tracking.hyperbolic-stretching.com Open in urlscan Pro
2606:4700:3034::6815:e6c Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://tracking.hyperbolic-stretching.com/
Effective URL:
https://tracking.hyperbolic-stretching.com/202-login.php
Submission: On May 20 via automatic, source certstream-suspicious (May 20th 2021, 10:46:16 am UTC)

Summary HTTP 30 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 2 countries across 7 domains to perform 30 HTTP transactions. The main IP is 2606:4700:3034::6815:e6c, located in United States and belongs to CLOUDFLARENET, US. The main domain is tracking.hyperbolic-stretching.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 27th 2020. Valid for: a year.

This is the only time tracking.hyperbolic-stretching.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 7	2606:4700:303... 2606:4700:3034::6815:e6c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2600:9000:20e... 2600:9000:20eb:a200:6:d04e:e780:21	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
4	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:831::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
30	10

7 2606:4700:3034::6815:e6c (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

tracking.hyperbolic-stretching.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:20eb:a200:6:d04e:e780:21 (United States)

ASN16509 (AMAZON-02, US)

dp5k1x6z3k332.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

377a921e04a1a3b314f009aea6792044.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	googlesyndication.com 377a921e04a1a3b314f009aea6792044.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	73 KB
7	hyperbolic-stretching.com 1 redirects tracking.hyperbolic-stretching.com	86 KB
4	doubleclick.net securepubads.g.doubleclick.net	122 KB
4	cloudfront.net dp5k1x6z3k332.cloudfront.net	427 KB
3	googletagservices.com www.googletagservices.com	85 KB
1	google.com adservice.google.com	553 B
1	google.de adservice.google.de	799 B
30	7

	Domain	Requested by
7	tracking.hyperbolic-stretching.com	1 redirects tracking.hyperbolic-stretching.com
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
4	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
4	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net tracking.hyperbolic-stretching.com
4	dp5k1x6z3k332.cloudfront.net	tracking.hyperbolic-stretching.com
3	www.googletagservices.com	tracking.hyperbolic-stretching.com securepubads.g.doubleclick.net
1	377a921e04a1a3b314f009aea6792044.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
30	9

This site contains links to these domains. Also see Links.

Domain
prosper.tracking202.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-06-27` - `2021-06-27`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-04-13` - `2021-07-06`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-04-13` - `2021-07-06`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-05-03` - `2021-07-26`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://tracking.hyperbolic-stretching.com/202-login.php
Frame ID: 874C12085CCF9A193430FE40C9A9B0C6
Requests: 21 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpaH5cobKyua1I5d0l_wA4qC1E_DE15WEgPy7RR0LIbroGOY1lJ_lvgP9LUcJ5FOf3--pP-nEby7nRQ-zuHzQcETvCQ_lUch-bPDaCPHx0fQeQz-9WHwT9U8pnbzFQQJfVY3KF3fyeHIRD-avsYdid0Z9k1wQ0hdxn0LLob4NjAKPyP9isFqccGxb_VSRxGLhn8tYCIbuk32RL1NJwH-YLbjNd_V2BlKjpdcdU3pQJdybvczWkQ8-CBoOiS8jR14d0Hpga8gCadZ_KOl-oGdYLSdna3vzZ4m1hI8cm5EYQ5Ru-rkjxqqJrlAZ9k69yQB2PIbWnpntIwQDpdA&sai=AMfl-YTE5sGD57wn0F5-yBS69edLOMZ9Ee5S43y1-gtiD4pVN9rBpAC4JL9HscWaJofaO6SGimX32LJT_j7D5dX0sulO3qm1p3fCJ88QAKZAVZZSilXw_6Iw4VRs92qdxpQ&sig=Cg0ArKJSzCS6TUvnnVhkEAE&adurl=
Frame ID: BC8C67F67016A20A90292A62F26E803F
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 168AA36A4EB874C75C2AC8F47F26863D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://tracking.hyperbolic-stretching.com/ HTTP 302
https://tracking.hyperbolic-stretching.com/202-login.php Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

DoubleClick for Publishers (DFP) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /googletagservices\.com\/tag\/js\/gpt(?:_mobile)?\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
script /jquery-ui.*\.js/i

