bancol0mbi912.temporary-demo.site Open in urlscan Pro
172.67.72.106 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bancol0mbi912.temporary-demo.site/
Effective URL:
https://bancol0mbi912.temporary-demo.site/
Submission: On August 15 via manual (August 15th 2024, 12:19:16 pm UTC) from PH — Scanned from IT

Summary HTTP 36 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 4 countries across 13 domains to perform 36 HTTP transactions. The main IP is 172.67.72.106, located in United States and belongs to CLOUDFLARENET, US. The main domain is bancol0mbi912.temporary-demo.site.
TLS certificate: Issued by WE1 on July 25th 2024. Valid for: 3 months.

This is the only time bancol0mbi912.temporary-demo.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bancolombia (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 5	172.67.72.106 172.67.72.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	169.150.247.37 169.150.247.37	60068 (CDN77 _) (CDN77 _)
1	172.67.71.57 172.67.71.57	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	216.58.206.74 216.58.206.74	15169 (GOOGLE) (GOOGLE)
1	142.250.186.168 142.250.186.168	15169 (GOOGLE) (GOOGLE)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
14	89.116.115.39 89.116.115.39	47583 (AS-HOSTINGER) (AS-HOSTINGER)
1	172.67.8.141 172.67.8.141	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
4	142.250.185.196 142.250.185.196	15169 (GOOGLE) (GOOGLE)
2	162.159.255.116 162.159.255.116	13335 (CLOUDFLAR...) (CLOUDFLARENET)
36	13

5 172.67.72.106 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bancol0mbi912.temporary-demo.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 169.150.247.37 (Frankfurt am Main, Germany)

ASN60068 (CDN77 _, GB)
PTR: 169-150-247-37.bunnyinfra.net

fonts.bunny.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b-cloud.b-cdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.71.57 (United States)

ASN13335 (CLOUDFLARENET, US)

waust.at	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.74 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.168 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (San Francisco, United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 89.116.115.39 (São Paulo, Brazil)

ASN47583 (AS-HOSTINGER, CY)

script.mrclayl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.8.141 (United States)

ASN13335 (CLOUDFLARENET, US)

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.185.98 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.162 (United States)

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.196 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.159.255.116 (None, )

ASN13335 (CLOUDFLARENET, US)

sucursalpersonas.transaccionesbancolombia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	mrclayl.com script.mrclayl.com	364 KB
5	temporary-demo.site 1 redirects bancol0mbi912.temporary-demo.site	10 KB
4	google.com www.google.com — Cisco Umbrella Rank: 10	671 B
3	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 77	4 KB
3	b-cdn.net b-cloud.b-cdn.net — Cisco Umbrella Rank: 848956	221 KB
2	transaccionesbancolombia.com sucursalpersonas.transaccionesbancolombia.com — Cisco Umbrella Rank: 355178	8 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 176	2 KB
1	amung.us whos.amung.us — Cisco Umbrella Rank: 10888	202 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1211	30 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 112	83 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	2 KB
1	waust.at waust.at — Cisco Umbrella Rank: 28960	4 KB
1	bunny.net fonts.bunny.net — Cisco Umbrella Rank: 15346	1 KB
36	13

	Domain	Requested by
14	script.mrclayl.com	bancol0mbi912.temporary-demo.site code.jquery.com script.mrclayl.com
5	bancol0mbi912.temporary-demo.site	1 redirects bancol0mbi912.temporary-demo.site
4	www.google.com	bancol0mbi912.temporary-demo.site code.jquery.com
3	googleads.g.doubleclick.net	1 redirects www.googletagmanager.com
3	b-cloud.b-cdn.net	bancol0mbi912.temporary-demo.site
2	sucursalpersonas.transaccionesbancolombia.com	script.mrclayl.com
1	www.googleadservices.com	www.googletagmanager.com
1	whos.amung.us	waust.at
1	code.jquery.com	bancol0mbi912.temporary-demo.site
1	www.googletagmanager.com	bancol0mbi912.temporary-demo.site
1	fonts.googleapis.com	bancol0mbi912.temporary-demo.site
1	waust.at	bancol0mbi912.temporary-demo.site
1	fonts.bunny.net	bancol0mbi912.temporary-demo.site
36	13

This site contains no links.

Subject Issuer	Validity	Valid
temporary-demo.site WE1	`2024-07-25` - `2024-10-23`	3 months	crt.sh
fonts.bunny.net R11	`2024-07-06` - `2024-10-04`	3 months	crt.sh
*.b-cdn.net Sectigo RSA Domain Validation Secure Server CA	`2023-11-05` - `2024-11-11`	a year	crt.sh
waust.at WE1	`2024-07-02` - `2024-09-30`	3 months	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.google-analytics.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
script.mrclayl.com WR1	`2024-07-21` - `2024-10-19`	3 months	crt.sh
amung.us WE1	`2024-07-07` - `2024-10-05`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
www.googleadservices.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
www.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh
sucursalpersonas.transaccionesbancolombia.com GlobalSign Extended Validation CA - SHA256 - G3	`2024-07-16` - `2025-08-17`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://bancol0mbi912.temporary-demo.site/
Frame ID: 87F82BFE253EA42B3DDFF86D73E448F7
Requests: 34 HTTP requests in this frame

Frame: https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js
Frame ID: A7BBAD7D5D2FFF61DE85AB212468C7CD
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfP0CITAAAAAHq9FOgCo7v_fb0-pmmH9VW3ziFs&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=es&v=Ai7lOI0zKMDPHxlv62g7oMoJ&size=invisible&sa=action&cb=8evslk2xrrxy
Frame ID: A1D58CAC7EB27FDB20825B0CD1456E8B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bancolombia Sucursal Virtual Personas

Page URL History Show full URLs

http://bancol0mbi912.temporary-demo.site/ HTTP 307
https://bancol0mbi912.temporary-demo.site/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui.*\.js

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

<div[^>]+class="g-recaptcha"

