investigating-embezzlement-cxqrichrich.today Open in urlscan Pro
2606:4700:3032::6815:67  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response investigating-embezzlement-cxqrichrich.today/	11 KB 5 KB	240ms 137ms	Document text/html	2606:4700:3032::6815:67 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:67 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d23f32a8ca5f37374cfb4f51c51e230c85f5fe3550ded2545b4eb7bd75b41d1c Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8e83a6ee2d51ef9f-EWR content-encoding zstd content-type text/html; charset=UTF-8 date Mon, 25 Nov 2024 18:20:19 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5I4rCR2xmAhpSbFwF%2BUXVPbt16h%2FJ0XLA4yEXLKnJasT2fbn4tWri6ykD4dacZSS%2BbJAHqZG%2BiXFUa0Izr2AaJkeEbrCizguweQkZebEey5Sp5cHdV24wwzGw%2BYTXKSULNG5ZNELzVgM3KiQumS4Rdu9a%2FcX8rI5zb3sTOc8vLgNavT43BXJnF48Bg%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=22412&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4218&recv_bytes=4446&delivery_rate=584&cwnd=12000&unsent_bytes=0&cid=ea8a126bb6967a7d&ts=150&x=1" cfHdrFlush;dur=0 vary Accept-Encoding x-adblock-key MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAOkfkOV3lsGKqQ9j5bagzq3wjNQNxWwn/esVXnQFKykdGNnnz7w5UeA2I4OuWHWvh0oBKk747TbfSyNssqOrybkCAwEAAQ==_yfbma6iQoW+I04FodosV+CJmiOV5CBllGae5gobxJ7TKVDa9zHy5WJWMoBVEG+0UZnRtoBikdo8rFYNc+fUQKQ==
GET H3	200	caf.js Show response www.google.com/adsense/domains/	149 KB 54 KB	175ms 44ms	Script text/javascript	2607:f8b0:4006:81c::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/adsense/domains/caf.js?abp=1&2va64smr560lx5k=true Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:81c::2004 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 85712c50d38be57a7b3a0c5ad3c177b277ea4982142132dfc47ac484d4a28da5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers content-encoding gzip etag "11976203983100957894" report-to {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]} x-content-type-options nosniff expires Mon, 25 Nov 2024 18:20:19 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 25 Nov 2024 18:20:19 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding link <https://syndicatedsearch.goog>; rel="preconnect" cache-control private, max-age=3600 cross-origin-opener-policy same-origin; report-to="ads-afs-ui" cross-origin-resource-policy cross-origin accept-ranges bytes x-xss-protection 0 server sffe
GET H2	200	6e3a82979a1e73c3323cc8d1a4e46b46.js Show response ob.togreencolumn.com/i/	108 KB 40 KB	169ms 31ms	Script text/javascript	2600:9000:21f9:a400:2:17ff:2c80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ob.togreencolumn.com/i/6e3a82979a1e73c3323cc8d1a4e46b46.js Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f9:a400:2:17ff:2c80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Caddy / Resource Hash 941a8e3b7c67e42ebb34e83cbf81f3075445456900b52ee1dd31bec433ba290e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers cache-control max-age=43200 content-encoding gzip etag "1b141-Kbh6oPPnkDsNd0DO6H0EchkSZ5I" age 40586 via 1.1 6c72f3d1226793372ca91070a470930e.cloudfront.net (CloudFront) expires Mon, 25 Nov 2024 19:03:53 GMT x-cache Hit from cloudfront content-length 40531 x-amz-cf-id uhygWUOR9u1FnIB-aNb3EsxWHUcLhValvxNMPU8ARCQrOxhiQzrf3A== date Mon, 25 Nov 2024 07:03:53 GMT content-type text/javascript; charset=utf-8 x-amz-cf-pop JFK52-P10 server Caddy
