imf.qal3a.online Open in urlscan Pro
2607:f8b0:4004:c07::79 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://imf.qal3a.online/2022/06/2022.html
Effective URL:
https://imf.qal3a.online/2022/06/2022.html
Submission: On January 10 via api (January 10th 2025, 5:56:37 am UTC) from US — Scanned from CA

Summary HTTP 48 Redirects Behaviour Indicators

Summary

This website contacted 13 IPs in 1 countries across 10 domains to perform 48 HTTP transactions. The main IP is 2607:f8b0:4004:c07::79, located in Washington, United States and belongs to GOOGLE, US. The main domain is imf.qal3a.online.
TLS certificate: Issued by WR3 on December 7th 2024. Valid for: 3 months.

This is the only time imf.qal3a.online was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	2607:f8b0:400... 2607:f8b0:4004:c07::79	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1b::9d	15169 (GOOGLE) (GOOGLE)
4	2607:f8b0:400... 2607:f8b0:4004:c21::84	15169 (GOOGLE) (GOOGLE)
3	172.66.44.220 172.66.44.220	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	199.232.192.193 199.232.192.193	54113 (FASTLY) (FASTLY)
3	31.13.66.35 31.13.66.35	32934 (FACEBOOK) (FACEBOOK)
2	172.253.115.94 172.253.115.94	15169 (GOOGLE) (GOOGLE)
16	172.253.63.154 172.253.63.154	15169 (GOOGLE) (GOOGLE)
6	172.253.115.155 172.253.115.155	15169 (GOOGLE) (GOOGLE)
1	142.251.111.155 142.251.111.155	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c08::84	15169 (GOOGLE) (GOOGLE)
1	172.253.63.106 172.253.63.106	15169 (GOOGLE) (GOOGLE)
48	13

1 2607:f8b0:4004:c07::79 (Washington, United States)

ASN15169 (GOOGLE, US)

imf.qal3a.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1b::9d (Washington, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c21::84 (Washington, United States)

ASN15169 (GOOGLE, US)

blogger.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.66.44.220 (United States)

ASN13335 (CLOUDFLARENET, US)

od-jsc.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 199.232.192.193 (United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 31.13.66.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.115.94 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 172.253.63.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.253.115.155 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f155.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.111.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f155.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c08::84 (Washington, United States)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.106 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f106.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 110	257 KB
7	imgur.com i.imgur.com — Cisco Umbrella Rank: 8961	545 B
6	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 43
4	googleusercontent.com blogger.googleusercontent.com — Cisco Umbrella Rank: 10221	207 KB
3	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 389 ep2.adtrafficquality.google — Cisco Umbrella Rank: 403	20 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 120	3 KB
3	pages.dev od-jsc.pages.dev	37 KB
2	gstatic.com fonts.gstatic.com	48 KB
1	google.com www.google.com — Cisco Umbrella Rank: 3
1	qal3a.online imf.qal3a.online	13 KB
48	10

	Domain	Requested by
17	pagead2.googlesyndication.com	imf.qal3a.online pagead2.googlesyndication.com
7	i.imgur.com	imf.qal3a.online
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com
4	blogger.googleusercontent.com	imf.qal3a.online
3	www.facebook.com	imf.qal3a.online
3	od-jsc.pages.dev	imf.qal3a.online
2	ep2.adtrafficquality.google	pagead2.googlesyndication.com ep2.adtrafficquality.google
2	fonts.gstatic.com	od-jsc.pages.dev
1	www.google.com	ep2.adtrafficquality.google
1	ep1.adtrafficquality.google	pagead2.googlesyndication.com
1	imf.qal3a.online
48	11

This site contains no links.

