www.bagborroworsteal.com Open in urlscan Pro
162.242.193.45 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_8&ems_l=8697087&i=1&d=NDIzMDExNDcy%7CWlRXRFo1Tko0OA%3D%3D...
Effective URL:
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Submission: On July 06 via api (July 6th 2021, 12:35:47 pm UTC) from US

Summary HTTP 51 Redirects Links 5 Behaviour Indicators

Summary

This website contacted 23 IPs in 6 countries across 15 domains to perform 51 HTTP transactions. The main IP is 162.242.193.45, located in United States and belongs to RACKSPACE, US. The main domain is www.bagborroworsteal.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on May 26th 2020. Valid for: 2 years.

This is the only time www.bagborroworsteal.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	217.175.192.21 217.175.192.21	1764 (NEXTLAYER-AS) (NEXTLAYER-AS)
2 4	162.242.193.45 162.242.193.45	27357 (RACKSPACE) (RACKSPACE)
1	2a00:1450:400... 2a00:1450:4001:82f::200a	15169 (GOOGLE) (GOOGLE)
10	93.184.220.20 93.184.220.20	15133 (EDGECAST) (EDGECAST)
1	54.192.93.42 54.192.93.42	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
2	2a0b:4d07:101::1 2a0b:4d07:101::1	44239 (PROINITY ...) (PROINITY PROINITY)
1	2a00:1450:400... 2a00:1450:400c:c08::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
1	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
10	185.32.241.65 185.32.241.65	30286 (THM) (THM)
1	2600:9000:20e... 2600:9000:20eb:fc00:0:43cc:80:93a1	16509 (AMAZON-02) (AMAZON-02)
6	143.204.98.96 143.204.98.96	16509 (AMAZON-02) (AMAZON-02)
1	52.202.92.254 52.202.92.254	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2a00:1450:400... 2a00:1450:4001:809::2004	15169 (GOOGLE) (GOOGLE)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM)
51	23

1 217.175.192.21 (Austria)

ASN1764 (NEXTLAYER-AS, AT)

visit.bagborroworsteal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 162.242.193.45 (United States) 2 redirects

ASN27357 (RACKSPACE, US)

www.bagborroworsteal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 93.184.220.20 (London, United Kingdom)

ASN15133 (EDGECAST, US)

secure.avelleassets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.93.42 (United States)

ASN16509 (AMAZON-02, US)

cdn-scripts.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a0b:4d07:101::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

seal-alaskaoregonwesternwashington.bbb.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 185.32.241.65 (United States)

ASN30286 (THM, US)

imgs.signifyd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:fc00:0:43cc:80:93a1 (United States)

ASN16509 (AMAZON-02, US)

iprecon.iglobalstores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 143.204.98.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-96.fra50.r.cloudfront.net

d1vyngmisxigjx.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.202.92.254 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-202-92-254.compute-1.amazonaws.com

checkout.iglobalstores.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (United States)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (United States)

ASN30286 (THM, US)

w2txo5aa272l2t36g36wpgnm3o6kg6rkl4ni5ksp75070cfb5db0064bam1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	signifyd.com cdn-scripts.signifyd.com imgs.signifyd.com	82 KB
10	avelleassets.com secure.avelleassets.com	128 KB
6	cloudfront.net d1vyngmisxigjx.cloudfront.net	20 KB
5	bagborroworsteal.com 2 redirects visit.bagborroworsteal.com www.bagborroworsteal.com	34 KB
3	online-metrix.net h.online-metrix.net w2txo5aa272l2t36g36wpgnm3o6kg6rkl4ni5ksp75070cfb5db0064bam1.e.aa.online-metrix.net	15 KB
3	google.de www.google.de	235 B
3	google.com 1 redirects www.google.com	195 B
3	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	1 KB
2	iglobalstores.com iprecon.iglobalstores.com checkout.iglobalstores.com	12 KB
2	googleadservices.com www.googleadservices.com	18 KB
2	bbb.org seal-alaskaoregonwesternwashington.bbb.org	3 KB
2	google-analytics.com www.google-analytics.com	19 KB
1	gstatic.com fonts.gstatic.com	28 KB
1	googleapis.com fonts.googleapis.com	591 B
0	Failed function sub() { [native code] }. Failed
51	15

	Domain	Requested by
10	imgs.signifyd.com	cdn-scripts.signifyd.com imgs.signifyd.com www.bagborroworsteal.com
10	secure.avelleassets.com	www.bagborroworsteal.com
6	d1vyngmisxigjx.cloudfront.net	www.bagborroworsteal.com
4	www.bagborroworsteal.com	2 redirects www.bagborroworsteal.com
3	www.google.de	www.bagborroworsteal.com
3	www.google.com	1 redirects www.bagborroworsteal.com
2	h.online-metrix.net	imgs.signifyd.com
2	googleads.g.doubleclick.net	1 redirects www.googleadservices.com
2	www.googleadservices.com	www.bagborroworsteal.com www.googleadservices.com
2	seal-alaskaoregonwesternwashington.bbb.org	www.bagborroworsteal.com
2	www.google-analytics.com	www.bagborroworsteal.com www.google-analytics.com
1	w2txo5aa272l2t36g36wpgnm3o6kg6rkl4ni5ksp75070cfb5db0064bam1.e.aa.online-metrix.net
1	checkout.iglobalstores.com	www.bagborroworsteal.com
1	iprecon.iglobalstores.com	secure.avelleassets.com
1	fonts.gstatic.com	fonts.googleapis.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	cdn-scripts.signifyd.com	www.bagborroworsteal.com
1	fonts.googleapis.com	www.bagborroworsteal.com
1	visit.bagborroworsteal.com
0	ghbmnnjooekpmoecnnnilnnbdlolhkhi Failed	imgs.signifyd.com
51	20

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.pinterest.com
instagram.com
www.bbb.org