Page Statistics

36
Requests

94 %
HTTPS

0 %
IPv6

13
Domains

13
Subdomains

13
IPs

4
Countries

729 kB
Transfer

2136 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bancol0mbi912.temporary-demo.site/ HTTP 307
https://bancol0mbi912.temporary-demo.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 9

https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js

Request Chain 15

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11395263888/?random=883361189&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&label=gRbzCO7ejPMYEKmS5roq&hn=www.googleadservices.com&frm=0&tiba=Home&gtm_ee=1&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECSidldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXJaAwoBAWIECgICAw&pscrd=IhMIvYyvzP32hwMVFKn9Bx0qWxzFMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOipodHRwczovL2JhbmNvbDBtYmk5MTIudGVtcG9yYXJ5LWRlbW8uc2l0ZS8 HTTP 302
https://www.google.com/pagead/1p-conversion/11395263888/?random=883361189&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&label=gRbzCO7ejPMYEKmS5roq&hn=www.googleadservices.com&frm=0&tiba=Home&gtm_ee=1&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECSidldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXJaAwoBAWIECgICAw&pscrd=IhMIvYyvzP32hwMVFKn9Bx0qWxzFMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOipodHRwczovL2JhbmNvbDBtYmk5MTIudGVtcG9yYXJ5LWRlbW8uc2l0ZS8&is_vtc=1&cid=CAQSGwDpaXnfW-sHQ2aKqRQFY88CV9KHl-hn941G-A&random=1770591920

36 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
bancol0mbi912.temporary-demo.site/
Redirect Chain

http://bancol0mbi912.temporary-demo.site/
https://bancol0mbi912.temporary-demo.site/

18 KB
4 KB

1109ms
473ms

Document
text/html

172.67.72.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.72.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bd37c7541a25dcc01ec1b0449eaeb3b5e5b696c70082fc32602cb4c8d8ccf27

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
age: 5952
cache-control: no-store, no-cache, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8b392190ff440e4d-MXP
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Thu, 15 Aug 2024 12:19:07 GMT
expires: -1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=48MUvzr5RWOmO816YeBZfTLkzxIEAVGKXzdIbZb9CjsJDrGAxd%2BcaTF9myRHLGOrx5kl8SiayVLIGBRAe%2BpW8bDdrtZHlnrsYFRWmgvZAjG8OMhQOzjv%2BrRxlZ1Qq%2FWs5ACnvOmkWjazz%2FWH5OIf3PR8aQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubdomains; preload
vary: Accept-Encoding
via: 1.1 varnish (Varnish/6.2)
x-brizy-preview: 1
x-cache: HIT
x-cache-hits: 3
x-content-type-options: nosniff
x-varnish: 11015683 10768203
x-xss-protection: 1; mode=block

Redirect headers

Location: https://bancol0mbi912.temporary-demo.site/
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 css
fonts.bunny.net/ 9 KB
1 KB 690ms
57ms Stylesheet
text/css 169.150.247.37
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://fonts.bunny.net/css?family=Lato:100,100italic,300,300italic,regular,italic,700,700italic,900,900italic&subset=arabic,bengali,cyrillic,cyrillic-ext,devanagari,greek,greek-ext,gujarati,hebrew,khmer,korean,latin-ext,tamil,telugu,thai,vietnamese&display=swap
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 169.150.247.37 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 169-150-247-37.bunnyinfra.net
Software: BunnyCDN-DE1-1080 /
Resource Hash: 7244259fcc20d56bb98c86a6304e241ce66b0feb19d5ea311e3d3d4bf9b946a8

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:08 GMT
content-encoding: br
cdn-edgestorageid: 1081
cdn-cachedat: 07/21/2024 18:12:55
cdn-pullzone: 781720
last-modified: Sun, 21 Jul 2024 18:12:55 GMT
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 3a60ca70-b89d-4cd5-a4b5-34a3468d7e0f
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=2592000
cdn-requestid: 9a5f7ff832df6da1a9946d7a68266829
cdn-requestcountrycode: IT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 preview.pro.min.css
b-cloud.b-cdn.net/builds/pro/167-cloud/css/ 331 KB
46 KB 790ms
157ms Stylesheet
text/css 169.150.247.37
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://b-cloud.b-cdn.net/builds/pro/167-cloud/css/preview.pro.min.css
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 169.150.247.37 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 169-150-247-37.bunnyinfra.net
Software: BunnyCDN-DE1-1080 /
Resource Hash: 4fec84e6ca158981fe098298239d944f59aa00d3a1ad9e268af1baede02905ca

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:08 GMT
x-amz-version-id: lSmnZXKIh1wN0mVvdn2Guzasagz82Ez1
content-encoding: br
cdn-edgestorageid: 1082
x-amz-request-id: Q4NQWMWEYF49RHZM
x-amz-server-side-encryption: AES256
cdn-cachedat: 08/07/2024 13:50:00
cdn-pullzone: 246147
x-amz-replication-status: COMPLETED
x-amz-id-2: 0aTcl2Fem+7x1NuJEKwn0TPAYOj+F6u5ezo5bQSCdzXStViNjKwEHNrw64FWOIpiZsykbyLuLDY=
last-modified: Wed, 07 Aug 2024 10:48:23 GMT
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"fc5a264d07168db7118693e3dad8797d"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: e647d0c9-3a16-4c3e-ae99-91e18e06d4b3
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
cdn-requestid: cf97e3f90d7b1e5240784e7142770505
cdn-requestcountrycode: IT
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-status: 200
link: <https://s3.amazonaws.com/brizy.cloud/builds/pro/167-cloud/css/preview.pro.min.css>; rel="canonical"
cdn-requestpullsuccess: True