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery-ui.*\.js/i

Page Statistics

30
Requests

100 %
HTTPS

89 %
IPv6

7
Domains

9
Subdomains

10
IPs

2
Countries

793 kB
Transfer

1726 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://prosper.tracking202.com/apps/?utm_source=p202pro

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://tracking.hyperbolic-stretching.com/ HTTP 302
https://tracking.hyperbolic-stretching.com/202-login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3-29

200

Primary Request 202-login.php Show response
tracking.hyperbolic-stretching.com/
Redirect Chain

https://tracking.hyperbolic-stretching.com/
https://tracking.hyperbolic-stretching.com/202-login.php

4 KB
2 KB

463ms
443ms

Document
text/html

2606:4700:3034::6815:e6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:e6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9dd949bb3448e33cb246b1f07645266fea03723f153ff1ff5fb7039c23ba0aaa

Request headers

:method: GET
:authority: tracking.hyperbolic-stretching.com
:scheme: https
:path: /202-login.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=bee27bf8e05286cf3ece223d864c03a6; path=/
cf-cache-status: DYNAMIC
cf-request-id: 0a2afad93900002baddbb8d000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bivnAbq%2BfEWAB%2Fv7QMURGn7f9lxEBCVgd9%2Bl52DboDMyYo3nenRfo7ve24WeSgFzfgYjWEp5O%2Bu5krPMN3ZVtQxrvpGlla7U%2Fj4BzcqUse9pIepVbSHU1iYwrqzQPbLpzf44TbvlAsCNaRdEWi7Y"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6524fa6ecae62bad-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Thu, 20 May 2021 10:45:55 GMT
content-type: text/html; charset=UTF-8
location: /202-login.php
cf-cache-status: DYNAMIC
cf-request-id: 0a2afad7c2000005edc8aa1000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LDhMEatej%2B5Ai8qErj%2BTry6t4vZ%2FZ8trufNUa9%2FwMVh8w%2FIY2r2hJU9scsrTyGZkGz%2BTj1zz%2Br9gTkJ%2FdVUxUp0mEqRVY3KPRsd1xIGOrrmktHmZhakQ%2BG7QM%2FLmp3t0nKK2dgGsf3eeecPhSKes"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6524fa6c6b0805ed-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3-29 200 bootstrap.min.css
tracking.hyperbolic-stretching.com/202-css/css/ 115 KB
18 KB 442ms
441ms Stylesheet
text/css 2606:4700:3034::6815:e6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.hyperbolic-stretching.com/202-css/css/bootstrap.min.css
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:e6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5

Request headers

:path: /202-css/css/bootstrap.min.css
pragma: no-cache
cookie: PHPSESSID=bee27bf8e05286cf3ece223d864c03a6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tracking.hyperbolic-stretching.com
referer: https://tracking.hyperbolic-stretching.com/202-login.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tracking.hyperbolic-stretching.com/202-login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 30 Apr 2019 16:24:58 GMT
server: cloudflare
etag: W/"1ca39-587c1d787ea80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=tSkfjq5Wr%2FQE8%2F%2BLLPMIXsb11KSGAMFRe%2BBWiMEw5o0M%2B2hrsoFR0iskcJr%2BLjM9RHMDWJKHdB1uHDLxM8aK8mUOa5Z6nVu1evvb5%2BtUhq2JzSLVVL9Ei9H4e8DwAjQNll%2Fd62XUqAuVNV2QhIW%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6524fa719a2f2bad-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a2afadb0000002bad8417c000000001

GET
H3-29 200 flat-ui-pro.min.css
tracking.hyperbolic-stretching.com/202-css/css/ 170 KB
25 KB 460ms
459ms Stylesheet
text/css 2606:4700:3034::6815:e6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.hyperbolic-stretching.com/202-css/css/flat-ui-pro.min.css
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:e6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1e21637d3265f5d0979e0157399307828665b5b3cabb6e9fd350bee1491b3fd