GET H3	200	8424.jpg www.relevantlinks.net/img.php/image_id/	36 KB 36 KB	160ms 42ms	Image image/jpeg	2606:4700:3108::ac42:2b41 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.relevantlinks.net/img.php/image_id/8424.jpg Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3108::ac42:2b41 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 28349c38fe446eb7d54a2cde34f39e2e71e02df4c11211331ac029da54ba6f41 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers cache-control public, max-age=604800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT age 572692 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=okDJm4jmBAOo6LEGrpIlhTbMFAegngxj6u7QAqtM3E9Yg3DU8soYBs3nsTcAVZt8fp0hBHVToILWo1aygLorqKBXcIn4UrNyKqXVEKK0jzKgYDz3AAe0MfEjqY20LArMuhgk%2B1Z6Ieum1ciynp8%2Fwahp%2BkA%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e83a6f018d14346-EWR accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=21563&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4181&recv_bytes=4289&delivery_rate=131267&cwnd=12000&unsent_bytes=0&cid=942bc2843428a47a&ts=56&x=1", cfHdrFlush;dur=0 content-length 36645 date Mon, 25 Nov 2024 18:20:19 GMT content-type image/jpeg last-modified Sat, 16 Nov 2024 10:31:03 GMT vary Accept-Encoding server cloudflare
GET H3	200	cookie.js Show response partner.googleadservices.com/gampad/	442 B 285 B	138ms 38ms	Script text/javascript	2607:f8b0:4006:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://partner.googleadservices.com/gampad/cookie.js?domain=investigating-embezzlement-cxqrichrich.today&client=partner-dp-domainactive_60_3ph_xml&product=SAS&callback=__sasCookie&cookie_types=v1%2Cv2 Requested by Host: www.google.com URL: https://www.google.com/adsense/domains/caf.js?abp=1&2va64smr560lx5k=true Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::2002 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 859ae7fcfa08e118f00e09242c8cc06aade3a57f0966a3293e65c1990b2dd978 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers timing-allow-origin * content-encoding gzip cross-origin-resource-policy cross-origin x-content-type-options nosniff alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 264 date Mon, 25 Nov 2024 18:20:20 GMT x-xss-protection 0 content-type text/javascript; charset=UTF-8 content-disposition attachment; filename="f.txt" server cafe
GET H2	200	ads syndicatedsearch.goog/afs/ Frame 0AE9	0 0	275ms 156ms	Document text/html	2607:f8b0:4006:823::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://syndicatedsearch.goog/afs/ads?adsafe=medium&psid=5733297675&pcsa=false&channel=seg11&client=dp-domainactive_60_3ph_xml&r=m&hl=en&rpbu=https%3A%2F%2Finvestigating-embezzlement-cxqrichrich.today%2F%3Fcaf_results%3D1%26acid%3D0%26asrc%3D%26at2%3D60%26at3%3Dseg11%26atxt%3D%26avid%3D%26ct%3D184%26psqs%3D%26sqs%3D%26t1%3D%26t2%3D%26t3%3D%26tpct%3D%26u%3D%26u2%3D%26uuid%3D13917d3a-d32a-48ab-a5c2-bd197f86bb83%26rfpi%3D%26ec%3D%26at4%3D5733297675%26sescnt%3D1&type=3&uiopt=false&swp=as-drid-2552143704139388&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301542%2C17301266%2C72717107%2C49280903%2C72771954&format=r1&nocache=611732558819971&num=0&output=afd_ads&domain_name=investigating-embezzlement-cxqrichrich.today&v=3&bsl=8&pac=0&u_his=2&u_tz=-600&dt=1732558819972&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1200&frm=0&uio=-&cont=kwBlock1&drt=0&jsid=caf&nfp=1&jsv=697661440&rurl=https%3A%2F%2Finvestigating-embezzlement-cxqrichrich.today%2F Requested by Host: www.google.com URL: https://www.google.com/adsense/domains/caf.js?abp=1&2va64smr560lx5k=true Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software gws / Resource Hash