GET
H2 200 s.js Show response
waust.at/ 8 KB
4 KB 605ms
74ms Script
application/x-javascript 172.67.71.57
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://waust.at/s.js
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.71.57 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2698
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 12 Jan 2023 17:19:44 GMT
server: cloudflare
etag: W/"63c04130-2170"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MpSsHN9JUdm8xjvs35S5b579sTSrPilz0h9A8RVVFQYYHjAEtlDRi8N32T7DSBavfk7XQ26mLgK8Q%2FK%2BZti023z3iaK8q6SIUAnIBx%2FkZmOEXD6rLO1GHkXW"}],"group":"cf-nel","max_age":604800}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=86400
cf-ray: 8b39219decdc83a2-MXP
expires: Fri, 16 Aug 2024 11:34:11 GMT

GET
H2 200 css
fonts.googleapis.com/ 17 KB
2 KB 668ms
81ms Stylesheet
text/css 216.58.206.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400italic,400,700&subset=latin,cyrillic

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f10.1e100.net

Software

ESF /

Resource Hash

5b7fe828decc07f24ab19c7e017da0dedb2c71e1647594f3ddeb6072d743147f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 15 Aug 2024 12:19:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 15 Aug 2024 12:12:56 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 15 Aug 2024 12:19:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 229 KB
83 KB 518ms
64ms Script
application/javascript 142.250.186.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11395263888

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.168 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5a46f6bbf9790ae389f0929df73bdfcfbd7a4988c7fcdc75a13ed4da91d74b00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84212
x-xss-protection: 0
last-modified: Thu, 15 Aug 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 15 Aug 2024 12:19:09 GMT

GET
H2 200 jquery-3.7.0.min.js Show response
code.jquery.com/ 85 KB
30 KB 690ms
61ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.7.0.min.js
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.130.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:08 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1232898
x-cache: HIT, HIT
content-length: 30308
x-served-by: cache-lga13623-LGA, cache-mxp6971-MXP
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1723724348.326289,VS0,VE0
etag: W/"28feccc0-155a6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 50, 3025

GET
H2 200 script.php Show response
script.mrclayl.com/ 10 KB
3 KB 1157ms
282ms Script
application/javascript 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/script.php?tok=qwerty49188765

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed / PHP/8.1.27

Resource Hash

ab1f6f0ee975820d0fef8f29d7a590ff12bb33878b4023e2cc7b4f3d468cedb2

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
server: LiteSpeed
x-powered-by: PHP/8.1.27
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800
platform: hostinger
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 3068
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 group-jq.min.js Show response
b-cloud.b-cdn.net/builds/free/293-cloud/editor/js/ 101 KB
39 KB 788ms
157ms Script
text/javascript 169.150.247.37
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://b-cloud.b-cdn.net/builds/free/293-cloud/editor/js/group-jq.min.js
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 169.150.247.37 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 169-150-247-37.bunnyinfra.net
Software: BunnyCDN-DE1-1080 /
Resource Hash: ab453409a32214d7e65505f6eab9564c70e757fc9af096b4dfd62bad306eda02

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:08 GMT
x-amz-version-id: LLbd_IjI_CHEit4YfZgmHB8AZaxlQOvR
content-encoding: br
cdn-edgestorageid: 1081
x-amz-request-id: EW0FQ8BHKV9NCN6P
x-amz-server-side-encryption: AES256
cdn-cachedat: 08/07/2024 13:54:40
cdn-pullzone: 246147
x-amz-replication-status: COMPLETED
x-amz-id-2: yN/JBNRVwqXmuMC/lE1vd0I20DkPO0fBV+z6QYaSh6QXjVjZIfPr2gfkV5wiS95Bt5otquNARDk=
last-modified: Wed, 07 Aug 2024 10:48:13 GMT
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"382784ac4f4421222995f4d3d6b37e8b"
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cdn-cache: HIT
cdn-uid: e647d0c9-3a16-4c3e-ae99-91e18e06d4b3
cache-control: public, max-age=31919000
cdn-requestid: 9fbe4b8f3efe265b78e76d54788219a3
cdn-requestcountrycode: IT
link: <https://s3.amazonaws.com/brizy.cloud/builds/free/293-cloud/editor/js/group-jq.min.js>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 preview.pro.min.js Show response
b-cloud.b-cdn.net/builds/pro/167-cloud/js/ 501 KB
137 KB 704ms
74ms Script
text/javascript 169.150.247.37
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://b-cloud.b-cdn.net/builds/pro/167-cloud/js/preview.pro.min.js
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 169.150.247.37 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS: 169-150-247-37.bunnyinfra.net
Software: BunnyCDN-DE1-1080 /
Resource Hash: 3378179c132048ca581593442c327a818490b0591770e6741bf4a8f592535d6c

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:08 GMT
x-amz-version-id: TY0AFmUI9GSQXUE4xAOKzlgp8EXU2U51
content-encoding: br
cdn-edgestorageid: 1080
x-amz-request-id: Q4NZEGGT1ZSY0TKV
x-amz-server-side-encryption: AES256
cdn-cachedat: 08/07/2024 13:50:00
cdn-pullzone: 246147
x-amz-replication-status: COMPLETED
x-amz-id-2: gmC49afUUwKEUCotBhOs6nZSxsC9HaL1nQP+/Ecrci9PbrOoIO7o5W6P63pJeLsJukWgCeSNHBQ=
last-modified: Wed, 07 Aug 2024 10:48:24 GMT
server: BunnyCDN-DE1-1080
cdn-proxyver: 1.04
cdn-requestpullcode: 200
etag: W/"694dfd11c948d2c597c26d0d4cb0ec6c"
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cdn-cache: HIT
cdn-uid: e647d0c9-3a16-4c3e-ae99-91e18e06d4b3
cache-control: public, max-age=31919000
cdn-requestid: f86f67a361751c5e60b160c1afad2408
cdn-requestcountrycode: IT
link: <https://s3.amazonaws.com/brizy.cloud/builds/pro/167-cloud/js/preview.pro.min.js>; rel="canonical"
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2

200

main.js Show response
bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/ Frame A7BB
Redirect Chain

https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js?

8 KB
4 KB

82ms
81ms

Script
application/javascript

172.67.72.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js?