Request headers

:path: /202-css/css/flat-ui-pro.min.css
pragma: no-cache
cookie: PHPSESSID=bee27bf8e05286cf3ece223d864c03a6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tracking.hyperbolic-stretching.com
referer: https://tracking.hyperbolic-stretching.com/202-login.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tracking.hyperbolic-stretching.com/202-login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 30 Apr 2019 16:24:58 GMT
server: cloudflare
etag: W/"2a9e2-587c1d787ea80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hGR5TUTj1VdOY%2BPqJIdSr%2FuV8KR7iRWeh1bn1AXqPnVpQ6vcwwrEixxOlsSxlkdxEz2KbxKvn2TnlAKC1%2FDPkmTLKJSnC4W8iLrsfHb141dck%2F9I6NU%2BXNa1v8H7L6VAxbRjeotKQ8R91xOoBAgx"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6524fa719a332bad-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a2afadb0400002bad8417d000000001

GET
H3-29 200 custom.min.css
tracking.hyperbolic-stretching.com/202-css/ 9 KB
3 KB 370ms
368ms Stylesheet
text/css 2606:4700:3034::6815:e6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.hyperbolic-stretching.com/202-css/custom.min.css
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:e6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b04152e0458008ed9d39313f6999841b7978e0b3439bcf79b6c9b5bc3d91e6aa

Request headers

:path: /202-css/custom.min.css
pragma: no-cache
cookie: PHPSESSID=bee27bf8e05286cf3ece223d864c03a6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: tracking.hyperbolic-stretching.com
referer: https://tracking.hyperbolic-stretching.com/202-login.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tracking.hyperbolic-stretching.com/202-login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 30 Apr 2019 16:24:58 GMT
server: cloudflare
etag: W/"22a7-587c1d787ea80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kKd2hUJSy5wmwTaOy98nlkamTFOeHagPIYeBJVglx4XpnxbT4AOqmt%2FV9VVIjsW3W129nFQsyw%2Fn6z0hpTd7E1P3TNobrz%2F9jvYJcDZ%2FeXROec1FbMf55nH3KAyZkskp9AplVbGtyoJ4bMtov914"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6524fa719a362bad-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a2afadb0000002bad7f875000000001

GET
H2 200 jquery-1.11.2.min.js Show response
dp5k1x6z3k332.cloudfront.net/ 94 KB
33 KB 71ms
18ms Script
text/plain 2600:9000:20eb:a200:6:d04e:e780:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp5k1x6z3k332.cloudfront.net/jquery-1.11.2.min.js
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:a200:6:d04e:e780:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 370ba5ff8c7574bc13c753f1313ec6702d2b466130af6b8c0aa31c3520f1efe7

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: A1n1qtGK00ZnOOKDQv5MKzafDMWBWB8C
content-encoding: gzip
last-modified: Fri, 21 Dec 2018 06:54:39 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C1
etag: W/"af3d9d6a3f7a553423f147fdfba40791-1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/plain
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
date: Thu, 20 May 2021 10:45:56 GMT
x-amz-cf-id: 1FGpiig5tqRhAt5mz4OUyO-yrzkM7N55WYkSqUbeUI5TD_r3LcS-wA==

GET
H2 200 jquery-ui.min.js Show response
dp5k1x6z3k332.cloudfront.net/ 234 KB
64 KB 121ms
68ms Script
text/plain 2600:9000:20eb:a200:6:d04e:e780:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp5k1x6z3k332.cloudfront.net/jquery-ui.min.js
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:a200:6:d04e:e780:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7ab17d7c830048456601619d3a6422eb5e419b1d0bfef58d8b1c533435d2e054

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: cHowRFnlrg8GwicFoiylN22YJ5h3Y5nH
content-encoding: gzip
last-modified: Fri, 05 Feb 2016 16:59:58 GMT
server: AmazonS3
age: 86240
etag: W/"128d983b9cd284706fdc4e9a2fd07025-1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/plain
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
date: Wed, 19 May 2021 10:48:37 GMT
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: uljQyXqkWNtW0Z_oNoXsOUrbTW2wqjIQeBkESqW-KUkghuwN2eSlkA==