Subject Issuer	Validity	Valid
visit.bagborroworsteal.com R3	`2021-05-12` - `2021-08-10`	3 months	crt.sh
bagborroworsteal.com Go Daddy Secure Certificate Authority - G2	`2020-05-26` - `2022-07-25`	2 years	crt.sh
upload.video.google.com GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
gp1.wac.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2021-03-10` - `2022-04-06`	a year	crt.sh
cdn-scripts.signifyd.com Amazon	`2020-09-30` - `2021-10-30`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.bbb.org GeoTrust RSA CA 2018	`2020-05-15` - `2022-07-03`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-06-22` - `2021-09-14`	3 months	crt.sh
imgs.signifyd.com Go Daddy Secure Certificate Authority - G2	`2021-04-02` - `2022-05-04`	a year	crt.sh
*.iglobalstores.com Amazon	`2020-10-05` - `2021-11-05`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-06-07` - `2021-08-30`	3 months	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2021-01-21` - `2022-01-21`	a year	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh

This page contains 6 frames:

Primary Page: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Frame ID: A10909D903860951A0C327B20B2B3641
Requests: 37 HTTP requests in this frame

Frame: https://www.bagborroworsteal.com/blank_for_iframe.html
Frame ID: D90D20115ABE8D936E69FCF444164536
Requests: 1 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/check.js;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&jb=3b3526266a716d77354c696c7570266a716d3544696e7d70266a73603f4160706d6d67273a323839
Frame ID: EC8621F99451DC6733FBE9B5CB2439DA
Requests: 9 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/ls_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b
Frame ID: 74CBFD53F4CF666235ECD8FFCC647FEC
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b
Frame ID: D8AE3A7748CB41D049452F38F92E3764
Requests: 2 HTTP requests in this frame

Frame: https://imgs.signifyd.com/fp/top_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b
Frame ID: B49955F72406C3FDA83B683BD0B1943C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_8&ems_l=8697087&i=1&d=NDIzMDExNDcy%7C... Page URL
https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011472&sc_uid=ZTWDZ5NJ48&sc_l... HTTP 302
https://www.bagborroworsteal.com/failedPermission HTTP 302
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination= Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

51
Requests

98 %
HTTPS

50 %
IPv6

15
Domains

20
Subdomains

23
IPs

6
Countries

361 kB
Transfer

1008 kB
Size

10
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: http://www.facebook.com/bagborroworsteal

Search URL Search Domain Scan URL

URL: http://twitter.com/bagborrowsteal

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/bagborroworsteal/
Title:

Search URL Search Domain Scan URL

URL: http://instagram.com/bagborroworsteal
Title:

Search URL Search Domain Scan URL

URL: http://www.bbb.org/western-washington/business-reviews/handbags/bag-borrow-or-steal-in-seattle-wa-22027217#bbbseal

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_8&ems_l=8697087&i=1&d=NDIzMDExNDcy%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_7843abd00fd49a4df4d05f24773a350e1791164159f33edb0306331ad8cf9db2 Page URL
https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011472&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438 HTTP 302
https://www.bagborroworsteal.com/failedPermission HTTP 302
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070221345/?random=174247294&cv=9&fst=1625574932399&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=FE7kYOyHGsKQx_AP5_-P8A4&sscte=1&crd= HTTP 302
https://www.google.com/pagead/1p-user-list/1070221345/?random=174247294&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3876359837&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/1070221345/?random=174247294&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3876359837&resp=GooglemKTybQhCsO&ipr=y

51 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK nrd.php Show response
visit.bagborroworsteal.com/u/ 847 B
808 B 230ms
177ms Document
text/html 217.175.192.21
NEXTLAYER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_8&ems_l=8697087&i=1&d=NDIzMDExNDcy%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_7843abd00fd49a4df4d05f24773a350e1791164159f33edb0306331ad8cf9db2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

217.175.192.21 , Austria, ASN1764 (NEXTLAYER-AS, AT),

Reverse DNS

Software

Apache /

Resource Hash

9c6b7f3dc7e0070fb0577c8451507124a549be6cc44074bfc912724694b993f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: visit.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:30 GMT
server: Apache
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
content-encoding: gzip
x-af: suite16-web3
cache-control: max-age=0, no-cache, no-store, must-revalidate
pragma: no-cache
content-length: 430
content-type: text/html; charset=utf-8
x-hf: suite-haproxy01b

GET
H/1.1

200
OK

Primary Request signinInput Show response
www.bagborroworsteal.com/
Redirect Chain

https://www.bagborroworsteal.com/sell/configInfo?sc_src=email_7092609&sc_lid=423011472&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2...
https://www.bagborroworsteal.com/failedPermission
https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

31 KB
32 KB

172ms
171ms

Document
text/html

162.242.193.45
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.242.193.45 , United States, ASN27357 (RACKSPACE, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

1a907d10429bfdcb82b4349a2bbd77d7c20d37ffd215ea4f650d6989f66845a0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://visit.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: JSESSIONID=4D47D6A87FAE6DD3B786FAD8C303F9B6.workerA; UBID=""; SESSION=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472; adTrackId=null; destination="/sell/configInfo?sc_src=email_7092609&sc_lid=423011472&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://visit.bagborroworsteal.com/u/nrd.php?p=ZTWDZ5NJ48_36048_7092609_1_8&ems_l=8697087&i=1&d=NDIzMDExNDcy%7CWlRXRFo1Tko0OA%3D%3D%7CNy42LjIxX1NpdGV3aWRl%7CMjk4MzQzOA%3D%3D%7C&_esuh=_9_7843abd00fd49a4df4d05f24773a350e1791164159f33edb0306331ad8cf9db2

Response headers

Date: Tue, 06 Jul 2021 12:35:31 GMT
Server: Apache-Coyote/1.1
X-Frame-Options: SAMEORIGIN
Content-Type: text/html;charset=UTF-8
Keep-Alive: timeout=5, max=498
Connection: Keep-Alive
Transfer-Encoding: chunked