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Server

172.67.72.106 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bb0a3f9b1710b9260e9526f044efb4373bee8716120e28ccadfe44d05fabf267

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:08 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MiAkyIJyIN%2BExEjUSjL9KHFcCAOC%2F8a%2BgXrzOzxzvjEPNJwpUXY7b4IRX7kj98yilnnIuDZm3gpj39S%2BZF7gUa9cGECf1up%2BcJdDejiZGnwOL42rxTie4Q7mvNwwLkOC2tWiaWtj9RAP1vqMFsB2ruAMMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8b39219c29a70e4d-MXP

Redirect headers

date: Thu, 15 Aug 2024 12:19:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K5Il7WeDqONa9A2J0OoGtm%2F2k5xiEPvbpVyRiwjMBOi%2Bqp5Rmd%2FkpYVXvsAtr8nYB4Bwm0FHISjKyjoOHOYpm2P4FTbLKalDoyK52O9DuO7iWhdsKyd7vIdo5vbpDB5ecdxV%2FOO2orEkt8ZMbV7hq7XKZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/ba7376691753/main.js?
access-control-allow-origin: *
cache-control: max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
cf-ray: 8b39219b787d0e4d-MXP
content-length: 0

POST
H2 200 8b392190ff440e4d Show response
bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame A7BB 0
619 B 172ms
168ms XHR
text/plain 172.67.72.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/h/g/jsd/r/8b392190ff440e4d
Requested by: Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8b39219d3b510e4d-MXP
content-length: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YpGsScniiTX7NmGR9U5S21U3sPVC98NtOvbe%2BTzspeQl6LidPM9vYhtrEXiCI2zyOUrAJFYZAiaypeFdhR%2FeipFDS7KHHZsc%2BXC7NuNCKekhhd%2BntkIP2w0AkE%2FlKiSzUJ3N6YWd0wa8nTEwy33s1VUKuA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8

GET
H2 200 / Show response
whos.amung.us/pingjs/ 24 B
202 B 825ms
270ms Script
text/javascript 172.67.8.141
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://whos.amung.us/pingjs/?k=perreo&t=Home&c=s&x=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&y=&a=0&d=2.333&v=27&r=6795
Requested by: Host: waust.at
URL: https://waust.at/s.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.8.141 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 62f5b8b0233f2be502e539f894abdab4de84894768e81b82d8a48ddcab36488d

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8b3921a22ce6bac1-MXP
alt-svc: h3=":443"; ma=86400
content-type: text/javascript;charset=UTF-8

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11395263888/ 2 KB
2 KB 571ms
77ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11395263888/?random=1723724349236&cv=11&fst=1723724349236&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&hn=www.googleadservices.com&frm=0&tiba=Home&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11395263888

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

66e0093eabf6d71c9b938245a1ad3178908facd765a05da1a3f552aa5eea8d19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1338
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11395263888/ 2 KB
1 KB 579ms
88ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11395263888/?random=1723724349260&cv=11&fst=1723724349260&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&hn=www.googleadservices.com&frm=0&tiba=Home&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11395263888

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

0e03ec7ef7b1bdac34e582131156c19503c2f6989babc6ae233e4be70ba533ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1338
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/11395263888/ 3 KB
2 KB 338ms
87ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/11395263888/?random=1723724349264&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&label=gRbzCO7ejPMYEKmS5roq&hn=www.googleadservices.com&frm=0&tiba=Home&gtm_ee=1&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11395263888

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

7bdc58dc0ae053ecf56d6141d0a0266b5b652fa5f9e647a2203087b11b808765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1541
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.com/pagead/1p-conversion/11395263888/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11395263888/?random=883361189&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w...
https://www.google.com/pagead/1p-conversion/11395263888/?random=883361189&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=ht...

42 B
108 B

535ms
59ms

Image
image/gif

142.250.185.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-conversion/11395263888/?random=883361189&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&label=gRbzCO7ejPMYEKmS5roq&hn=www.googleadservices.com&frm=0&tiba=Home&gtm_ee=1&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECSidldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXJaAwoBAWIECgICAw&pscrd=IhMIvYyvzP32hwMVFKn9Bx0qWxzFMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOipodHRwczovL2JhbmNvbDBtYmk5MTIudGVtcG9yYXJ5LWRlbW8uc2l0ZS8&is_vtc=1&cid=CAQSGwDpaXnfW-sHQ2aKqRQFY88CV9KHl-hn941G-A&random=1770591920

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Server

142.250.185.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:10 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:09 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://www.google.com/pagead/1p-conversion/11395263888/?random=883361189&cv=11&fst=1723724349264&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&label=gRbzCO7ejPMYEKmS5roq&hn=www.googleadservices.com&frm=0&tiba=Home&gtm_ee=1&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&capi=1&data=event%3Dconversion&fmt=3&ct_cookie_present=false&crd=CLHBsQIIsMGxAgi5wbECSidldmVudC1zb3VyY2U9bmF2aWdhdGlvbi1zb3VyY2UsIHRyaWdnZXJaAwoBAWIECgICAw&pscrd=IhMIvYyvzP32hwMVFKn9Bx0qWxzFMgIIAzICCAQyAggHMgIICDICCAkyAggKMgIIAjICCAsyAggVMgIIHzICCBMyAggSOipodHRwczovL2JhbmNvbDBtYmk5MTIudGVtcG9yYXJ5LWRlbW8uc2l0ZS8&is_vtc=1&cid=CAQSGwDpaXnfW-sHQ2aKqRQFY88CV9KHl-hn941G-A&random=1770591920
content-type: image/gif
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 styles.css
script.mrclayl.com/css/ 106 KB
14 KB 299ms
296ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/styles.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

2c1b32d98585fee04a38eb732834e0ccc33952800b6077064a197555cff4b551

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "1a782-664798da-4f4ab7e8c40f64fe;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 14720
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 bootstrap.css
script.mrclayl.com/css/ 118 KB
16 KB 289ms
287ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/bootstrap.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