GET
H2 200 bootstrap.min.js Show response
dp5k1x6z3k332.cloudfront.net/ 35 KB
10 KB 68ms
16ms Script
text/plain 2600:9000:20eb:a200:6:d04e:e780:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp5k1x6z3k332.cloudfront.net/bootstrap.min.js
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:a200:6:d04e:e780:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 00:28:36 GMT
content-encoding: gzip
last-modified: Fri, 05 Feb 2016 16:59:50 GMT
server: AmazonS3
age: 37041
etag: W/"8320787b6989da405b9b09129eaf0686-1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: 8Lk8LCJKqkSblGbV3e4SpsyGaFKfS4LY
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
content-type: text/plain
x-amz-cf-id: XLCY39mNbTcf-od3Zw-wCdU0A9MNBEMcDY4wcE2EH6ajd4ORARGjtQ==

GET
H3-29 200 prosper202.png
tracking.hyperbolic-stretching.com/202-img/ 3 KB
3 KB 353ms
353ms Image
image/png 2606:4700:3034::6815:e6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tracking.hyperbolic-stretching.com/202-img/prosper202.png
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:e6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fc7d28f3e0679bb5c5c96450eaf4596867c870b0c52be7f735cd75c95fd76dc

Request headers

:path: /202-img/prosper202.png
pragma: no-cache
cookie: PHPSESSID=bee27bf8e05286cf3ece223d864c03a6
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: tracking.hyperbolic-stretching.com
referer: https://tracking.hyperbolic-stretching.com/202-login.php
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://tracking.hyperbolic-stretching.com/202-login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2659
cf-request-id: 0a2afadcbc00002badf0234000000001
last-modified: Tue, 30 Apr 2019 16:24:58 GMT
server: cloudflare
etag: "a63-587c1d787ea80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cHwMLFkq%2FoAe%2BmCtFXxDuQiUtK%2BwtaEaz11Lwd1xEKvOEnY72Q2rvQSF8wIvqGGRMdFImqQ41EdL3hy5KTlVIHOjX5iOBMbz%2FlYiW6AajGIXAnOkkermHaTHUpyDfz2vTON7aDRfgqTt5Z73l5Cr"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6524fa746a032bad-FRA

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 62 KB
21 KB 34ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f81f34a70f6672d9950e7b673ff1e5464be0b2299c844b488ebc6ab0c700df92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "877 / 153 of 1000 / last-modified: 1621503772"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21294
x-xss-protection: 0
expires: Thu, 20 May 2021 10:45:56 GMT

GET
H2 200 wallpaper202.jpg
dp5k1x6z3k332.cloudfront.net/ 320 KB
321 KB 40ms
40ms Image
image/jpeg 2600:9000:20eb:a200:6:d04e:e780:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dp5k1x6z3k332.cloudfront.net/wallpaper202.jpg
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:a200:6:d04e:e780:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ad590869798680bdb7a08e66c796e63d3747d925032aa32f3b2b70add96d38f2

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: PqnOL9.vNuHdbkljSxp.3OBoyLmUAhTy
via: 1.1 eab88762658052b4a1e386f8521a38cf.cloudfront.net (CloudFront)
last-modified: Fri, 01 Sep 2017 23:06:48 GMT
server: AmazonS3
age: 17549
etag: "fbc46f79084f0c55acacc2d9bb4e8501-1"
x-cache: Hit from cloudfront
content-type: image/jpeg
date: Thu, 20 May 2021 05:53:28 GMT
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
content-length: 327505
x-amz-cf-id: 9RWZcz1YgBDv_Y5X6VyCz7HhyWnIu9NFIAx7HqI0PcZDi4NdvkywSw==

GET
H3-29 200 lato-regular.woff
tracking.hyperbolic-stretching.com/202-css/fonts/lato/ 35 KB
35 KB 426ms
426ms Font
font/woff 2606:4700:3034::6815:e6c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.hyperbolic-stretching.com/202-css/fonts/lato/lato-regular.woff
Requested by: Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-css/css/flat-ui-pro.min.css
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:e6c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e14b4e3561f0efd6d6f15d4ee390287527fdc30748a0c562f1bccd485464f3a