Redirect headers

Date: Tue, 06 Jul 2021 12:35:31 GMT
Server: Apache-Coyote/1.1
X-Frame-Options: SAMEORIGIN
Location: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Content-Length: 0
Keep-Alive: timeout=5, max=499
Connection: Keep-Alive

GET
H2 200 css
fonts.googleapis.com/ 1 KB
591 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Playfair+Display

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9d83121a5242fd08642d5791a2c7536b9f20291498977184992a6a1db5808f05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 06 Jul 2021 12:02:52 GMT
server: ESF
date: Tue, 06 Jul 2021 12:35:32 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 06 Jul 2021 12:35:32 GMT

GET
H2 200 global.min.css
secure.avelleassets.com/TNT1930/css/ 29 KB
7 KB 27ms
6ms Stylesheet
text/css 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/css/global.min.css

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67C0) /

Resource Hash

87755777f5ef22d9f1963138aec8eff9577c8d6c4dacfbc208ff4842194999fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 04 May 2020 16:34:51 GMT
server: ECS (frb/67C0)
age: 594588
etag: "73cc-5a4d51c2920c0+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
content-length: 6894

GET
H2 200 concat_global.min.js Show response
secure.avelleassets.com/TNT1930/js_prod/ 118 KB
39 KB 28ms
7ms Script
text/javascript 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/js_prod/concat_global.min.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6727) /

Resource Hash

df095f2eeccde5bd77d3d845d3c1a077d9f72f2c757d7a77bd2ef540af9c234f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 10 Mar 2016 19:20:10 GMT
server: ECS (frb/6727)
age: 455237
etag: "1d940-52db6b3f48e80+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/javascript
content-length: 39856

GET
H2 200 ig_welcome_mat_bagborrowsteal.css
secure.avelleassets.com/TNT1930/css/ 4 KB
2 KB 27ms
7ms Stylesheet
text/css 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/css/ig_welcome_mat_bagborrowsteal.css

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67D3) /

Resource Hash

01708dc7992dc288a868c11571d919e7d474d4936cac11735c2f7d363f3d2d6f

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Mon, 03 Jun 2019 21:43:27 GMT
server: ECS (frb/67D3)
age: 104691
etag: "f14-58a72411eddc0+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/css
content-length: 1456

GET
H2 200 ig_welcome_mat_bagborrowsteal.js Show response
secure.avelleassets.com/TNT1930/js_dev/ 30 KB
10 KB 27ms
7ms Script
text/javascript 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.avelleassets.com/TNT1930/js_dev/ig_welcome_mat_bagborrowsteal.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/668A) /

Resource Hash

63302d1db7161aa5add476568458cccf5d85ed30a615b8a29df686deb5d42245

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 01 Aug 2019 20:27:21 GMT
server: ECS (frb/668A)
age: 455229
etag: "7790-58f14119a5c40+gzip"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: text/javascript
content-length: 9951

GET
H2 200 script-tag.js Show response
cdn-scripts.signifyd.com/api/ 7 KB
7 KB 153ms
80ms Script
application/javascript 54.192.93.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-scripts.signifyd.com/api/script-tag.js
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.93.42 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e17857cb74ff8bb8c18929844a2d0ff42bd36dee42113f85a8831ad42ef6eb79

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:33:07 GMT
via: 1.1 33f2aa758a32e61bd0552f8be1ef8517.cloudfront.net (CloudFront)
age: 145
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-cf-pop: MAD51-C3
content-length: 7199
x-amz-cf-id: ix6lSxZslhHxpPEQ_ZMH_JcSuY4YvOmVg9NN83kRLHLWCpe6DOZGdg==

GET
H2 200 spacer.gif
secure.avelleassets.com/images/ 43 B
148 B 6ms
6ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/spacer.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/673A) /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Wed, 30 Nov 2005 01:15:09 GMT
server: ECS (frb/673A)
age: 507133
etag: "2b-406be1133c140"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 43

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 4187
date: Tue, 06 Jul 2021 11:25:45 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Tue, 06 Jul 2021 13:25:45 GMT

GET
H2 200 global_sprites.png
secure.avelleassets.com/TNT1930/css/sprites/ 62 KB
62 KB 7ms
6ms Image
image/png 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/TNT1930/css/sprites/global_sprites.png

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67E2) /

Resource Hash

1fa823896b863bc6bf90a0e3b122db129a337a98b16364fd72018549e1184600

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Mon, 03 Jun 2019 21:43:27 GMT
server: ECS (frb/67E2)
age: 443210
etag: "f748-58a72411eddc0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/png
accept-ranges: bytes
content-length: 63304

GET
H2 200 search_vert.gif
secure.avelleassets.com/images/navigation/mainnav/ 1 KB
1 KB 6ms
6ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/navigation/mainnav/search_vert.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6762) /

Resource Hash

91ddf1744d48128e8279b661f1c36bcae9eed12b542c420ae8de883a6d2002c9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Fri, 10 Jan 2014 02:00:08 GMT
server: ECS (frb/6762)
age: 337497
etag: "452-4ef9415df5a00"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 1106

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 13ms
13ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=947781962&t=pageview&_s=1&dl=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&dr=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&dp=Sign%20In&ul=en-us&de=UTF-8&dt=Account%20Sign%20In&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1497146822&gjid=601478277&cid=456446471.1625574932&tid=UA-238171-1&_gid=106007276.1625574932&_r=1&_slc=1&z=1382087777

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.bagborroworsteal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sign_in_pink.gif
secure.avelleassets.com/images/icons/buttons/ 2 KB
2 KB 351ms
351ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/icons/buttons/sign_in_pink.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

Apache/2.4.41 (IUS) /

Resource Hash

3276b3d1db11c0bf2d0115055682512dc39716d2f1dccf07f529ddae440e3317

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Wed, 07 Aug 2019 21:29:43 GMT
server: Apache/2.4.41 (IUS)
etag: "77d-58f8da3b0ffc0"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1917

GET
H2 200 accessibility.gif
secure.avelleassets.com/images/icons/ 5 KB
6 KB 7ms
6ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/icons/accessibility.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/6795) /