Subject Issuer	Validity	Valid
imf.qal3a.online WR3	`2024-12-07` - `2025-03-07`	3 months	crt.sh
*.g.doubleclick.net WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.googleusercontent.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
od-jsc.pages.dev WE1	`2024-12-04` - `2025-03-04`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-15` - `2025-02-14`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-10-19` - `2025-01-17`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
adtrafficquality.google WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.google.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://imf.qal3a.online/2022/06/2022.html
Frame ID: B1F85356311C5CC3B0E5EA7B412624A2
Requests: 40 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250108/r20190131/zrt_lookup_fy2021.html
Frame ID: 19AD244595C51993251542A795EAE8B1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1736082806&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&pra=5&wgl=1&aihb=0&aiof=3&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiict=1&aiapm=0.3221&aiapmi=0.33938&aief=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593188&bpp=3&bdt=182&idt=118&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=4193969496215&frm=20&pv=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fsapi=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=139
Frame ID: F1E1BB12F0D8FF3A0AA67623D18E135A
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&h=280&adk=3088186576&adf=3175363789&pi=t.aa~a.3911002853~rp.4&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1736082806&rafmt=1&to=qs&pwprc=5555275673&format=1200x280&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593970&bpp=2&bdt=963&idt=-M&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=2&correlator=4193969496215&frm=20&pv=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1338&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7
Frame ID: 7D275E2A64422E3B6AA6B6B1434665A9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&h=280&adk=3088186576&adf=2973209031&pi=t.aa~a.3299938725~rp.4&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1736082806&rafmt=1&to=qs&pwprc=5555275673&format=1200x280&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593970&bpp=1&bdt=963&idt=-M&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=4193969496215&frm=20&pv=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2080&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=2&fsb=1&dtd=15
Frame ID: 2CFFFFCE06C5F3248C514F89B460F1AB
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&h=280&adk=3809598800&adf=54630664&pi=t.aa~a.1182920990~rp.3&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1736082806&rafmt=1&to=qs&pwprc=5555275673&format=1200x280&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593970&bpp=1&bdt=964&idt=0&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=4&correlator=4193969496215&frm=20&pv=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3003&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=19
Frame ID: 8586EA3F2773CCBA7D2FB55A37412F11
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250108/r20190131/zrt_lookup_fy2021.html
Frame ID: AA468B199E4759511208F5DC5DCD6669
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: ECD3DAF6DF4E83E917B4866F9CF23221
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 84E92A40C2018EADCDA554CCD74F6905
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

برنامج الأغذية العالمي (WPF)

Page URL History Show full URLs

http://imf.qal3a.online/2022/06/2022.html HTTP 307
https://imf.qal3a.online/2022/06/2022.html Page URL

Detected technologies

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

48
Requests

98 %
HTTPS

33 %
IPv6

10
Domains

11
Subdomains

13
IPs

1
Countries

584 kB
Transfer

1378 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://imf.qal3a.online/2022/06/2022.html HTTP 307
https://imf.qal3a.online/2022/06/2022.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

48 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 2022.html Show response
imf.qal3a.online/2022/06/
Redirect Chain

http://imf.qal3a.online/2022/06/2022.html
https://imf.qal3a.online/2022/06/2022.html

51 KB
13 KB

272ms
102ms

Document
text/html

2607:f8b0:4004:c07::79
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::79 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

eb96925efcfbe2cf5dbb2a75fc3e8de5aa0afa4787b78d34f45113c1ef96cb8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-length: 12988
content-type: text/html; charset=UTF-8
date: Fri, 10 Jan 2025 05:56:32 GMT
etag: W/"b68a350a1967c4fa4ac959ee779c6381b6377d788f841bc5eb6178d0aff56b91"
expires: Fri, 10 Jan 2025 05:56:32 GMT
last-modified: Sun, 05 Jan 2025 13:13:26 GMT
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

Location: https://imf.qal3a.online/2022/06/2022.html
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 158 KB
53 KB 111ms
51ms Script
text/javascript 2607:f8b0:4004:c1b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2457458440571846