5e7aacc05a5cfe4d2fa8407d5a885b9c2511e0213fb5abd0599cdef3f0e0e524

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "1d9e0-664798da-3e9bad2dfd7e4d90;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 16697
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 keyboard_util.css
script.mrclayl.com/css/ 2 KB
552 B 289ms
288ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/keyboard_util.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

70f1cd5b6038df19e8cf82b14c9835eeaf8f679d731d698d2fe5b96c140109af

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "62d-664798da-687ef38ed1c20801;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 489
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 jquery-ui.css
script.mrclayl.com/css/ 31 KB
6 KB 289ms
288ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/jquery-ui.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

c9eeb55f7cf16683b871600ce998b61b1031629097be96069d5741f33adaf6d1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "7c88-664798da-ec822c9eda265766;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 5671
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 ui.css
script.mrclayl.com/css/ 13 KB
3 KB 290ms
288ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/ui.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

0265a31c7bea01a32328e09245aad8cf38ba3316a13e93080697b35e338f35b4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "34ab-664798da-2a2de78e08d20a41;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 2770
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 showLoadingBank.css
script.mrclayl.com/css/ 2 KB
553 B 292ms
291ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/showLoadingBank.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

d27f74e5b0aff4b16fd133bd8c42458a400acde162b92211d642c76381c11e5e

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "75f-664798da-b561d54fedf625ca;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 490
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 stylesheet.css
script.mrclayl.com/css/ 1007 B
248 B 294ms
294ms Stylesheet
text/css 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/css/stylesheet.css

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

70b12b4ea441b91094cc36e8b1ddc40fe4eeee8f7541fe3504abc1693c650ec8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "3ef-664798da-5f905787968c7d40;br"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 184
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 jquery.jclockNew.js Show response
script.mrclayl.com/js/ 8 KB
2 KB 642ms
640ms Script
application/x-javascript 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/js/jquery.jclockNew.js

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

c6abf874d8228e1e37ece02cbd25c86ac1d64200331f7b91b085885eaa5e3074

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "1e72-664798da-dd99be2aec088cb4;br"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 2117
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 _user.php Show response
script.mrclayl.com/ 4 KB
2 KB 639ms
638ms Script
application/javascript 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/_user.php?&_=1723724348584

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed / PHP/8.1.27

Resource Hash

7dded95d55e6af6686067cb3068a93d84708b07acc18ce3ff5dc943d5368f228

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:09 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
server: LiteSpeed
x-powered-by: PHP/8.1.27
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800
platform: hostinger
content-length: 1775
expires: Thu, 22 Aug 2024 12:19:09 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11395263888/ 42 B
108 B 530ms
53ms Image
image/gif 142.250.185.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11395263888/?random=1723724349236&cv=11&fst=1723723200000&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&hn=www.googleadservices.com&frm=0&tiba=Home&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfUkzw3OgkxFAFGiA3qi2TdV4vWCSVZA&random=1020225299&rmt_tld=0&ipr=y

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:10 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11395263888/ 42 B
455 B 527ms
53ms Image
image/gif 142.250.185.196
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11395263888/?random=1723724349260&cv=11&fst=1723723200000&bg=ffffff&guid=ON&async=1&gtm=45be48c0za200&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbancol0mbi912.temporary-demo.site%2F&hn=www.googleadservices.com&frm=0&tiba=Home&npa=0&pscdl=noapi&auid=447703982.1723724349&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfEzD5ETEeoejMr8sjLEgURBb8MvZvBA&random=2156542147&rmt_tld=0&ipr=y

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 15 Aug 2024 12:19:10 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 439 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

Request headers

Referer
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 logo.svg
sucursalpersonas.transaccionesbancolombia.com/mua/images/ 7 KB
5 KB 268ms
80ms Image
image/svg+xml 162.159.255.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sucursalpersonas.transaccionesbancolombia.com/mua/images/logo.svg

Requested by

Host: script.mrclayl.com
URL: https://script.mrclayl.com/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.255.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' static.cloudflareinsights.com .medallia.com .kampyle.com https://cdn.siftscience.com https://checkout.wompi.co https://www.google.com .googleapis.com api.segment.io .segment.com .todo1.com .ambientesbc.com .cloudbancolombia.com .newrelic.com bam.nr-data.net .gstatic.com https://www.google-analytics.com https://tagmanager.google.com https://www.googletagmanager.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ .hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com .twitter.com https://t.co .doubleclick.net https://stags.bluekai.com .linkedin.com .todo-1.com .static.browseranalytic.com .browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'unsafe-inline' 'unsafe-eval'; connect-src https://www.google-analytics.com .medallia.com .kampyle.com https://sessions.bugsnag.com .doubleclick.net api.segment.io .segment.com .todo1.com .newrelic.com bam.nr-data.net https://www.google-analytics.com www.google-analytics.com tagmanager.google.com https://vars.hotjar.com/ .hotjar.com .hotjar.io .todo-1.com .static.browseranalytic.com .browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self'; img-src .medallia.com .kampyle.com https://hexagon-analytics.com https://www.google-analytics.com www.google-analytics.com https://www.google.com .gstatic.com images-cdn.info .ambientesbc.com .cloudbancolombia.com .bancolombia.com .todo1.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ .hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com .twitter.com https://t.co .doubleclick.net https://stags.bluekai.com .linkedin.com .todo-1.com .static.browseranalytic.com .browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://fonts.googleapis.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ .hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com .twitter.com https://t.co .doubleclick.net https://stags.bluekai.com .linkedin.com; frame-src .todo-1.com .medallia.com .kampyle.com https://checkout.wompi.co 'self' https://www.google.com/ https://.googleapis.com https://.gstatic.com .salesforce.com .force.com .visualforce.com .ambientesbc.com .cloudbancolombia.com .bancolombia.corp .bancolombia.com .transaccionesbancolombia.com https://vars.hotjar.com/ .hotjar.com https://stags.bluekai.com https://www.facebook.com data: blob:; font-src https://.gstatic.com 'self' data:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Security-Policy	default-src 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://script.mrclayl.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-content-security-policy: default-src 'self';
date: Thu, 15 Aug 2024 12:19:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' static.cloudflareinsights.com *.medallia.com *.kampyle.com https://cdn.siftscience.com https://checkout.wompi.co https://www.google.com *.googleapis.com api.segment.io *.segment.com *.todo1.com *.ambientesbc.com *.cloudbancolombia.com *.newrelic.com bam.nr-data.net *.gstatic.com https://www.google-analytics.com https://tagmanager.google.com https://www.googletagmanager.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'unsafe-inline' 'unsafe-eval'; connect-src https://www.google-analytics.com *.medallia.com *.kampyle.com https://sessions.bugsnag.com *.doubleclick.net api.segment.io *.segment.com *.todo1.com *.newrelic.com bam.nr-data.net https://www.google-analytics.com www.google-analytics.com tagmanager.google.com https://vars.hotjar.com/ *.hotjar.com *.hotjar.io *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self'; img-src *.medallia.com *.kampyle.com https://hexagon-analytics.com https://www.google-analytics.com www.google-analytics.com https://www.google.com *.gstatic.com images-cdn.info *.ambientesbc.com *.cloudbancolombia.com *.bancolombia.com *.todo1.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://fonts.googleapis.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com; frame-src *.todo-1.com *.medallia.com *.kampyle.com https://checkout.wompi.co 'self' https://www.google.com/ https://*.googleapis.com https://*.gstatic.com *.salesforce.com *.force.com *.visualforce.com *.ambientesbc.com *.cloudbancolombia.com *.bancolombia.corp *.bancolombia.com *.transaccionesbancolombia.com https://vars.hotjar.com/ *.hotjar.com https://stags.bluekai.com https://www.facebook.com data: blob:; font-src https://*.gstatic.com 'self' data:
cf-cache-status: HIT
x-permitted-cross-domain-policies: master-only
age: 6634
content-encoding: gzip
x-xss-protection: 1; mode=block
last-modified: Tue, 27 Apr 2021 13:04:03 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: https://c.na7.visual.fo.todo1.com
cache-control: public, max-age=14400
cf-ray: 8b3921a5fadd3747-MXP
expires: Thu, 15 Aug 2024 16:19:10 GMT