Resource Hash

d61f1e577b16aefc5029d0642694c25da422759e1ba766ca6d675dcc47d02ddc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Fri, 10 Jan 2020 23:14:59 GMT
server: ECS (frb/6795)
age: 353245
etag: "15bc-59bd14b6602c0"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 5564

GET
H2 200 bag-borrow-or-steal-22027217.png
seal-alaskaoregonwesternwashington.bbb.org/logo/rbvtbas/ 2 KB
2 KB 24ms
9ms Image
image/png 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://seal-alaskaoregonwesternwashington.bbb.org/logo/rbvtbas/bag-borrow-or-steal-22027217.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine / ASP.NET
Resource Hash: cec1bbe9694e8380d5d11e528292f347622be1e2fac7064d2dd987aa8ccda177

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Tue, 06 Jul 2021 10:02:40 GMT
server: keycdn-engine
x-aspnet-version: 4.0.30319
x-edge-location: defr
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
x-shield: active
content-length: 2073
expires: Tue, 06 Jul 2021 16:35:32 GMT

GET
H2 200 search_arrow.gif
secure.avelleassets.com/images/navigation/mainnav/ 68 B
161 B 6ms
6ms Image
image/gif 93.184.220.20
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.avelleassets.com/images/navigation/mainnav/search_arrow.gif

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/668C) /

Resource Hash

1319095e503185318684b65d6a8eda0cf1efb19028b35d3f966c154019df9c69

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
last-modified: Wed, 08 Jan 2014 23:28:21 GMT
server: ECS (frb/668C)
age: 337497
etag: "44-4ef7dd9362f40"
x-frame-options: SAMEORIGIN
x-cache: HIT
content-type: image/gif
accept-ranges: bytes
content-length: 68

GET
H2 200 bag-borrow-or-steal-22027217.js Show response
seal-alaskaoregonwesternwashington.bbb.org/logo/ 3 KB
981 B 16ms
8ms Script
application/javascript 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://seal-alaskaoregonwesternwashington.bbb.org/logo/bag-borrow-or-steal-22027217.js
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine / ASP.NET
Resource Hash: 716c18fda50474e76ea9e81fd08eb20024fe490ccb77b21b22e513bf8b673d78

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
x-edge-location: defr
x-powered-by: ASP.NET
x-cache: HIT
content-length: 659
last-modified: Tue, 08 Dec 2015 18:58:11 GMT
server: keycdn-engine
etag: "80e33162ea31d11:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
x-shield: active
expires: Tue, 06 Jul 2021 16:35:32 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
94 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c08::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j91&tid=UA-238171-1&cid=456446471.1625574932&jid=1497146822&gjid=601478277&_gid=106007276.1625574932&_u=IEBAAEAAAAAAAC~&z=834942358

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 06 Jul 2021 12:35:32 GMT
content-type: text/plain
access-control-allow-origin: https://www.bagborroworsteal.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.woff2
fonts.gstatic.com/s/playfairdisplay/v22/ 28 KB
28 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/playfairdisplay/v22/nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtM.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Playfair+Display

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c5348e4d76366efc13f2bcb5a5ce138e581e90d570a09d0ec66a8cab4920be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.bagborroworsteal.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 01:54:51 GMT
x-content-type-options: nosniff
age: 38441
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28568
x-xss-protection: 0
last-modified: Thu, 28 Jan 2021 20:30:38 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Jul 2022 01:54:51 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 17ms
16ms Image
image/gif 2a00:1450:4001:808::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-238171-1&cid=456446471.1625574932&jid=1497146822&_u=IEBAAEAAAAAAAC~&z=1967068109

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
30ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j91&tid=UA-238171-1&cid=456446471.1625574932&jid=1497146822&_u=IEBAAEAAAAAAAC~&z=1967068109

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ 44 KB
17 KB 25ms
24ms Script
text/javascript 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

0f506a0bf099d96a1f34c7c23cb74929b8fa381d4114509f9aef2273f2c852b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17349
x-xss-protection: 0
server: cafe
etag: 3780840205288251298
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 06 Jul 2021 12:35:32 GMT

GET
H/1.1 200
OK blank_for_iframe.html Show response
www.bagborroworsteal.com/ Frame D90D 293 B
619 B 90ms
89ms Document
text/html 162.242.193.45
RACKSPACE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.bagborroworsteal.com/blank_for_iframe.html

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

162.242.193.45 , United States, ASN27357 (RACKSPACE, US),

Reverse DNS

Software

Apache/2.4.41 (IUS) /

Resource Hash

56f9b2160d7519c225d7455901a249f231349ee1ab51ba38377370f098d9f46d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: www.bagborroworsteal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: JSESSIONID=4D47D6A87FAE6DD3B786FAD8C303F9B6.workerA; UBID=""; SESSION=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472; adTrackId=null; destination="/sell/configInfo?sc_src=email_7092609&sc_lid=423011472&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"; _ga=GA1.2.456446471.1625574932; _gid=GA1.2.106007276.1625574932; _gat=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Server: Apache/2.4.41 (IUS)
X-Frame-Options: SAMEORIGIN
Last-Modified: Fri, 30 May 2014 19:30:53 GMT
ETag: "125-4faa3156e3540"
Accept-Ranges: bytes
Content-Length: 293
Keep-Alive: timeout=5, max=497
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H3-29 200 / Show response
www.googleadservices.com/pagead/conversion/1070221345/ 2 KB
1 KB 33ms
18ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/1070221345/?random=1625574932399&cv=9&fst=1625574932399&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

6c6a3dbe39d191763ab64724722bf332df8e3325141a880e3d90b741906a01ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1181
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/972814219/ 2 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/972814219/?random=1625574932405&cv=9&fst=1625574932399&num=2&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

502981fdd914a8914fe0ba48bb3aacbb4b17c9a1da44a721763fa6fa93dd2a83

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1096
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK tags.js Show response
imgs.signifyd.com/fp/ 80 KB
11 KB 56ms
17ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/tags.js?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&pageid=2