Security Headers Name Value Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-npDmkDw4IU7li4dOikwt4Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other X-Xss-Protection 0 Request headers Referer https://investigating-embezzlement-cxqrichrich.today/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=3600 content-disposition inline content-encoding br content-length 2947 content-security-policy object-src 'none';base-uri 'self';script-src 'nonce-npDmkDw4IU7li4dOikwt4Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other content-type text/html; charset=UTF-8 cross-origin-opener-policy same-origin-allow-popups; report-to="gws" date Mon, 25 Nov 2024 18:20:20 GMT expires Mon, 25 Nov 2024 18:20:20 GMT report-to {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} server gws x-xss-protection 0
GET H3	200	pxlt.php Show response investigating-embezzlement-cxqrichrich.today/include/	2 B 631 B	75ms 74ms	Script text/javascript	2606:4700:3032::6815:67 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://investigating-embezzlement-cxqrichrich.today/include/pxlt.php?uuid=13917d3a-d32a-48ab-a5c2-bd197f86bb83&cb=3580792 Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:67 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0889a34434e586e918436027c4e8b4c3380f84643731bdeb57024adb8745cf53 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JY%2FfMTEsHg6ffUobjZZpp2xFN27K8yZhadOuP1jYgDI49UJDUhl%2BtYlCcP2TShVfoAKW1ZgXtEAMFJhNIKAXJTd3%2F2nPBMXP89u4b3XXwXnN0zxDsyh8ehp%2BrNv6PJtHr26Zs6cz6ok%2FW%2BgVg0kWrxK2WDngyDJIURkilVZaYiMHRIXbapLlgeF%2BHA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e83a6f108f2ef9f-EWR alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=23551&sent=18&recv=14&lost=0&retrans=0&sent_bytes=9512&recv_bytes=4956&delivery_rate=225879&cwnd=12000&unsent_bytes=0&cid=ea8a126bb6967a7d&ts=542&x=1", cfHdrFlush;dur=0 content-length 2 date Mon, 25 Nov 2024 18:20:20 GMT content-type text/javascript;charset=UTF-8 server cloudflare
GET		ct obs.togreencolumn.com/	0 0
GET H3	200	px.gif investigating-embezzlement-cxqrichrich.today/abp/	43 B 707 B	104ms 103ms	Image image/gif	2606:4700:3032::6815:67 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://investigating-embezzlement-cxqrichrich.today/abp/px.gif?ch=1&abp=1&2va64smr560lx5k=true&rn=2.994919419093936 Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:67 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers cf-cache-status HIT etag "2b-6262ca5e61600" age 0 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ton%2BgEAY7vUGI3RJjyotrWO8RTP9UvaVycaaDF3Wd62GxGllY6cOmYXA1tFBXU8X6fBzyQbgT%2FaY5C5T1e6nJ91ZpleDw8XnWNjKS8rpUDBH2WwXtbAOV3zHigrIE5dDU%2Bv1MtiPDpW2B6lTHqHKdAOwY0MWm3EK9P9zgfUQwt7nzmI0y3OmTRj2lg%3D%3D"}],"group":"cf-nel","max_age":604800} alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=23502&sent=21&recv=17&lost=0&retrans=0&sent_bytes=10917&recv_bytes=6158&delivery_rate=6906&cwnd=12000&unsent_bytes=0&cid=ea8a126bb6967a7d&ts=986&x=1", cfHdrFlush;dur=0 date Mon, 25 Nov 2024 18:20:20 GMT content-type image/gif last-modified Tue, 05 Nov 2024 16:11:04 GMT vary Accept-Encoding cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e83a6f39b43ef9f-EWR accept-ranges bytes content-length 43 server cloudflare