Request headers

sec-fetch-mode: cors
origin: https://tracking.hyperbolic-stretching.com
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: font
cookie: PHPSESSID=bee27bf8e05286cf3ece223d864c03a6
:path: /202-css/fonts/lato/lato-regular.woff
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: */*
cache-control: no-cache
:authority: tracking.hyperbolic-stretching.com
referer: https://tracking.hyperbolic-stretching.com/202-css/css/flat-ui-pro.min.css
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://tracking.hyperbolic-stretching.com
Referer: https://tracking.hyperbolic-stretching.com/202-css/css/flat-ui-pro.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:57 GMT
cf-cache-status: MISS
nel: {"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 35464
cf-request-id: 0a2afadce900002bad148f0000000001
last-modified: Tue, 30 Apr 2019 16:24:58 GMT
server: cloudflare
etag: "8a88-587c1d787ea80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yhZkd053gKuy7WC%2B1bj%2FbnRRk5kI2ddyCbmn8Rma3x7kKVRxPpm2KuLPOqkVnm07XfOs4WYnoTFZGR9JFjHYnCWg8PJGPMwCvfnxxozyoMcT4BoETWVg%2BrETBn7go7CXBNcX%2BZT%2BR2mb5rKIOCpw"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6524fa74aaba2bad-FRA

GET
H2 200 pubads_impl_2021051701.js Show response
securepubads.g.doubleclick.net/gpt/ 308 KB
109 KB 109ms
40ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

sffe /

Resource Hash

65bd64f93eeb0e9cac00f8ed11c2a9c4663907c5a96b7c80bfd2c7502141939b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 00:12:19 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110938
x-xss-protection: 0
expires: Thu, 20 May 2021 10:45:56 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
799 B 37ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=tracking.hyperbolic-stretching.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
553 B 36ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=tracking.hyperbolic-stretching.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 34 KB
13 KB 116ms
79ms XHR
text/plain 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2381817625185452&correlator=3820127844861086&output=ldjh&impl=fifs&eid=31060784%2C31060790%2C31061215%2C31061220%2C21064365%2C31060991&vrg=2021051701&ptt=17&sc=1&sfv=1-0-38&ecs=20210520&iu_parts=1006305%2CP202_CS_Login_Page_288x200&enc_prev_ius=%2F0%2F1&prev_iu_szs=288x200&cookie_enabled=1&bc=31&abxe=1&lmt=1621507556&dt=1621507556821&dlt=1621507556089&idt=718&frm=20&biw=1600&bih=1200&oid=3&adxs=115&adys=412&adks=1334064552&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftracking.hyperbolic-stretching.com%2F202-login.php&vis=1&dmc=8&scr_x=0&scr_y=0&psz=344x594&msz=288x-1&ga_vid=2066338369.1621507557&ga_sid=1621507557&ga_hid=2041448039&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

6206802c48cc20fd8f4757b06ebd337a07d8dc7568dd3b4ce59485b6789cf939

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13045
x-xss-protection: 0
google-lineitem-id: 70352765
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138257846555
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://tracking.hyperbolic-stretching.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
377a921e04a1a3b314f009aea6792044.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 76ms
15ms Other
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://377a921e04a1a3b314f009aea6792044.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/ 0
0 26ms
6ms Other
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame BC8C 0
0 67ms
67ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpaH5cobKyua1I5d0l_wA4qC1E_DE15WEgPy7RR0LIbroGOY1lJ_lvgP9LUcJ5FOf3--pP-nEby7nRQ-zuHzQcETvCQ_lUch-bPDaCPHx0fQeQz-9WHwT9U8pnbzFQQJfVY3KF3fyeHIRD-avsYdid0Z9k1wQ0hdxn0LLob4NjAKPyP9isFqccGxb_VSRxGLhn8tYCIbuk32RL1NJwH-YLbjNd_V2BlKjpdcdU3pQJdybvczWkQ8-CBoOiS8jR14d0Hpga8gCadZ_KOl-oGdYLSdna3vzZ4m1hI8cm5EYQ5Ru-rkjxqqJrlAZ9k69yQB2PIbWnpntIwQDpdA&sai=AMfl-YTE5sGD57wn0F5-yBS69edLOMZ9Ee5S43y1-gtiD4pVN9rBpAC4JL9HscWaJofaO6SGimX32LJT_j7D5dX0sulO3qm1p3fCJ88QAKZAVZZSilXw_6Iw4VRs92qdxpQ&sig=Cg0ArKJSzCS6TUvnnVhkEAE&adurl=