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0356394fdda7a541bb9d6dae44554831e22f0aa07de2900297e17f36bbbd419b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://imf.qal3a.online
Referer: https://imf.qal3a.online/

Response headers

content-encoding: br
etag: 10018992184821887373
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 05:56:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 10 Jan 2025 05:56:33 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 53721
x-xss-protection: 0
server: cafe

GET
H2 200 img_1716506430580.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvU_VtsfMmR6a5_dNihGM9dhyphenhyphen_TAU99odQNzGSHopfDLpqZ7XMWDfKO_1cpTYU_Q3RSRAx_5n3rs2KhYywsFFX91d5scpWfD8lwlqZHllgh_7_GSL6cZeAX_FWfdX6MuWeHT_qWy... 170 KB
171 KB 335ms
206ms Image
image/png 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvU_VtsfMmR6a5_dNihGM9dhyphenhyphen_TAU99odQNzGSHopfDLpqZ7XMWDfKO_1cpTYU_Q3RSRAx_5n3rs2KhYywsFFX91d5scpWfD8lwlqZHllgh_7_GSL6cZeAX_FWfdX6MuWeHT_qWy-jJ4_uUGzUKaoS6AhQJgg3T9AmbEY3yEBAfmS7y5ZMnJ-4pdI74kQG/s1080/img_1716506430580.png

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

8163c139f394d10a920245789492fd2cc36aeac9e1c1b0690ff10fa3ea0ee148

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
etag: "vb0"
x-content-type-options: nosniff
expires: Sat, 11 Jan 2025 05:56:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174549
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/png
vary: Origin
server: fife
content-disposition: inline;filename="img_1716506430580.png"

GET
H3 200 css2.css
od-jsc.pages.dev/ 2 KB
1 KB 134ms
43ms Stylesheet
text/css 172.66.44.220
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://od-jsc.pages.dev/css2.css?family=Poppins:wght@500;700&display=swap

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.220 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

842be935d39dcb195e58cafdaf280ac1088b22e48538b4946fe4fb18e9852706

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

content-encoding: br
etag: W/"ea2f2b6f152177bb4346aa8b89e3c5d9"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VkIW5TniSOC7m9O6TXzfjO24vFZUDpKPronHvVI%2Bpa7ub34XwoiN6IkM%2BaDiSTu1%2BWcO%2BtV26kX43sLj0jXUpa%2F%2BYV%2FKJZ27VBnuw7Q0b2RoRZS5ehZ1NI5Sv18Hk%2BYGs5bL"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22408&min_rtt=22380&rtt_var=8449&sent=11&recv=9&lost=0&retrans=0&sent_bytes=5165&recv_bytes=4903&delivery_rate=131214&cwnd=12000&unsent_bytes=0&cid=93a24c0904b0935b&ts=50&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 10 Jan 2025 05:56:33 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ffa6caafb0bab42-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H3 200 droidarabicnaskh.css
od-jsc.pages.dev/ 1 KB
1 KB 111ms
42ms Stylesheet
text/css 172.66.44.220
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://od-jsc.pages.dev/droidarabicnaskh.css

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.220 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0facd387627530907acc0b41d7076a1313a748ba84d37983618c04f2e66f1849

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

content-encoding: br
etag: W/"4c47ee2aa08d75c53fbb400d0a2bd286"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nmusu5lG6eaePznWZOJuhP2NxUZ%2F0VFD26G0qZOGLYwaYxpPnvjgBjV15i%2BVyJVmTFq8TbJ8JxgmdahCmkNpeAIsozX0fj8usNGFufa8tAYZDIOspS42%2BZUxcJOzSgqN%2F7S9"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22408&min_rtt=22380&rtt_var=8449&sent=10&recv=9&lost=0&retrans=0&sent_bytes=4116&recv_bytes=4903&delivery_rate=131214&cwnd=12000&unsent_bytes=0&cid=93a24c0904b0935b&ts=48&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 10 Jan 2025 05:56:33 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
priority: u=0,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ffa6caafb0aab42-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H2 429 umdRtdF.gif
i.imgur.com/ 0
52 B 83ms
17ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/umdRtdF.gif