GET H3	200	px.gif investigating-embezzlement-cxqrichrich.today/abp/	43 B 705 B	71ms 70ms	Image image/gif	2606:4700:3032::6815:67 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://investigating-embezzlement-cxqrichrich.today/abp/px.gif?ch=2&abp=2&2va64smr560lx5k=true&rn=2.994919419093936 Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:67 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-cache-status HIT etag "2b-6262ca5e61600" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fDZGa8XTObZVmCpQkkV8LHQqttOXmCc7PJ7coOKkSzhW17NUvOB4p8ixfstvUBqN3cCcnFoFqySQmuIW6UFQOxcZr3LWjSTevtQr4SLOFnTUSrxRG0aigfqF4FXGoE9GPd6yvDsYy30UrzyKDevY55PqMb9TqSyg6sXWrsqgaSfZUQLA1AEPk%2FuVvw%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e83a6f39b48ef9f-EWR accept-ranges bytes alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=23502&sent=20&recv=17&lost=0&retrans=0&sent_bytes=10189&recv_bytes=6158&delivery_rate=6906&cwnd=12000&unsent_bytes=0&cid=ea8a126bb6967a7d&ts=953&x=1", cfHdrFlush;dur=0 content-length 43 date Mon, 25 Nov 2024 18:20:20 GMT content-type image/gif last-modified Tue, 05 Nov 2024 16:11:04 GMT vary Accept-Encoding server cloudflare
POST H3	200	abpc.php Show response investigating-embezzlement-cxqrichrich.today/	0 637 B	79ms 77ms	XHR text/html	2606:4700:3032::6815:67 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://investigating-embezzlement-cxqrichrich.today/abpc.php Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:67 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://investigating-embezzlement-cxqrichrich.today/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json Content-Type application/json Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=asXBBY%2Bzfplvn41brLvqtvSgeV4FdItVD1DzzuxI8x0k0TC3w3bdNIY8IFz%2BXPjQ9aN0AdO3owVLK%2BF1tXPtgksEg791CoxvBXUaSMcmPFqi8oOqOVo2wFbPQVAK3yNQ8CccCbOoZgvLfD9ySnppBMp%2BGe58yc0HbfS78nCLnDvq4W6BkJcEqQUKBw%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e83a6f6b86eef9f-EWR alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=25906&sent=23&recv=22&lost=0&retrans=0&sent_bytes=11670&recv_bytes=7613&delivery_rate=15725&cwnd=12000&unsent_bytes=0&cid=ea8a126bb6967a7d&ts=1461&x=1", cfHdrFlush;dur=0 date Mon, 25 Nov 2024 18:20:20 GMT content-type text/html; charset=UTF-8 server cloudflare
GET H3	200	da.php Show response investigating-embezzlement-cxqrichrich.today/	0 785 B	99ms 99ms	Script text/javascript	2606:4700:3032::6815:67 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://investigating-embezzlement-cxqrichrich.today/da.php?act=2&gal=true&giev=0&gtp=%7B%22cafRequestAccepted%22%3Atrue%2C%22cafStatus%22%3A%7B%22client%22%3A%22partner-dp-domainactive_60_3ph_xml%22%2C%22adult%22%3Afalse%7D%7D&acid=0&asrc=&at2=60&at3=seg11&atxt=&avid=&ct=184&psqs=&sqs=&t1=&t2=&t3=&tpct=&u=&u2=&uuid=13917d3a-d32a-48ab-a5c2-bd197f86bb83&rfpi=&ec=&at4=5733297675&sescnt=1&impact= Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:67 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tkyt%2FF741ep7dgPQACYmHrq56sVBdSoPbxRbGhtG2H%2BM9mYY24VBK76DIL3fYdg8RxiZW1Vk35n1IAS6Ue5DppC0i8AhSG3b8vETJiKmtEQ2CK1ad0V2ImXTHFT%2FGrZw4IJQQ8v%2B07rfh562VXi1%2B%2BnKVtPDE5vrma0%2FtBCokXmbZeVD68Eafeo0kg%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods POST, GET expires 0 alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=QUIC&rtt=25906&sent=24&recv=22&lost=0&retrans=0&sent_bytes=12330&recv_bytes=7613&delivery_rate=15725&cwnd=12000&unsent_bytes=0&cid=ea8a126bb6967a7d&ts=1484&x=1", cfHdrFlush;dur=0 p3p policyref="/w3c/p3p.xml",CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM" date Mon, 25 Nov 2024 18:20:20 GMT content-type text/javascript;charset=UTF-8 cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} pragma no-cache access-control-allow-credentials true cf-ray 8e83a6f6b871ef9f-EWR access-control-allow-origin * content-length 0 server cloudflare