Requested by

Host: cdn-scripts.signifyd.com
URL: https://cdn-scripts.signifyd.com/api/script-tag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

a6c0e4b973bc57c73d29dcf2ad83c92edc5271c2e91e83e3a5a3e8fc2b0329e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iGlobalIp.js Show response
iprecon.iglobalstores.com/ 18 B
439 B 30ms
8ms Script
text/javascript 2600:9000:20eb:fc00:0:43cc:80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://iprecon.iglobalstores.com/iGlobalIp.js?p=igcCallback&_1625574932416=
Requested by: Host: secure.avelleassets.com
URL: https://secure.avelleassets.com/TNT1930/js_dev/ig_welcome_mat_bagborrowsteal.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:fc00:0:43cc:80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4406332ec7167767030f8f3f0561af1bc97ce03b13b86370736f1654e742c09b

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Jul 2021 12:20:44 GMT
via: 1.1 f797fc0ae68a3abc35e081e46174c9f2.cloudfront.net (CloudFront)
age: 888
x-amzn-requestid: 7f3c9ac3-0434-458c-bbcb-8f07879500b6
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=1800
x-amzn-trace-id: Root=1-60e44a9c-70bcb4216518ca05735f3c5f;Sampled=0
x-amz-cf-pop: FRA2-C1
access-control-allow-credentials: true
x-amz-apigw-id: CDCYcEodIAMFyfw=
content-length: 18
x-amz-cf-id: _65chUZMxRcDYeudFUWsDxypJfBF48engzRi_OzYy0nu1juURJ46-w==

GET
H/1.1 200
OK close-square.png
d1vyngmisxigjx.cloudfront.net/images/ 1 KB
2 KB 28ms
9ms Image
image/png 143.204.98.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/close-square.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-96.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: c4a749be78ebdf7a12353556c362cd7a5b63fdfdb0b65306e8968576ed1ffe87

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 00:14:09 GMT
Via: 1.1 baaf38f0a0d54e4834bf934fa5189ceb.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:47 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 44483
ETag: "554-59d396f2cb8e5"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 1364
X-Amz-Cf-Id: 0h7HoC_R8O12-TBKXh_8JKF-yJn5ZjsKRGZGwkjXJ_EHrEX979vy4g==

GET
H/1.1 200
OK bagborroworsteel.png
checkout.iglobalstores.com/images/ 11 KB
12 KB 392ms
98ms Image
image/png 52.202.92.254
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://checkout.iglobalstores.com/images/bagborroworsteel.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.202.92.254 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-202-92-254.compute-1.amazonaws.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 65dafcdaae3b766bb4cf47d6ff72f49eeda9af3363a7efae97d48ef76cc22d01

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Last-Modified: Tue, 28 Jan 2020 20:54:08 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "2d3b-59d396cd56bb4"
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11579

GET
H/1.1 200
OK US.png
d1vyngmisxigjx.cloudfront.net/images/flags/96x64/ 3 KB
4 KB 26ms
7ms Image
image/png 143.204.98.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/flags/96x64/US.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-96.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 58cdce9d9fa5d1b29625c051c2976d9914d2ddb70fdc6c83bc5c543816453720

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 23:35:50 GMT
Via: 1.1 479d15a99f4dd073131fba1516541469.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:48 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 46782
ETag: "d23-59d396f3ce581"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 3363
X-Amz-Cf-Id: k41dPaB6E2iidEBy4N62aJVjvfWZOiPCu6tKfXSzFE79X2IhrLt_kg==

GET
H/1.1 200
OK payment-methods-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 4 KB
4 KB 27ms
8ms Image
image/png 143.204.98.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/payment-methods-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-96.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: de6198ebfb4c6f439366c804fa711983cfcbb0c694432d2e5fb1f8e541ecd804

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 21:13:36 GMT
Via: 1.1 a267c4458d5587daaaf85f1d134a02d4.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:46 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 55316
ETag: "fc4-59d396f228788"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 4036
X-Amz-Cf-Id: m3PnaaFJl9NlM3UO_mX4ARFIaqpQuK4OeSqL8pclSz6_LZFgKJP9Jg==

GET
H/1.1 200
OK prepay-duty-tax-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 2 KB
3 KB 26ms
8ms Image
image/png 143.204.98.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/prepay-duty-tax-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-96.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 7446767437b0174b01820e3eb0d2202fa8e67f1753296ab5c97c21bc2dd20147

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 21:13:37 GMT
Via: 1.1 a267c4458d5587daaaf85f1d134a02d4.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:50 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 55315
ETag: "9a5-59d396f5e57f7"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 2469
X-Amz-Cf-Id: ZesfXkcJ0Csdj0SpsU7ls8obbS49GgBFXbMOjFAw_Y5TQ3GQ6mIp9Q==

GET
H/1.1 200
OK shipping-icon.png
d1vyngmisxigjx.cloudfront.net/images/ 4 KB
5 KB 30ms
12ms Image
image/png 143.204.98.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/shipping-icon.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-96.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 4389239d90f66985ca942fc833a14f1f2269581a37b804843846954e056f8036

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 00:14:10 GMT
Via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:50 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 44482
ETag: "1133-59d396f5c7398"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 4403
X-Amz-Cf-Id: Xjbb27UIDUpWHvDdiqx18tMy3vTyQpo5aYJOjP4LZNhUK-t4a4vAow==

GET
H3-29 200 /
www.google.com/pagead/1p-user-list/972814219/ 42 B
64 B 21ms
20ms Image
image/gif 2a00:1450:4001:809::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/972814219/?random=1625574932405&cv=9&fst=1625572800000&num=2&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&is_vtc=1&random=2440514288&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 /
www.google.de/pagead/1p-user-list/972814219/ 42 B
64 B 29ms
27ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/972814219/?random=1625574932405&cv=9&fst=1625572800000&num=2&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&data=ecomm_prodid%3D%3Becomm_pagetype%3DsigninInput%3Becomm_totalvalue%3D&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&is_vtc=1&random=2440514288&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

/
www.google.de/pagead/1p-user-list/1070221345/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070221345/?random=174247294&cv=9&fst=1625574932399&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&resp=GooglemKTyb...
https://www.google.com/pagead/1p-user-list/1070221345/?random=174247294&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=...
https://www.google.de/pagead/1p-user-list/1070221345/?random=174247294&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1...