Requested by

Host: tracking.hyperbolic-stretching.com
URL: https://tracking.hyperbolic-stretching.com/202-login.php

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 May 2021 10:45:56 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 20 May 2021 10:45:56 GMT

GET
H3-29 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/ Frame BC8C 17 KB
7 KB 23ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ac13025dc609fbe2671ff553cec81ea6e640efa3413d7c8944e461b718d1782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:43:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7009
x-xss-protection: 0
server: cafe
etag: 607056201285360291
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Jun 2021 10:43:26 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame BC8C 2 KB
1 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:44:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 03 Jun 2021 10:44:03 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BC8C 118 KB
36 KB 29ms
15ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d253e967c986d216abdb99d19a6f4487d71d64e406b832a22361a29fb62dc55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621424119306032"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36804
x-xss-protection: 0
expires: Thu, 20 May 2021 10:45:56 GMT

GET
H3-29 200 13929413282998392376
tpc.googlesyndication.com/simgad/ Frame BC8C 40 KB
40 KB 23ms
7ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13929413282998392376

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30199eb7592f9dc2d5fc61f19b2c5e9cade92002db1b13609452ab57b02ae082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 18 May 2021 15:03:05 GMT
x-content-type-options: nosniff
age: 157371
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41336
x-xss-protection: 0
last-modified: Tue, 22 Jan 2019 20:50:54 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 18 May 2022 15:03:05 GMT

GET
H3-29 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 24ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c42d25b217d0238ad491d1174be0b4e0ee1305e71185e817c0d4ec11a18685d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621424113157718"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27995
x-xss-protection: 0
expires: Thu, 20 May 2021 10:45:56 GMT

GET
H3-29 200 view
securepubads.g.doubleclick.net/pcs/ Frame BC8C 0
0 102ms
64ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvpOMAChWEAZ4RozzXmKYAsCwsdhBD_8pe6iMqYGwBY7M80Gvfzpn3-GmyeH4AkTHWkzzf9wkc-yBLmTuIEQ4Phtc0QOTl84Vb_hRKujiFQaGBqt2rHQdEkmpP8ZeeFEvNK5mlXAovzJu0dhk06xE3w3ItNWJRiSt3z53CFTdOy_PdSus1WFH0pleHbBJ8_OS8qktcBNrMbNzipm2sJd9diIg1zhHXcD4TxJL3X6SjSXxQYv-oZ93MIWE-ruEjRTpKUmc7yYDAHUJnjMshXCVd4rbPXP5I95svlSrLMdFO2frmovk9LFaiLlztdLoPKXl_m82Q2KxaDW-Mn-C81&sai=AMfl-YTVYqjmy1kXKcPnOQkM-85s3wCvMhIqv3ynTRCw2nLeQfUyralhMdBmobtnydtfJN65RSeBLAfd9HFTOrzXiuHjF5fwCqF5AVeuF7zEt9MJO3Zo0sEzyfP7Fz8eUC4&sig=Cg0ArKJSzEbntcBFJcrjEAE&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 May 2021 10:45:57 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 20 May 2021 10:45:57 GMT

GET
DATA 200
OK truncated
/ Frame BC8C 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1367e4f0efc8ce3069e66a4e0f524dde004e7cecc2ac2a55ea1cb850e92f510d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
8 KB 43ms
22ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021051701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1fff4bd1ceda0baf65c69fc7924ecf664be089c228f2864c99183d1913a38e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 20 May 2021 10:45:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7610
x-xss-protection: 0