GET H2	204	gen_204 syndicatedsearch.goog/afs/	0 509 B	237ms 136ms	Image text/html	2607:f8b0:4006:823::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://syndicatedsearch.goog/afs/gen_204?client=dp-domainactive_60_3ph_xml&output=uds_ads_only&zx=qc7hgfkayfn3&aqid=5L9EZ4jnC92YnboP2uyoAQ&psid=5733297675&pbt=bs&adbx=540&adby=30&adbh=557&adbw=520&adbah=166%2C166%2C166&adbn=master-1&eawp=partner-dp-domainactive_60_3ph_xml&errv=697661440&csala=6%7C0%7C310%7C68%7C46&lle=0&ifv=1&hpt=0 Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software gws / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-Xz9V_ZoHY6xsw1aTqPhj8g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers content-security-policy object-src 'none';base-uri 'self';script-src 'nonce-Xz9V_ZoHY6xsw1aTqPhj8g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other cross-origin-opener-policy same-origin-allow-popups; report-to="gws" report-to {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} permissions-policy unload=() alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Mon, 25 Nov 2024 18:20:22 GMT x-xss-protection 0 content-type text/html; charset=UTF-8 server gws x-frame-options SAMEORIGIN
GET H2	204	gen_204 syndicatedsearch.goog/afs/	0 212 B	50ms 47ms	Image text/html	2607:f8b0:4006:823::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://syndicatedsearch.goog/afs/gen_204?client=dp-domainactive_60_3ph_xml&output=uds_ads_only&zx=16rp4ev87n97&aqid=5L9EZ4jnC92YnboP2uyoAQ&psid=5733297675&pbt=bv&adbx=540&adby=30&adbh=557&adbw=520&adbah=166%2C166%2C166&adbn=master-1&eawp=partner-dp-domainactive_60_3ph_xml&errv=697661440&csala=6%7C0%7C310%7C68%7C46&lle=0&ifv=1&hpt=0 Requested by Host: investigating-embezzlement-cxqrichrich.today URL: https://investigating-embezzlement-cxqrichrich.today/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:823::200e , United States, ASN15169 (GOOGLE, US), Reverse DNS Software gws / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-JdcAxE64XcYnyXGpIV9GoA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://investigating-embezzlement-cxqrichrich.today/ Response headers content-security-policy object-src 'none';base-uri 'self';script-src 'nonce-JdcAxE64XcYnyXGpIV9GoA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other cross-origin-opener-policy same-origin-allow-popups; report-to="gws" report-to {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} permissions-policy unload=() alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Mon, 25 Nov 2024 18:20:22 GMT x-xss-protection 0 content-type text/html; charset=UTF-8 server gws x-frame-options SAMEORIGIN

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

obs.togreencolumn.com

URL

https://obs.togreencolumn.com/ct?id=59128&url=https%3A%2F%2Finvestigating-embezzlement-cxqrichrich.today%2F&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1732558820160&hl=2&op=0&ag=4270235709&rand=54807012726555811119877175120522135171450911000475768500000513202981287828158227651562&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDY1NDJdLFsiYWJuY2giLDM2XSxbLTksIisiXSxbLTIwLCItIl0sWy0zMCwiW1widlwiLDBdIl0sWy0zNCwiLSJdLFstNTcsIldFMFpWMXhPY1ZoWFhWVmNTeGNGV2xaVVNVeE5YRjBIR1dKWVNobFlTVWxWUUdRWkVWeFBXRlVaV0UwWkJWaFhWbGRBVkZaTVNnY1pFUU1PQXdnTUNRb0pBUkFWR1FWWVYxWlhRRlJXVEVvSEF3Z0JBd29KRUJWWVRSbDRTMHRZUUJkUFhCa1JVVTFOU1VvREZoWldXeGROVmw1TFhGeFhXbFpWVEZSWEYxcFdWQlpRRmc5Y0NsZ0JDd0FPQUZnSVhBNEtXZ29LQ3dwYVdnRmRDRmdOWEEwUFd3MFBGMU5LQXdnRER3RU1EZ2dRRlZoTkdVc1pFVkZOVFVsS0F4WVdWbHNYVFZaZVMxeGNWMXBXVlV4VVZ4ZGFWbFFXVUJZUFhBcFlBUXNBRGdCWUNGd09DbG9LQ2dzS1dsb0JYUWhZRFZ3TkQxc05EeGRUU2dNSUF3NEtDdz09Il0sWy02NCwiWzAsXCJcIixbXV0iXSxbLTcwLCItIl0sWy03LCItIl0sWy0xNCwiLSJdLFstMTksIlsxMDAsMTAwLDEwMCwxMDAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyODUsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwXSJdLFstMjksIi0iXSxbLTMyLCIyIl0sWy00NCwiMCwwLDAsNSJdLFstNDcsIlBhY2lmaWMvSG9ub2x1bHUsZW4tVVMsbGF0bixncmVnb3J5Il0sWy01OCwiLSJdLFstNjAsMjA4XSxbLTI3LCJbMTAwLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0zNSwiWzE3MzI1NTg4MjAwNDMsMTBdIl0sWy01NCwie1wiaFwiOltcIl8zXCIsXCIyODcyODk5MzIwXCJdLFwiZFwiOltdLFwiYlwiOltdLFwic1wiOjF9Il0sWy02MywiLSJdLFstMTMsIi0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy00OSwiLSJdLFstNTYsImxhbmRzY2FwZS1wcmltYXJ5Il0sWy02MSwie1wid2dzbFwiOlwiNDtwYWNrZWRfNHg4X2ludGVnZXJfZG90X3Byb2R1Y3Q7dW5yZXN0cmljdGVkX3BvaW50ZXJfcGFyYW1ldGVycztwb2ludGVyX2NvbXBvc2l0ZV9hY2Nlc3M7cmVhZG9ubHlfYW5kX3JlYWR3cml0ZV9zdG9yYWdlX3RleHR1cmVzO1wiLFwicGNmXCI6XCJiZ3JhOHVub3JtXCJ9Il0sWy02NSwiLSJdLFstMiwiMTksZUFIV1gxL2YzcXpDdmJrdXltUXdnbElhRjNwSXNnSUlqU1ErOGlLZ3FJMG9zSUFpcEZFRVFSSWtVZ2RFUVFwVW9KU0F0Q0FxU0g5R3l5N1pXWitlci9kK2U5MmJ3c0NTRC8xZSJdLFstMTIsIm51bGwiXSxbLTI0LCJbXSJdLFstMjgsImVuLVVTLGVuIl0sWy0zOCwibCwtMSwtMSwxLDAsMSwwLDE4LDgxLDEzOCwtMSwwLDMxNS42LDMxNS42LDY1MCw2NTEiXSxbLTQ4LCIwLDAiXSxbLTUwLCItIl0sWy02NywiLSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjI5LFwid2dsXCI6MSxcImdyZW5cIjpcIndlYmtpdCB3ZWJnbFwiLFwic2VmXCI6MTkzMDgyMDI3OSxcInNlY1wiOlwiXCJ9Il0sWy00LCI8aHRtbCBkYXRhLWFkYmxvY2trZXk9XCJNRnd3RFFZSktvWklodmNOQVFFQkJRQURTd0F3U0FKQkFPa2ZrT1YzbHNHS3FROWo1YmFnenEzd2pOUU54V3duL2VzVlhuUUZLeWtkR05ubno3dzVVZUEySTRPdVdIV3ZoMG9CS2s3NDdUYmZTeU5zc3FPcnlia0NBd0VBQVE9PV95ZmJtYTZpUW9XK0kwNEZvZG9zVitDSm1pT1Y1Q0JsbEdhZTVnb2J4SjdUS1ZEYTl6SHk1V0pXTW9CVkVHKzBVWm5SdG9CaWtkbzhyRllOYytmVVFLUT09XCIgbGFuZz1cImVuXCI%2BPGhlYWQ%2BICAgIDxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9wYXJ0bmVyLmdvb2dsZWFkc2VydmljZXMuY29tL2dhbXBhZC9jb29raWUuanM%2FZG9tYWluPWludmVzdGlnYXRpbmctZW1iZXp6bGVtZW50LWN4cXJpY2hyaWNoLnRvZGF5JmFtcDtjbGllbnQ9cGFydG5lci1kcC1kb21haW5hY3RpdmVfNjBfM3BoX3htbCZhbXA7cHJvZHVjdD1TQVMmYW1wO2NhbGxiYWNrPV9fc2FzQ29va2llJmFtcDtjb29raWVfdHlwZXM9djElMkN2MlwiPjwvc2NyaXB0PjxzY3JpcHQ%2BXG4gICAgdmFyIG9idHNjcmlwdCA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ3NjcmlwdCcpO1xuICAgIG9idHNjcmlwdC5zZXRBdHRyaWJ1dGUoJ3NyYycsJ2h0dHBzOi8vb2IudG9ncmVlbmNvbHVtbi5jb20vaS82ZTNhODI5NzlhMWU3M2MzMzIzY2M4ZDFhNGU0NmI0Ni5qcycpO1xuICAgIG9idHNjcmlwdC5zZXRBdHRyaWJ1dGUoXCJkYXRhLWNoXCIsIFwiY2hlcTRwcGNcIik7XG4gICAgb2J0c2NyaXB0LnNldEF0dHJpYnV0ZShcImRhdGEtanNvbnBcIiwgXCJvbkNoZXFSZXNwb25zZVwiKTtcbiAgICBvYnRzY3JpcHQuc2V0QXR0cmlidXRlKFwiY2xhc3NcIiwgXCJjdF9jbGlja3RydWVfNTkxMjhcIik7XG4gICAgb2J0c2NyaXB0LnNldEF0dHJpYnV0ZShcImRhdGEtdXZpZFwiLCBcIlwiKTtcbiAgICBkb2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKG9idHNjcmlwdCk7XG4gICAgXG4gICAgZnVuY3Rpb24gb25DaGVxUmVzcG9uc2UgKG1lc3NhZ2UpIHtcbiAgICAgICAgdHJ5IHtcbiAgICAgICAgICAgIHZhciB1cmwgPSBcImh0dHBzOi8vODFieDBmZW82ay5leGVjdXRlLWFwaS51cy13ZXN0LTIuYW1hem9uYXdzLmNvbS9tYWluXCJcbiAgICAgICAgICAgIGZldGNoKHVybCwgeyBtZXRob2Q6ICdQT1NUJyxoZWFkZXJzOiB7XCJhY2NlcHRcIjogXCIqLypcIiwgXCJDb250ZW50LVR5cGVcIjogXCJhcHBsaWNhdGlvbi9qc29uXCIsIFxuICAgICAgICAgICAgXCJvcmlnaW5cIjogXCJodHRwczovL2ludmVzdGlnYXRpbmctZW1iZXp6bGVtZW50LWN4cXJpY2hyaWNoLnRvZGF5XCJ9LCBib2R5OiBKU09OLnN0cmluZ2lmeSh7XCJtZXNzYWdlXCI6IG1lc3NhZ2UsIFwiaGFzaFwiOiBcIlwiLCBcImRvbWFpblwiOiBcImludmVzdGlnYXRpbmctZW1iZXp6bGVtZW50LWN4cXJpY2hyaWNoLnRvZGF5XCIsIFwicGlkXCI6IDEgfSkgfSk7IH0gXG4gICAgICAgIGNhdGNoIChlcnIpIHt9XG4gICAgICAgIH1cbiAgICA8L3NjcmlwdD48c2NyaXB0IHNyYz1cImh0dHBzOi8vb2IudG9ncmVlbmNvbHVtbi5jb20vaS82ZTNhODI5NzlhMWU3M2MzMzIzY2M4ZDFhNGU0NmI0Ni5qc1wiIGRhdGEtY2g9XCJjaGVxNHBwY1wiIGRhdGEtanNvbnA9XCJvbkNoZXFSZXNwb25zZVwiIGNsYXNzPVwiY3RfY2xpY2t0cnVlXzU5MTI4XCIgZGF0YS11dmlkPVwiXCI%2BPC9zY3JpcHQ%2BXG48bWV0YSBjaGFyc2V0PVwidXRmLThcIj5cbjxtZXRhIGh0dHAtZXF1aXY9XCJYLVVBLUNvbXBhdGlibGVcIiBjb250ZW50PVwiSUU9ZWRnZSxjaHJvbWU9MVwiPlxuPG1ldGEgaHR0cC1lcXVpdj1cImNsZWFydHlwZVwiIGNvbnRlbnQ9XCJvblwiPlxuPG1ldGEgY29udGVudD1cIndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAsIG1pbmltdW0tc2NhbGU9MS4wLCBtYXhpbXVtLXNjYWxlPTEsIHVzZXItc2NhbGFibGU9MFwiIG5hbWU9XCJ2aWV3cG9ydFwiPlxuPG1ldGEgcHJvcGVydHk9XCJvZzp0aXRsZVwiIGNvbnRlbnQ9XCJcIj5cbjxtZXRhIHByb3BlcnR5PVwib2c6ZGVzY3JpcHRpb25cIiBjb250ZW50PVwiXCI%2BXG48bWV0YSBuYW1lPVwiZGVzY3JpcHRpb25cIiBjb250ZW50PVwiXCI%2BXG48bWV0YSBuYW1lPVwiSGFuZGhlbGRGcmllbmRseVwiIGNvbnRlbnQ9XCJUcnVlXCI%2BXG48dGl0bGU%2BPC90aXRsZT5cbjxzdHlsZSJdLFstOCwiLSJdLFstNDUsIjYyMCw2NzcsMCwwLDAsNTYyLDAsMCw2NDgsMCwwLDAsMCwwLDAsMCwwLDAsMCw2ODQsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAiXSxbLTcxLCJhMDExMDAxMDEwMDEwMDEwMTAwMDEwMTAwMTExMTEwMTAwMDAxMCJdLFstMTUsIi0iXSxbLTE2LCIwIl0sWy0yMSwiLSJdLFstMzEsImZhbHNlIl0sWy0zNywiLTE0NC02Ni0xODAtIl0sWy02OCwiLSJdLFstNSwiLSJdLFstMjYsIntcInRqaHNcIjoxMDQ3NDUyMyxcInVqaHNcIjo3MDIyMzc5LFwiamhzbFwiOjQyOTQ3MDUxNTJ9Il0sWy0zNiwiW1wiNC8zXCIsXCI0LzNcIl0iXSxbLTM5LCJbXCIyMDAzMDEwN1wiLDIsXCJHZWNrb1wiLFwiTmV0c2NhcGVcIixcIk1vemlsbGFcIixudWxsLG51bGwsdHJ1ZSw4LGZhbHNlLG51bGwsNSx0cnVlLHRydWUsbnVsbCwwLHRydWUsdHJ1ZV0iXSxbLTQxLCItIl0sWzM3LCJbMzMxNjIyNDA0OSxmdW5jdGlvbihuZXdWYWx1ZSkge1xuICAgICAgICAgICAgICBhZGRDb250ZW50V2luZG93UHJveHkodGhpcylcbiAgICAgICAgICAgICAgLy8gUmVzZXQgcHJvcGVydHksIHRoZSBob29rIGlzIG9ubHkgbmVlZGVkIG9uY2VcbiAgICAgICAgICAgICAgT2JqZWN0LmRlZmluZVByb3BlcnR5KGlmcmFtZSwgJ3NyY2RvYycsIHtcbiAgICAgICAgICAgICAgICBjb25maWd1cmFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHdyaXRhYmxlOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB2YWx1ZTogX3NyY2RvY1xuICAgICAgICAgICAgICB9KVxuICAgICAgICAgICAgICBfaWZyYW1lLnNyY2RvYyA9IG5ld1ZhbHVlXG4gICAgICAgICAgICB9XSJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstNiwiLSJdLFstMTcsIjE2Il0sWy0yMywiKyJdLFstNDMsIjAwMDAwMDAxMDEwMDAwMDEwMDExMTAxMTAwMTAxMTAxMDAwMDAxMCJdLFstNDYsIjAiXSxbLTU1LCIwIl0sWy01OSwiZGVmYXVsdCJdLFstMTEsIntcInRcIjpcIlwiLFwibVwiOltcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwiZGVzY3JpcHRpb25cIl19Il0sWy0xOCwiWzAsMCwwLDFdIl0sWy0yNSwiLSJdLFstMzMsIi0iXSxbLTQyLCIxNzI0Mjk3NjUzIl0sWyJibmNoIiwyNDVdLFstMSwiLSJdLFstMTAsIi0iXSxbLTQwLCIzMyJdLFstNTEsIi0iXSxbLTUyLCItIl0sWy01MywiMTAwIl0sWy02MiwiODAiXSxbLTY2LCJnZW9sb2NhdGlvbixjaHVhZnVsbHZlcnNpb25saXN0LGNyb3Nzb3JpZ2luaXNvbGF0ZWQsc2NyZWVud2FrZWxvY2sscHVibGlja2V5Y3JlZGVudGlhbHNnZXQsc2hhcmVkc3RvcmFnZXNlbGVjdHVybCxjaHVhYXJjaCxjb21wdXRlcHJlc3N1cmUsY2hwcmVmZXJzcmVkdWNlZHRyYW5zcGFyZW5jeSx1c2IsY2hzYXZlZGF0YSxwdWJsaWNrZXljcmVkZW50aWFsc2NyZWF0ZSxzaGFyZWRzdG9yYWdlLHJ1bmFkYXVjdGlvbixjaHVhZm9ybWZhY3RvcnMsY2hkb3dubGluayxvdHBjcmVkZW50aWFscyxwYXltZW50LGNodWEsY2h1YW1vZGVsLGNoZWN0LGF1dG9wbGF5LGNhbWVyYSxwcml2YXRlc3RhdGV0b2tlbmlzc3VhbmNlLGFjY2VsZXJvbWV0ZXIsY2h1YXBsYXRmb3JtdmVyc2lvbixpZGxlZGV0ZWN0aW9uLHByaXZhdGVhZ2dyZWdhdGlvbixpbnRlcmVzdGNvaG9ydCxjaHZpZXdwb3J0aGVpZ2h0LGxvY2FsZm9udHMsY2h1YXBsYXRmb3JtLG1pZGksY2h1YWZ1bGx2ZXJzaW9uLHhyc3BhdGlhbHRyYWNraW5nLGNsaXBib2FyZHJlYWQsZ2FtZXBhZCxkaXNwbGF5Y2FwdHVyZSxrZXlib2FyZG1hcCxqb2luYWRpbnRlcmVzdGdyb3