42 B
64 B

20ms
20ms

Image
image/gif

2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1070221345/?random=174247294&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3876359837&resp=GooglemKTybQhCsO&ipr=y

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 06 Jul 2021 12:35:32 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/1070221345/?random=174247294&cv=9&fst=1625572800000&num=1&value=0&label=NoJeCN_H-gIQoZCp_gM&bg=666666&hl=en&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.bagborroworsteal.com%2FsigninInput%3FproductId%3D0%26size%3D%26rentalTermId%3D%26destination%3D&ref=https%3A%2F%2Fvisit.bagborroworsteal.com%2F&tiba=Account%20Sign%20In&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&crd=&is_vtc=1&random=3876359837&resp=GooglemKTybQhCsO&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK DE.png
d1vyngmisxigjx.cloudfront.net/images/flags/96x64/ 1 KB
2 KB 8ms
8ms Image
image/png 143.204.98.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d1vyngmisxigjx.cloudfront.net/images/flags/96x64/DE.png
Requested by: Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-96.fra50.r.cloudfront.net
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: a02b3ffbb8805d295bb9ef2b5676ac97189736203b6779ab848ceb7b9008e67c

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 05 Jul 2021 19:35:39 GMT
Via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
Last-Modified: Tue, 28 Jan 2020 20:54:48 GMT
Server: Apache/2.4.29 (Ubuntu)
Age: 61193
ETag: "592-59d396f3a7481"
X-Cache: Hit from cloudfront
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Amz-Cf-Pop: FRA50-C1
Accept-Ranges: bytes
Content-Length: 1426
X-Amz-Cf-Id: feHmaCYeYpL2xL03dG4SiVP7AN2qD_78CjK95B7mKtLITIABM87NJg==

GET
H/1.1 200
OK check.js;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A Show response
imgs.signifyd.com/fp/ Frame EC86 219 KB
36 KB 23ms
22ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/check.js;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&jb=3b3526266a716d77354c696c7570266a716d3544696e7d70266a73603f4160706d6d67273a323839

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/fp/tags.js?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&pageid=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

5072d3c60b8175f6ee5594d8ed4329e72a77b5cfb5b5222a91418b10b7393734

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:32 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: 75070cfb5db0064b
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
imgs.signifyd.com/fp/ Frame EC86 81 B
475 B 38ms
15ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:32 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
imgs.signifyd.com/fp/ Frame EC86 81 B
475 B 45ms
15ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&ck=0&m=1

Requested by

Host: www.bagborroworsteal.com
URL: https://www.bagborroworsteal.com/signinInput?productId=0&size=&rentalTermId=&destination=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:32 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
imgs.signifyd.com/fp/ Frame EC86 81 B
540 B 52ms
17ms XHR
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png

Requested by

Host: imgs.signifyd.com
URL: https://imgs.signifyd.com/fp/check.js;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&jb=3b3526266a716d77354c696c7570266a716d3544696e7d70266a73603f4160706d6d67273a323839

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, w2txo5aa/75070cfb5db0064b9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472
Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Last-Modified: Tue, 06 Jul 2021 12:35:32 GMT
Server: Apache
Etag: d0858b5651e54e66ba712a93c894907a
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://www.bagborroworsteal.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sun, 05 Jul 2026 12:35:32 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A Show response
imgs.signifyd.com/fp/ Frame 74CB 82 KB
13 KB 19ms
19ms Document
text/html 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/ls_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

22ebe2bdca065a3e3d0850ea730d57ed075df2c65730ca89f169bb5570e2c740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: imgs.signifyd.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: thx_guid=449cd9bae6694d0fbae32c5156e42e50
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 200
OK sid_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A Show response
h.online-metrix.net/fp/ Frame D8AE 95 KB
15 KB 59ms
18ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

d588bd4a57a2b40587c7e72802bcbfa0cf36b9ef688e1466911f54950edd6370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET page_embed_script.js
ghbmnnjooekpmoecnnnilnnbdlolhkhi/ Frame EC86 0
0

GET
H/1.1 200
OK top_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A Show response
imgs.signifyd.com/fp/ Frame B499 82 KB
13 KB 22ms
17ms Document
text/html 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/top_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

658b4494728d06c87bffcdd378bd7989be93d30d0c1df2febd9c4ed4da36638f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: imgs.signifyd.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.bagborroworsteal.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: thx_guid=449cd9bae6694d0fbae32c5156e42e50
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.bagborroworsteal.com/

