de/pagead/1p-user-list/987909199/ Frame E6A5	42 B 64 B	52ms 52ms	Image image/gif	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/987909199/?random=1646917776011&cv=9&fst=1646917200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa370&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&async=1&fmt=3&is_vtc=1&random=1377580693&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://hemistichal-mislead.000webhostapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers pragma no-cache date Thu, 10 Mar 2022 13:09:36 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

holy-violet-5937.on.fleek.co

URL

https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig

Domain

holy-violet-5937.on.fleek.co

URL

https://holy-violet-5937.on.fleek.co/?clientID=xxxxxx%40icrc.org&mc_phishing_protection_id=28048-c8ksvgn0s0va7r842mig

Domain

www.google.com

URL

https://www.google.com/pagead/1p-user-list/987909199/?random=1646917776011&cv=9&fst=1646917200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa370&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2Fhemistichal-mislead.000webhostapp.com%2Fbg.php%3Fdomain%3Dhttp%3A%2F%2Ficrc.org&ref=https%3A%2F%2Fholy-violet-5937.on.fleek.co%2F&tiba=International%20Committee%20of%20the%20Red%20Cross&async=1&fmt=3&is_vtc=1&random=1377580693&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y