GET
H2 200 OpenSans-Regular.ttf
script.mrclayl.com/fonts/opensans/ 212 KB
81 KB 1138ms
259ms Font
application/x-font-ttf 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/fonts/opensans/OpenSans-Regular.ttf

Requested by

Host: script.mrclayl.com
URL: https://script.mrclayl.com/css/stylesheet.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://script.mrclayl.com/css/stylesheet.css
Origin: https://bancol0mbi912.temporary-demo.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:11 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "350bc-664798da-17eb6fc029b80fa3;br"
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 82320
expires: Thu, 22 Aug 2024 12:19:11 GMT

GET
H2 200 anchor
www.google.com/recaptcha/api2/ Frame A1D5 0
0 592ms
113ms Document
text/html 142.250.185.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfP0CITAAAAAHq9FOgCo7v_fb0-pmmH9VW3ziFs&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=es&v=Ai7lOI0zKMDPHxlv62g7oMoJ&size=invisible&sa=action&cb=8evslk2xrrxy

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.7.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dTolT18PdFukLErW2sue-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-dTolT18PdFukLErW2sue-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 15 Aug 2024 12:19:10 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 icon-user.png
sucursalpersonas.transaccionesbancolombia.com/mua/images/icons/ 447 B
3 KB 76ms
73ms Image
image/png 162.159.255.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sucursalpersonas.transaccionesbancolombia.com/mua/images/icons/icon-user.png

Requested by

Host: script.mrclayl.com
URL: https://script.mrclayl.com/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.159.255.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