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.107767,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H3 200 /
www.facebook.com/reaction/image/1635855486666999/ 815 B
933 B 136ms
33ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/reaction/image/1635855486666999/?size=20&scale=1

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

39d8ba5c57b637434d21319acfa9fe2029cc88839cab8a4767b8854c60339921

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7457529559368164188"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 22 Jan 2025 13:03:27 +0000
date: Wed, 08 Jan 2025 13:03:27 GMT
content-type: image/png
x-fb-debug: +o49uG0aPw3tQyZKe6hLnrtFtcYgVy/219LLyvRuwuDjgBwLQmowXmlyPw6sAAdoYcWXz5+ExhBcuGmw8YeZDA==
priority: u=2,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7457529559368164188", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: public, max-age=1209600
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 815
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/reaction/image/1678524932434102/ 816 B
929 B 138ms
35ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/reaction/image/1678524932434102/?size=20&scale=1

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

81d62c74016d8779cb91019934882095ad606798f3f32327fa4dadf9d023a4d5

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sun, 12 Jan 2025 10:23:34 +0000
date: Sun, 29 Dec 2024 10:23:34 GMT
content-type: image/png
x-fb-debug: flexdfLlu70GtTEpczGJkHC6xh5O52jbytMAMALo0bnxsDzTArt3DXPZKrmLrbgtyt3ZvCiQ4UR3CAFpeZ/7kw==
priority: u=2,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: public, max-age=1209600
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 816
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/reaction/image/613557422527858/ 1 KB
1 KB 137ms
34ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/reaction/image/613557422527858/?size=20&scale=1

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

7b7cc49ed4945a43ca361ca9e327cd907f5520cec87858b820e02a6db6d55779

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Tue, 14 Jan 2025 11:06:43 +0000
date: Tue, 31 Dec 2024 11:06:43 GMT
content-type: image/png
x-fb-debug: SFRlh67WjmTDRonUIdcEfyR+GflrIqRFaVAXnNkrBHPG0mp6/N3z9dIs7Q/zwH1PN5lkQCFVNo51b84Vzku9eA==
priority: u=2,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: public, max-age=1209600
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 1179
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 429 g4G5Sz2.jpeg
i.imgur.com/ 0
238 B 82ms
17ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/g4G5Sz2.jpeg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.107745,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 2Z343cB.jpeg
i.imgur.com/ 0
51 B 17ms
15ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/2Z343cB.jpeg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.126879,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 dik62Au.jpg
i.imgur.com/ 0
51 B 21ms
19ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/dik62Au.jpg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.127053,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 hDBSzIL.jpg
i.imgur.com/ 0
51 B 18ms
16ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/hDBSzIL.jpg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.127034,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 Gk1iXHp.jpeg
i.imgur.com/ 0
51 B 20ms
19ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/Gk1iXHp.jpeg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.127181,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 429 WX71CLj.jpeg
i.imgur.com/ 0
51 B 21ms
20ms Image
text/plain 199.232.192.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/WX71CLj.jpeg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.192.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

strict-transport-security: max-age=300
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
retry-after: 0
x-timer: S1736488593.127175,VS0,VE0
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-served-by: cache-yul1970076-YUL
x-cache-hits: 0
server: cat factory 1.0