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=98
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
imgs.signifyd.com/fp/ Frame EC86 0
218 B 21ms
16ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&ja=3f31312626613f3438267a3f363826663f333e383078393a30302663643f393432307a333a323026737a7b3f387830246478723d332e393e303024393230302e333438322e313032382e313630322e333a30302e313e30302e333a38302c382430267361663f3a36246c6a3f60767470732731432d324627324e7777752c6a696762677a726f776d70717c67636c2c61676f253246716b6566696e4b6e78757427314e78726f6c7d6374496627314c322732347161786525334627303e72656c74696c546770654164253b4c2532366667717c6b6c61766b676c25334424667035687476707b253343273a4e25324e7e697369762c606965606f707067756f7273766763642e636d6d2d3246246a603564323c6c3730633132323961333066673b3a376265363736396365373939643924687b673d4c616675782668716035416a726d6f6d273230383b24687b6f753f4c616e757a246660633d393e266e646f3f3a2e7678643f477d706f70652730444a65726e6966266d6376607a3d3438383364316130606d61323267346b61353630323a3069643137353c303164663c3d3838393c3164366763633a3666633b3669646264373031333b313934612e703d726e7d6f696e576e6c61736a5c64696e71652372647767696e5d756b66646f7573576d65666b6957706c697165725e64636e7b6723706e776f6b6e5f61666d606d5f616172676261765c6e696c736d29706c75656b6c5773776961697c6b6d655e64636e7b6521726c7d67696c5d7b606f63637f6176655c646364716721726e7d65696e5f70676364706c63796d725e6463647b652178647567696c5d7464615d706e637167725e66636e716d21706e756f696e5d666d7e616c7e7a5e66616e716729726e75656b665d7376675d746b6d7765705e6e616c716729786c756f616e5f6a6374635664636c71672e6778333d613a366e343766373e396360313f6933346b3a306532663b336e6435333a3638616137303763366b266361643534&jb=393733266c733f4f677a696e6c692532443726382532382057696e666d757b2730304c562d303031302c32273b422530305f696e34362d3b42253a387836342b2730384372706e675f67624b697627304e3533352e3b36253032204348544544253243273032646b69652730384565636b6d2b273a30436a72676d6527304e30392e38263433383b2c353a27303051636e637269253044373b372e3136

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 06 Jul 2021 12:35:32 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
w2txo5aa272l2t36g36wpgnm3o6kg6rkl4ni5ksp75070cfb5db0064bam1.e.aa.online-metrix.net/fp/ Frame EC86 81 B
438 B 75ms
18ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://w2txo5aa272l2t36g36wpgnm3o6kg6rkl4ni5ksp75070cfb5db0064bam1.e.aa.online-metrix.net/fp/clear.png?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:33 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A
imgs.signifyd.com/fp/ Frame EC86 0
400 B 18ms
17ms Image
image/png 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imgs.signifyd.com/fp/clear1.png;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&jf=3c333826736b665d7a6e643f746c725f637a476672733c724a5247743146396324736b6657666174653f33343a353535343133332471616c5f747178653d776760386d61667363247b6b645f6b677b3f3b30353b333831333234383f3261303e343863673166383032313234383a32613834363a6b653366303b30313235383b343238383034343b35636967643561373d346134306331353b353237363a353731616d6b35656e3e3162323431613e3535363a3b69613036333a60613063613b313f316264376c3b3161386b3433653566363b33633037323d67323639303b3230383434626e36656334306e6338306d6164653560333b373a6367633d3336333633356169662671696c5f736b65353b30343e383232313232613a63333635676a3a31366631606138643531373e62336130303866303b3f3132633737363d3b3631673269316465646333353130613b363f353932313d3d62303a3a3130306467613831636534306b666564363030636b353863306d353936373c6d33353a396663326131343a32636334636c343432643267646d306334623161376761312e73696e7a3d30

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:33 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=E8FF9CA7FB7BFF45A20CBE83247D3DE1
h.online-metrix.net/fp/ Frame D8AE 0
400 B 17ms
17ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=E8FF9CA7FB7BFF45A20CBE83247D3DE1?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&jf=3c333626736b665d7a6e643f746c725f526643453273597a565a504c4348304b24736b6657666174653f33343a353535343133332471616c5f747178653d776760386d61667363247b6b645f6b677b3f3b30353b333831333234383f3261303e343863673166383032313234383a32613834363a6b653366303b30313235383b343238383034616331333b67643831643c636439393b673639326661373162663161383063363f3f3836646036376c3a6665643739363164383760633034663b3638323437646e6e32656c6d356136613b333d64303266313e303238353260363c366432363161373a64393d3235386a3739636635643a37303834603d376233333a353a3c382671696c5f736b65353b30343d383232313232646b366663633038616166663a343a69653467306b62633167303f32636e31386330636163303136376134693363653530676639373563613f336335343f3063303a3a3036303131603a60643533666d3335333830616130353536636a343431376e3031623e6b3664353233323a333737333730613836653b66343d3631336139653763247b6166723539

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=2FA2809990CD5A7123C8BD917BBD825A?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:33 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
imgs.signifyd.com/fp/ Frame EC86 0
387 B 15ms
15ms Script
text/javascript 185.32.241.65
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://imgs.signifyd.com/fp/clear.png?org_id=w2txo5aa&session_id=9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472&nonce=75070cfb5db0064b&jac=1&je=39353526267567607a74635d65707465706c69645f6978353134342c3534263332392c31382477696d3f75676a7274615f616e74677066696c5f656c6e7326726f3f666d246263767b763d7b226e67746d6c2238312630302e207b7c61747d7b223a22616a637a656b6e652075246175646a3f616d666263653c373834353f6e30326e6a6264393531343935343930666a663963363637326a663534343936363b676a6d66313d313561623536376930333135

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

185.32.241.65 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.bagborroworsteal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 06 Jul 2021 12:35:33 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ghbmnnjooekpmoecnnnilnnbdlolhkhi
URL: chrome-extension://ghbmnnjooekpmoecnnnilnnbdlolhkhi/page_embed_script.js

Verdicts & Comments Add Verdict or Comment

171 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.www.bagborroworsteal.com/	1970-01-19 19:42:59	Name: igSplash Value: igSplash
.www.bagborroworsteal.com/	1970-01-20 04:18:30	Name: igCountry Value: DE
.bagborroworsteal.com/	1970-01-19 19:34:21	Name: _gid Value: GA1.2.106007276.1625574932
.bagborroworsteal.com/	1970-01-20 13:04:06	Name: _ga Value: GA1.2.456446471.1625574932
www.bagborroworsteal.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 4D47D6A87FAE6DD3B786FAD8C303F9B6.workerA
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: destination Value: "/sell/configInfo?sc_src=email_7092609&sc_lid=423011472&sc_uid=ZTWDZ5NJ48&sc_llid=36048&utm_source=Emarsys&utm_medium=email&utm_campaign=7.6.21_Sitewide&sc_customer=2983438"
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: adTrackId Value: null
.bagborroworsteal.com/	1970-01-30 18:20:54	Name: UBID Value: ""
.bagborroworsteal.com/	1970-01-19 19:32:54	Name: _gat Value: 1
.bagborroworsteal.com/	1969-12-31 23:59:59	Name: SESSION Value: 9c5ad23c-1a65-44b3-91e8-a1ef3c8c6472