VwLGNod2lkdGgsY2hwcmVmZXJzcmVkdWNlZG1vdGlvbixicm93c2luZ3RvcGljcyxlbmNyeXB0ZWRtZWRpYSxneXJvc2NvcGUsc2VyaWFsLGNocnR0LGNodWFtb2JpbGUsd2luZG93bWFuYWdlbWVudCx1bmxvYWQsY2hkcHIsY2hwcmVmZXJzY29sb3JzY2hlbWUsY2h1YXdvdzY0LGF0dHJpYnV0aW9ucmVwb3J0aW5nLGZ1bGxzY3JlZW4saWRlbnRpdHljcmVkZW50aWFsc2dldCxwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24saGlkLGNodWFiaXRuZXNzLHN0b3JhZ2VhY2Nlc3Msc3luY3hocixjaGRldmljZW1lbW9yeSxjaHZpZXdwb3J0d2lkdGgscGljdHVyZWlucGljdHVyZSxtYWduZXRvbWV0ZXIsY2xpcGJvYXJkd3JpdGUsbWljcm9waG9uZSJdLFstNjksIkxpbnV4IHg4Nl82NHxHb29nbGUgSW5jLnw4fDE2fHwwIl0sWyJkZGIiLCIwLDE5LDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDEsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDIsMCwwLDAsMCwxLDAsMCwxLDIsMSwwLDAsMCwxLDEsMSwyLDIwLDAsMjQsMCwwLDAsMCwwLDAsMCwwLDEsMSw5LDAsMTYsMCwxLDAsMCwwLDAsMCwwLDAsNCwwIl0sWyJjYiIsIjAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDM1LDAsMCwxLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMTAsMSwwLDAsMCwwLDAsMCwyLDAsMCwwIl1d&dep=0&pre=0&sdd=%7B%7D&cri=W6aLOGs07H&pto=737&ver=62&gac=-&mei=&ap=&fe=1&duid=1.1732558820.Q2fLOSUKVojm2Dew&suid=1.1732558820.m8K2GC2Iu3SA0n4O&tuid=1.1732558820.jk8HS5EirbNG4fF4&fbc=-&gtm=-&it=10%2C296%2C181&fbcl=-&gacl=-&gacsd=-&rtic=-&bgc=-&spa=1&urid=0&ab=&sck=-&io=aGA2Og%3D%3D

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| obtscript function| onCheqResponse function| __ctcg_ct_59128_exec number| googleNDT_ number| googleAltLoader object| google boolean| gAccepted object| gData number| gActionType boolean| adsLoaded object| pageOptions object| kwBlock1 object| adBlock1 function| _obpb function| add_adblock_channel function| getUrlVars function| getx function| post function| cafCallback function| adCallback function| hideElementsByClassName function| recordAction function| loadAds object| s function| __sasCookie

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			investigating-embezzlement-cxqrichrich.today/	1969-12-31 23:59:59	Name: uuid Value: 13917d3a-d32a-48ab-a5c2-bd197f86bb83
			.investigating-embezzlement-cxqrichrich.today/	1970-01-21 03:27:22	Name: _cq_duid Value: 1.1732558820.Q2fLOSUKVojm2Dew
			.investigating-embezzlement-cxqrichrich.today/	1969-12-31 23:59:59	Name: _cq_suid Value: 1.1732558820.m8K2GC2Iu3SA0n4O
			.investigating-embezzlement-cxqrichrich.today/	1970-01-21 10:37:34	Name: __gsas Value: ID=3f8e69094b50fec2:T=1732558820:RT=1732558820:S=ALNI_MZgLyHVM7tcaZ8jN4jaDn4mr6qulA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://investigating-embezzlement-cxqrichrich.today/(Line 264) Message: [GroupMarkerNotSet(crbug.com/242999)!:A0C01202B4310000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

investigating-embezzlement-cxqrichrich.today
ob.togreencolumn.com
obs.togreencolumn.com
partner.googleadservices.com
syndicatedsearch.goog
www.google.com
www.relevantlinks.net
obs.togreencolumn.com
2600:9000:21f9:a400:2:17ff:2c80:93a1
2606:4700:3032::6815:67
2606:4700:3108::ac42:2b41
2607:f8b0:4006:80f::2002
2607:f8b0:4006:81c::2004
2607:f8b0:4006:823::200e
0889a34434e586e918436027c4e8b4c3380f84643731bdeb57024adb8745cf53
28349c38fe446eb7d54a2cde34f39e2e71e02df4c11211331ac029da54ba6f41
85712c50d38be57a7b3a0c5ad3c177b277ea4982142132dfc47ac484d4a28da5
859ae7fcfa08e118f00e09242c8cc06aade3a57f0966a3293e65c1990b2dd978
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
941a8e3b7c67e42ebb34e83cbf81f3075445456900b52ee1dd31bec433ba290e
d23f32a8ca5f37374cfb4f51c51e230c85f5fe3550ded2545b4eb7bd75b41d1c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855