GET
H2 200 3.jpg
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiF7e5qCDQ2MhWyKaPPGw_zplGhx6hwkrVdA39B7XvJxDI9BLlghoTnwy7RmNlxI4qTHXPnKc611Hrw02csi5bpENKHxy3fg6DyX8VW0Z2sp9MEM0UGHvSrS3us-ywNjgZ67RgIDIs42UaSD-Dm... 10 KB
10 KB 272ms
250ms Image
image/jpeg 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiF7e5qCDQ2MhWyKaPPGw_zplGhx6hwkrVdA39B7XvJxDI9BLlghoTnwy7RmNlxI4qTHXPnKc611Hrw02csi5bpENKHxy3fg6DyX8VW0Z2sp9MEM0UGHvSrS3us-ywNjgZ67RgIDIs42UaSD-DmEo58xytYF9hBU3iQ5vbK_sN0nHv7eeqeG36NMFQz11c/s1600/3.jpg

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

5ec73cf4d42170b4a8d173b35f0f1b9e2c73a5959fd4c905d0836a6a0612dcd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
etag: "v51"
x-content-type-options: nosniff
expires: Sat, 11 Jan 2025 05:56:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10315
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/jpeg
vary: Origin
server: fife
content-disposition: inline;filename="3.jpg"

GET
H2 200 AVvXsEjT4eUm-2rj5zOJp4t0qinB8klLc9O3IS3esNRuAwjiDn0d6WYvAiXm_uupgYOx__4zXv-Eb-_naXSEGQOL2cFWX2spboihLYvschTuM4yjp39XahK3OM4cQpooFPVt=s0-d
blogger.googleusercontent.com/img/proxy/ 26 KB
26 KB 82ms
60ms Image
image/jpeg 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blogger.googleusercontent.com/img/proxy/AVvXsEjT4eUm-2rj5zOJp4t0qinB8klLc9O3IS3esNRuAwjiDn0d6WYvAiXm_uupgYOx__4zXv-Eb-_naXSEGQOL2cFWX2spboihLYvschTuM4yjp39XahK3OM4cQpooFPVt=s0-d

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

50ff52e0b7c92330ec9b5cb0b1431540aadbbb22f02829d0411a28faa4d5db61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

access-control-expose-headers: Content-Length
timing-allow-origin: *
cache-control: public, max-age=86400, no-transform
x-content-type-options: nosniff
expires: Sat, 11 Jan 2025 05:56:33 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26293
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/jpeg
vary: Origin
server: fife
content-disposition: attachment;filename="unnamed.jpg"

GET
H3 200 jquery-latest.min.js Show response
od-jsc.pages.dev/ 94 KB
34 KB 113ms
45ms Script
text/javascript 172.66.44.220
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://od-jsc.pages.dev/jquery-latest.min.js

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.220 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

content-encoding: br
etag: W/"5e50651694cfe452faefafe2bf2e7b3a"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UaHioQqm7D%2FtkmyGGaErLukDQg9ae1bHadpTMdc4p%2Bjoxj6QkdkPOB7ud6debgW5X%2BP%2BA7Prr6yRI4%2B3h95Dfcvzry9Jt9gdGuP0NCswu%2FCL9Ma9IXjPlILdprsMwWDBCt7b"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=22408&min_rtt=22380&rtt_var=8449&sent=13&recv=9&lost=0&retrans=0&sent_bytes=6354&recv_bytes=4903&delivery_rate=131214&cwnd=12000&unsent_bytes=0&cid=93a24c0904b0935b&ts=51&x=1", cfExtPri, cfHdrFlush;dur=0
date: Fri, 10 Jan 2025 05:56:33 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
priority: u=2,i=?0
cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ffa6caafb0cab42-YYZ
access-control-allow-origin: *
server: cloudflare

GET
H3 200 DroidNaskh-Bold.woff2
fonts.gstatic.com/ea/droidarabicnaskh/v7/ 40 KB
40 KB 71ms
35ms Font
font/woff2 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/ea/droidarabicnaskh/v7/DroidNaskh-Bold.woff2

Requested by

Host: od-jsc.pages.dev
URL: https://od-jsc.pages.dev/droidarabicnaskh.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