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn-scripts.signifyd.com
checkout.iglobalstores.com
d1vyngmisxigjx.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
ghbmnnjooekpmoecnnnilnnbdlolhkhi
googleads.g.doubleclick.net
h.online-metrix.net
imgs.signifyd.com
iprecon.iglobalstores.com
seal-alaskaoregonwesternwashington.bbb.org
secure.avelleassets.com
stats.g.doubleclick.net
visit.bagborroworsteal.com
w2txo5aa272l2t36g36wpgnm3o6kg6rkl4ni5ksp75070cfb5db0064bam1.e.aa.online-metrix.net
www.bagborroworsteal.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
ghbmnnjooekpmoecnnnilnnbdlolhkhi
142.250.184.226
142.250.186.130
143.204.98.96
162.242.193.45
185.32.241.65
217.175.192.21
2600:9000:20eb:fc00:0:43cc:80:93a1
2a00:1450:4001:808::2004
2a00:1450:4001:808::200e
2a00:1450:4001:809::2004
2a00:1450:4001:80e::2002
2a00:1450:4001:827::2003
2a00:1450:4001:829::200e
2a00:1450:4001:82f::200a
2a00:1450:4001:831::2003
2a00:1450:400c:c08::9c
2a0b:4d07:101::1
52.202.92.254
54.192.93.42
91.235.132.130
91.235.134.131
93.184.220.20
01708dc7992dc288a868c11571d919e7d474d4936cac11735c2f7d363f3d2d6f
0f506a0bf099d96a1f34c7c23cb74929b8fa381d4114509f9aef2273f2c852b3
1319095e503185318684b65d6a8eda0cf1efb19028b35d3f966c154019df9c69
1a907d10429bfdcb82b4349a2bbd77d7c20d37ffd215ea4f650d6989f66845a0
1fa823896b863bc6bf90a0e3b122db129a337a98b16364fd72018549e1184600
22ebe2bdca065a3e3d0850ea730d57ed075df2c65730ca89f169bb5570e2c740
3276b3d1db11c0bf2d0115055682512dc39716d2f1dccf07f529ddae440e3317
4389239d90f66985ca942fc833a14f1f2269581a37b804843846954e056f8036
4406332ec7167767030f8f3f0561af1bc97ce03b13b86370736f1654e742c09b
502981fdd914a8914fe0ba48bb3aacbb4b17c9a1da44a721763fa6fa93dd2a83
5072d3c60b8175f6ee5594d8ed4329e72a77b5cfb5b5222a91418b10b7393734
56f9b2160d7519c225d7455901a249f231349ee1ab51ba38377370f098d9f46d
58cdce9d9fa5d1b29625c051c2976d9914d2ddb70fdc6c83bc5c543816453720
63302d1db7161aa5add476568458cccf5d85ed30a615b8a29df686deb5d42245
658b4494728d06c87bffcdd378bd7989be93d30d0c1df2febd9c4ed4da36638f
65dafcdaae3b766bb4cf47d6ff72f49eeda9af3363a7efae97d48ef76cc22d01
6c6a3dbe39d191763ab64724722bf332df8e3325141a880e3d90b741906a01ea
716c18fda50474e76ea9e81fd08eb20024fe490ccb77b21b22e513bf8b673d78
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
7446767437b0174b01820e3eb0d2202fa8e67f1753296ab5c97c21bc2dd20147
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87755777f5ef22d9f1963138aec8eff9577c8d6c4dacfbc208ff4842194999fa
91ddf1744d48128e8279b661f1c36bcae9eed12b542c420ae8de883a6d2002c9
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
9c5348e4d76366efc13f2bcb5a5ce138e581e90d570a09d0ec66a8cab4920be6
9c6b7f3dc7e0070fb0577c8451507124a549be6cc44074bfc912724694b993f6
9d83121a5242fd08642d5791a2c7536b9f20291498977184992a6a1db5808f05
a02b3ffbb8805d295bb9ef2b5676ac97189736203b6779ab848ceb7b9008e67c
a6c0e4b973bc57c73d29dcf2ad83c92edc5271c2e91e83e3a5a3e8fc2b0329e5
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c4a749be78ebdf7a12353556c362cd7a5b63fdfdb0b65306e8968576ed1ffe87
cec1bbe9694e8380d5d11e528292f347622be1e2fac7064d2dd987aa8ccda177
d588bd4a57a2b40587c7e72802bcbfa0cf36b9ef688e1466911f54950edd6370
d61f1e577b16aefc5029d0642694c25da422759e1ba766ca6d675dcc47d02ddc
de6198ebfb4c6f439366c804fa711983cfcbb0c694432d2e5fb1f8e541ecd804
df095f2eeccde5bd77d3d845d3c1a077d9f72f2c757d7a77bd2ef540af9c234f
e17857cb74ff8bb8c18929844a2d0ff42bd36dee42113f85a8831ad42ef6eb79
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

www.bagborroworsteal.com Open in urlscan Pro 162.242.193.45 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

51 Requests

98 %HTTPS

50 %IPv6

15 Domains

20 Subdomains

23 IPs

6 Countries

361 kBTransfer

1008 kBSize

10 Cookies

5 Outgoing links

Page URL History

Redirected requests

51 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.bagborroworsteal.com Open in urlscan Pro
162.242.193.45 Public Scan

Screenshot
Live screenshot

Full Image

51
Requests

98 %
HTTPS

50 %
IPv6

15
Domains

20
Subdomains

23
IPs

6
Countries

361 kB
Transfer

1008 kB
Size

10
Cookies

51 HTTP transactions
0 data transactions