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051701.js?31061220

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:45:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Thu, 20 May 2021 10:45:57 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 168A 12 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://tracking.hyperbolic-stretching.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://tracking.hyperbolic-stretching.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Thu, 20 May 2021 10:18:29 GMT
expires: Fri, 20 May 2022 10:18:29 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1648
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 0eWRs9v2owYuE6yDy88utlgh72O1yDgkHmBZb7_hHjI.js Show response
pagead2.googlesyndication.com/bg/ Frame 168A 14 KB
6 KB 20ms
6ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0eWRs9v2owYuE6yDy88utlgh72O1yDgkHmBZb7_hHjI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1e591b3dbf6a3062e13ac83cbcf2eb65821ef63b5c838241e60596fbfe11e32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 20 May 2021 10:43:31 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 146
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5773
x-xss-protection: 0
expires: Fri, 20 May 2022 10:43:31 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021051701&jk=2381817625185452&bg=!s7ClsPTNAAZ7hX_Ue4U7ACkAdvg8WtL1EyGEVFTjGfXyX6sqoh6f4I77I6qvcPo8-tP43sUkeoZUSgIAAAA2UgAAAAtoAQcKAUZnRea5tlfI3k8nEyxk2m6FE1_SWpJVgO3Hh8cCI0ce0Mfel9Qf5ofrF7pyFobBwxlTg4zAA5Eoihoh1p2lUONV09ElEM6FKVZVpoA00OtT3apPojExiL5LNn7fbtt9MABlvwHUhwPKk2EaBVFK1rYld79jrI6IMpyhFFhEJNKGDIzslwGV6dXigoRbFlDQEA3dtEKmmqudDdK1XJWBaN5hOSTmQxiDZ9c0Iwm1SPCIq4crbUEnsU-lgBvs97dJjeOJ6uzcg5q7YfgbUt0V0ptEwgTSl_LY7e8KcawVofHc21ZxPjd2TeUcvvovoK8J-BWSaRzFev4WvIuMLj7apPqHKX4BJ68l1ulVmirLc_Ehmg-1cwasgoDMzJrBIlhB6mJc9ofdvKlzE1xxkvUqE8y4PRnZiYedYCT4tr6B77FYW3wThcO-zZkCT1T-DJD3sNfbfbXctykn_GRi6yD7wrc0DWCwlp-W9Xn4618eIl0kos4a7R9bBTpcXm9FPOBAUeklhtEFelOy27XHaUNkzNHwdCQJ44IIK-Xs0-lPIFmF47C4acPnI6-AYWyImObRxd7EqALc3UgXzknqdDV89YAolwCBCwlpCnltx2wfCUBIttTIG72cns5gbl6npAkjeYCTnuYt3T6EHoyiqqxWo6JDIpvQ5VCux1MnCQv_4Ba7dd7HRoGCxKWvB-0e3U4fYb2SYxaRjB9cTVXckqY82cmr2WUWp_rkhzokYfTpy1yOb-hmLPL_RSmYnU2ilkT45H3d4jCuDKc6Qe7opQkWT_mMeGyQR4RTnGYtwd1_ApDcXYltgGlNyPXEmexWpv9Z1CNjtoqr0EIuxuF_pqsuO4AJKg4-7xrfLUn-rJkvYsoMSg_gpKqy8AzI8-Trwu6YZDKJgkmxDN49k1U9VO45e7hMtvmrq1iAGdtRvluW59f7Dwgfq0PiuAMSqkONOXR97GSx6iEdyPD8Yag84vZDARbg6V8YR7_Zt9sxE4U3TgyZStnadJLeG8VRu2H3GQ-EWbUfFGBk1ea4_kWc52Xm2OFh9qH9R1gQ7V8Ij8jPfkjFwc0DKpFVQCf4GnAXIVHCNqXWLtyjm0BNI9BmxNj9Zekp9cYP3j5lAibz4R2GlGn3A1y7bTR8p3lRWrWu_XyYmlsCSZeHVBLWJHhi_jq9D9h2kDk0D6T-MRZruUkY-cUbom7qkvqOhRK7gsiHSsh_zm83FFsWN6fTrg