75d5b455151a3b1a0a5b100041fee37de2daa0b41d1d177deaa863177c5b5b83

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' static.cloudflareinsights.com .medallia.com .kampyle.com https://cdn.siftscience.com https://checkout.wompi.co https://www.google.com .googleapis.com api.segment.io .segment.com .todo1.com .ambientesbc.com .cloudbancolombia.com .newrelic.com bam.nr-data.net .gstatic.com https://www.google-analytics.com https://tagmanager.google.com https://www.googletagmanager.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ .hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com .twitter.com https://t.co .doubleclick.net https://stags.bluekai.com .linkedin.com .todo-1.com .static.browseranalytic.com .browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'unsafe-inline' 'unsafe-eval'; connect-src https://www.google-analytics.com .medallia.com .kampyle.com https://sessions.bugsnag.com .doubleclick.net api.segment.io .segment.com .todo1.com .newrelic.com bam.nr-data.net https://www.google-analytics.com www.google-analytics.com tagmanager.google.com https://vars.hotjar.com/ .hotjar.com .hotjar.io .todo-1.com .static.browseranalytic.com .browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self'; img-src .medallia.com .kampyle.com https://hexagon-analytics.com https://www.google-analytics.com www.google-analytics.com https://www.google.com .gstatic.com images-cdn.info .ambientesbc.com .cloudbancolombia.com .bancolombia.com .todo1.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ .hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com .twitter.com https://t.co .doubleclick.net https://stags.bluekai.com .linkedin.com .todo-1.com .static.browseranalytic.com .browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://fonts.googleapis.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ .hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com .twitter.com https://t.co .doubleclick.net https://stags.bluekai.com .linkedin.com; frame-src .todo-1.com .medallia.com .kampyle.com https://checkout.wompi.co 'self' https://www.google.com/ https://.googleapis.com https://.gstatic.com .salesforce.com .force.com .visualforce.com .ambientesbc.com .cloudbancolombia.com .bancolombia.corp .bancolombia.com .transaccionesbancolombia.com https://vars.hotjar.com/ .hotjar.com https://stags.bluekai.com https://www.facebook.com data: blob:; font-src https://.gstatic.com 'self' data:
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Security-Policy	default-src 'self';
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://script.mrclayl.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-content-security-policy: default-src 'self';
date: Thu, 15 Aug 2024 12:19:10 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: default-src 'self'; script-src 'self' static.cloudflareinsights.com *.medallia.com *.kampyle.com https://cdn.siftscience.com https://checkout.wompi.co https://www.google.com *.googleapis.com api.segment.io *.segment.com *.todo1.com *.ambientesbc.com *.cloudbancolombia.com *.newrelic.com bam.nr-data.net *.gstatic.com https://www.google-analytics.com https://tagmanager.google.com https://www.googletagmanager.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'unsafe-inline' 'unsafe-eval'; connect-src https://www.google-analytics.com *.medallia.com *.kampyle.com https://sessions.bugsnag.com *.doubleclick.net api.segment.io *.segment.com *.todo1.com *.newrelic.com bam.nr-data.net https://www.google-analytics.com www.google-analytics.com tagmanager.google.com https://vars.hotjar.com/ *.hotjar.com *.hotjar.io *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self'; img-src *.medallia.com *.kampyle.com https://hexagon-analytics.com https://www.google-analytics.com www.google-analytics.com https://www.google.com *.gstatic.com images-cdn.info *.ambientesbc.com *.cloudbancolombia.com *.bancolombia.com *.todo1.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com *.todo-1.com *.static.browseranalytic.com *.browseranalytic.com browseranalytic.com https://browseranalytic.com/ https://static.browseranalytic.com/ 'self' data:; style-src 'self' 'unsafe-inline' 'unsafe-eval' https://tagmanager.google.com https://fonts.googleapis.com/ tagmanager.google.com https://connect.facebook.net https://www.facebook.com https://tags.bkrtx.com https://vars.hotjar.com/ *.hotjar.com https://sjs.bizographics.com https://static.ads-twitter.com *.twitter.com https://t.co *.doubleclick.net https://stags.bluekai.com *.linkedin.com; frame-src *.todo-1.com *.medallia.com *.kampyle.com https://checkout.wompi.co 'self' https://www.google.com/ https://*.googleapis.com https://*.gstatic.com *.salesforce.com *.force.com *.visualforce.com *.ambientesbc.com *.cloudbancolombia.com *.bancolombia.corp *.bancolombia.com *.transaccionesbancolombia.com https://vars.hotjar.com/ *.hotjar.com https://stags.bluekai.com https://www.facebook.com data: blob:; font-src https://*.gstatic.com 'self' data:
cf-cache-status: HIT
x-permitted-cross-domain-policies: master-only
age: 6634
content-length: 447
x-xss-protection: 1; mode=block
last-modified: Tue, 27 Apr 2021 13:04:03 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://c.na7.visual.fo.todo1.com
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8b3921a61b053747-MXP
expires: Thu, 15 Aug 2024 16:19:10 GMT

GET
H2 200 CIBFontSans-Light.ttf
script.mrclayl.com/fonts/opensans/ 108 KB
51 KB 938ms
260ms Font
application/x-font-ttf 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/fonts/opensans/CIBFontSans-Light.ttf

Requested by

Host: script.mrclayl.com
URL: https://script.mrclayl.com/css/stylesheet.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://script.mrclayl.com/css/stylesheet.css
Origin: https://bancol0mbi912.temporary-demo.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:11 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "1b014-664798da-e34cd0196d272749;br"
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 52282
expires: Thu, 22 Aug 2024 12:19:11 GMT

GET
H2 200 icon_font_bc.ttf
script.mrclayl.com/fonts/iconfont/ 31 KB
19 KB 938ms
260ms Font
application/x-font-ttf 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to

Full URL

https://script.mrclayl.com/fonts/iconfont/icon_font_bc.ttf?61jkgi

Requested by

Host: script.mrclayl.com
URL: https://script.mrclayl.com/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

ad0f43b7fd52d2f1574ba930c85ce401f95d69e21ad997ffe8e7ad98fec2ffda

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://script.mrclayl.com/css/styles.css
Origin: https://bancol0mbi912.temporary-demo.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:11 GMT
content-encoding: br
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "7ce8-664798da-b894eb00956057c8;br"
vary: Accept-Encoding
content-type: application/x-font-ttf
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 19098
expires: Thu, 22 Aug 2024 12:19:11 GMT

GET
H2 200 publi_home.jpg
script.mrclayl.com/img/ 165 KB
166 KB 231ms
230ms Image
image/jpeg 89.116.115.39
AS-HOSTINGER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://script.mrclayl.com/img/publi_home.jpg

Requested by

Host: bancol0mbi912.temporary-demo.site
URL: https://bancol0mbi912.temporary-demo.site/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

89.116.115.39 São Paulo, Brazil, ASN47583 (AS-HOSTINGER, CY),

Reverse DNS

Software

LiteSpeed /

Resource Hash

0b6f497c7aae9ad88f351ac5c260ed01e3a3051c4602b3724121901a33f42a70

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 12:19:10 GMT
content-security-policy: upgrade-insecure-requests
last-modified: Fri, 17 May 2024 17:50:18 GMT
server: LiteSpeed
etag: "29592-664798da-140bcf2915ddc5fc;;;"
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
platform: hostinger
content-length: 169362
expires: Thu, 22 Aug 2024 12:19:10 GMT

GET
H2 200 favicon.ico
bancol0mbi912.temporary-demo.site/ 1 KB
656 B 387ms
386ms Other
image/x-icon 172.67.72.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bancol0mbi912.temporary-demo.site/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.72.106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e

Request headers

Referer: https://bancol0mbi912.temporary-demo.site/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

expires: Sat, 14 Sep 2024 12:18:13 GMT
date: Thu, 15 Aug 2024 12:19:12 GMT
via: 1.1 varnish (Varnish/6.2)
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache: HIT
last-modified: Sat, 19 Mar 2022 20:59:08 GMT
server: cloudflare
etag: W/"6236441c-57e"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
x-varnish: 16706282 11015669
content-type: image/x-icon
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
cache-control: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lTPSILLdniN6VlEIss4GpP2ORnu3wjqkfHHlC2eo1u6Za39gUNJCihpgF9HXztn9sTJqLD1iCEZgvbCi4TNAe6bR0S3Kifd53x7n4MUyHaTnDfXHo2PI7sifwh3cPhGF%2FOx7QiCpeq2pn8wI7hmo8NpCMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8b3921b04f5a0e4d-MXP
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-cache-hits: 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bancolombia (Banking)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.temporary-demo.site/	1970-01-21 07:34:20	Name: cf_clearance Value: mardIthfQ2G7uaGQyu4_KBoz9kt9zd_2atAmik2_BkE-1723724349-1.0.1.1-f.H6yRynJBiALhAREMxRvrw7E0kJG68BK7JqDVOHbSvDRTr4jY6uevh1rSW1KJcDO.s6rOOpGqxa7OEjl2QlMQ
.temporary-demo.site/	1970-01-21 00:58:20	Name: _gcl_au Value: 1.1.447703982.1723724349
.doubleclick.net/	1970-01-20 22:48:45	Name: test_cookie Value: CheckForPermission
.transaccionesbancolombia.com/	1970-01-20 22:48:46	Name: __cf_bm Value: utz.sgUM8efL4_fw_pOqnGHV.ycyXXp.0OuGZsLB2OM-1723724350-1.0.1.1-adBCcHZZHQakjfeJtGMEDcfbF4pNOogdzOGycLwiAViMmM33HsRP1530FjQf336EV3gvj2tG.QIBNkf0jTCiFQ

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

b-cloud.b-cdn.net
bancol0mbi912.temporary-demo.site
code.jquery.com
fonts.bunny.net
fonts.googleapis.com
googleads.g.doubleclick.net
script.mrclayl.com
sucursalpersonas.transaccionesbancolombia.com
waust.at
whos.amung.us
www.google.com
www.googleadservices.com
www.googletagmanager.com
142.250.185.196
142.250.185.98
142.250.186.168
151.101.130.137
162.159.255.116
169.150.247.37
172.67.71.57
172.67.72.106
172.67.8.141
216.58.206.74
216.58.212.162
89.116.115.39
0265a31c7bea01a32328e09245aad8cf38ba3316a13e93080697b35e338f35b4
0b6f497c7aae9ad88f351ac5c260ed01e3a3051c4602b3724121901a33f42a70
0e03ec7ef7b1bdac34e582131156c19503c2f6989babc6ae233e4be70ba533ad
13c03e22a633919beb2847c58c8285fb8a735ee97097d7c48fd403f8294b05f8
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1
2c1b32d98585fee04a38eb732834e0ccc33952800b6077064a197555cff4b551
2c7a6ea74a49a6adc3fad622078895e9b2589448214913d8c035764148aca7d0
3378179c132048ca581593442c327a818490b0591770e6741bf4a8f592535d6c
4bd37c7541a25dcc01ec1b0449eaeb3b5e5b696c70082fc32602cb4c8d8ccf27
4fec84e6ca158981fe098298239d944f59aa00d3a1ad9e268af1baede02905ca
5a46f6bbf9790ae389f0929df73bdfcfbd7a4988c7fcdc75a13ed4da91d74b00
5b7fe828decc07f24ab19c7e017da0dedb2c71e1647594f3ddeb6072d743147f
5e7aacc05a5cfe4d2fa8407d5a885b9c2511e0213fb5abd0599cdef3f0e0e524
62f5b8b0233f2be502e539f894abdab4de84894768e81b82d8a48ddcab36488d
66e0093eabf6d71c9b938245a1ad3178908facd765a05da1a3f552aa5eea8d19
70b12b4ea441b91094cc36e8b1ddc40fe4eeee8f7541fe3504abc1693c650ec8
70f1cd5b6038df19e8cf82b14c9835eeaf8f679d731d698d2fe5b96c140109af
7244259fcc20d56bb98c86a6304e241ce66b0feb19d5ea311e3d3d4bf9b946a8
75d5b455151a3b1a0a5b100041fee37de2daa0b41d1d177deaa863177c5b5b83
7bdc58dc0ae053ecf56d6141d0a0266b5b652fa5f9e647a2203087b11b808765
7dded95d55e6af6686067cb3068a93d84708b07acc18ce3ff5dc943d5368f228
a9bc1ab7f7c0c6bc5d097050968993474e32346cffa537be1e0335a19645f12e
ab1f6f0ee975820d0fef8f29d7a590ff12bb33878b4023e2cc7b4f3d468cedb2
ab453409a32214d7e65505f6eab9564c70e757fc9af096b4dfd62bad306eda02
ad0f43b7fd52d2f1574ba930c85ce401f95d69e21ad997ffe8e7ad98fec2ffda
bb0a3f9b1710b9260e9526f044efb4373bee8716120e28ccadfe44d05fabf267
c6abf874d8228e1e37ece02cbd25c86ac1d64200331f7b91b085885eaa5e3074
c9eeb55f7cf16683b871600ce998b61b1031629097be96069d5741f33adaf6d1
d27f74e5b0aff4b16fd133bd8c42458a400acde162b92211d642c76381c11e5e
d8f9afbf492e4c139e9d2bcb9ba6ef7c14921eb509fb703bc7a3f911b774eff8
decf1c3cb09b3e38d867e0d5cf648220584404c9cf8d18a6c51bdfa2af5047cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6d82f567d08ec91a1b6ef0d4abf21be7a2d3dbc0a41c122584ea3536755b3ac

bancol0mbi912.temporary-demo.site Open in urlscan Pro 172.67.72.106 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

36 Requests

94 %HTTPS

0 %IPv6

13 Domains

13 Subdomains

13 IPs

4 Countries

729 kBTransfer

2136 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

36 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

bancol0mbi912.temporary-demo.site Open in urlscan Pro
172.67.72.106 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

36
Requests

94 %
HTTPS

0 %
IPv6

13
Domains

13
Subdomains

13
IPs

4
Countries

729 kB
Transfer

2136 kB
Size

4
Cookies

36 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!