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 May 2021 10:45:57 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BC8C 42 B
64 B 28ms
14ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst8F6iM_KvFHCIDbgxa261yebsenGKnvlJxLonoF_dzNTa_vOJOxfk5nNTwFKIuEx-0Oi2kblzKitbUa2GqS6ZvboM-z5H_7V84H1rYI50&sig=Cg0ArKJSzPTrtj_NhGZlEAE&id=lidar2&mcvt=1000&p=454,115,754,415&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210519&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=1334064552&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&rst=1621507556963&dlt=0&rpt=77&isd=0&msd=0&r=v&fum=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tracking.hyperbolic-stretching.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 20 May 2021 10:45:58 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.hyperbolic-stretching.com/	1970-01-20 03:46:43	Name: __gads Value: ID=4f166001a12b6116-222cf9a31ac800c8:T=1621507556:S=ALNI_MZ0uSkCSnrZGcpbMfY-kgas91f1Lg
			tracking.hyperbolic-stretching.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: bee27bf8e05286cf3ece223d864c03a6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

377a921e04a1a3b314f009aea6792044.safeframe.googlesyndication.com
adservice.google.com
adservice.google.de
dp5k1x6z3k332.cloudfront.net
pagead2.googlesyndication.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
tracking.hyperbolic-stretching.com
www.googletagservices.com
142.250.186.130
2600:9000:20eb:a200:6:d04e:e780:21
2606:4700:3034::6815:e6c
2a00:1450:4001:812::2002
2a00:1450:4001:828::2002
2a00:1450:4001:829::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:831::2001
1367e4f0efc8ce3069e66a4e0f524dde004e7cecc2ac2a55ea1cb850e92f510d
1d253e967c986d216abdb99d19a6f4487d71d64e406b832a22361a29fb62dc55
2fc7d28f3e0679bb5c5c96450eaf4596867c870b0c52be7f735cd75c95fd76dc
30199eb7592f9dc2d5fc61f19b2c5e9cade92002db1b13609452ab57b02ae082
370ba5ff8c7574bc13c753f1313ec6702d2b466130af6b8c0aa31c3520f1efe7
3ac13025dc609fbe2671ff553cec81ea6e640efa3413d7c8944e461b718d1782
4c42d25b217d0238ad491d1174be0b4e0ee1305e71185e817c0d4ec11a18685d
6206802c48cc20fd8f4757b06ebd337a07d8dc7568dd3b4ce59485b6789cf939
65bd64f93eeb0e9cac00f8ed11c2a9c4663907c5a96b7c80bfd2c7502141939b
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
7ab17d7c830048456601619d3a6422eb5e419b1d0bfef58d8b1c533435d2e054
7e14b4e3561f0efd6d6f15d4ee390287527fdc30748a0c562f1bccd485464f3a
9dd949bb3448e33cb246b1f07645266fea03723f153ff1ff5fb7039c23ba0aaa
a1fff4bd1ceda0baf65c69fc7924ecf664be089c228f2864c99183d1913a38e6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
ad590869798680bdb7a08e66c796e63d3747d925032aa32f3b2b70add96d38f2
b04152e0458008ed9d39313f6999841b7978e0b3439bcf79b6c9b5bc3d91e6aa
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
d1e21637d3265f5d0979e0157399307828665b5b3cabb6e9fd350bee1491b3fd
d1e591b3dbf6a3062e13ac83cbcf2eb65821ef63b5c838241e60596fbfe11e32
d5fd173d00d9733900834e0e1083de86b532e048b15c0420ba5c2db0623644b8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f04b517ba5d6a0510485689a3e42dac000f51640fd71b986804cba178eae42a5
f81f34a70f6672d9950e7b673ff1e5464be0b2299c844b488ebc6ab0c700df92

tracking.hyperbolic-stretching.com Open in urlscan Pro 2606:4700:3034::6815:e6c Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

30 Requests

100 %HTTPS

89 %IPv6

7 Domains

9 Subdomains

10 IPs

2 Countries

793 kBTransfer

1726 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

tracking.hyperbolic-stretching.com Open in urlscan Pro
2606:4700:3034::6815:e6c Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

100 %
HTTPS

89 %
IPv6

7
Domains

9
Subdomains

10
IPs

2
Countries

793 kB
Transfer

1726 kB
Size

2
Cookies

30 HTTP transactions
1 data transactions