0a6b3b2583f0b9ea7da829409bcde3dc1641adb9092100bf2e1415d61cde46d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://imf.qal3a.online
Referer: https://od-jsc.pages.dev/

Response headers

content-encoding: gzip
age: 518447
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 04 Jan 2026 05:55:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 04 Jan 2025 05:55:46 GMT
last-modified: Wed, 13 Aug 2014 16:50:04 GMT
content-type: font/woff2
vary: Accept-Encoding
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41271
x-xss-protection: 0
server: sffe

GET
H3 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 8 KB
8 KB 57ms
31ms Font
font/woff2 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: od-jsc.pages.dev
URL: https://od-jsc.pages.dev/css2.css?family=Poppins:wght@500;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://imf.qal3a.online
Referer: https://od-jsc.pages.dev/

Response headers

age: 517530
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Sun, 04 Jan 2026 06:11:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 04 Jan 2025 06:11:03 GMT
last-modified: Wed, 27 Apr 2022 16:11:40 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 7816
x-xss-protection: 0
server: sffe

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/ 432 KB
144 KB 33ms
33ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-2457458440571846

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

3a4b9e9018d2c90286121ea7ccf547b3304fed1db2da602a1a53600f0f1304c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

content-encoding: br
etag: 7592710081682814194
age: 46840
x-content-type-options: nosniff
expires: Thu, 23 Jan 2025 16:55:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 16:55:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 147594
x-xss-protection: 0
server: cafe

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20250108/r20190131/ Frame 19AD 0
0 91ms
34ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20250108/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 47304
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4144
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 16:48:09 GMT
etag: 7793694970870604198
expires: Thu, 23 Jan 2025 16:48:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame F1E1 0
0 571ms
528ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1736082806&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&pra=5&wgl=1&aihb=0&aiof=3&asro=0&ailel=1~2~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aiael=1~2~3~4~6~7~8~9~10~11~12~13~14~15~16~17~18~19~20~21~24~29~30~34&aicel=33~38&aifxl=29_18~30_19&aiixl=29_5~30_6&aiict=1&aiapm=0.3221&aiapmi=0.33938&aief=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593188&bpp=3&bdt=182&idt=118&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=4193969496215&frm=20&pv=2&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fsapi=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=139

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 58466
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jan 2025 05:56:33 GMT
expires: Fri, 10 Jan 2025 05:56:33 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/ 178 KB
59 KB 36ms
35ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/reactive_library_fy2021.js?bust=31089618

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

b79aa4d4f529b5c8e977b1f7752bc93869668574f8da2c0fa86528b7817dff99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

content-encoding: br
etag: 4137711651459886975
age: 46714
x-content-type-options: nosniff
expires: Thu, 23 Jan 2025 16:57:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 09 Jan 2025 16:57:59 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 60798
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
39ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=0&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
39ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=1&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
38ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=2&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 50ms
47ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=3&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 42ms
39ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=4&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
40ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=5&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 46ms
44ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2597439482178603&num=6&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 47ms
44ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=3299901363467300&num=0&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 44ms
41ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=3299901363467300&num=1&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 45ms
42ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=3299901363467300&num=2&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 47ms
44ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2928315980077751&num=0&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 44ms
42ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=2928315980077751&num=1&dvc=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 7D27 0
0 556ms
555ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&h=280&adk=3088186576&adf=3175363789&pi=t.aa~a.3911002853~rp.4&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1736082806&rafmt=1&to=qs&pwprc=5555275673&format=1200x280&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593970&bpp=2&bdt=963&idt=-M&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=2&correlator=4193969496215&frm=20&pv=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1338&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=2&uci=a!2&btvi=1&fsb=1&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 404
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jan 2025 05:56:34 GMT
expires: Fri, 10 Jan 2025 05:56:34 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 2CFF 0
0 583ms
583ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&h=280&adk=3088186576&adf=2973209031&pi=t.aa~a.3299938725~rp.4&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1736082806&rafmt=1&to=qs&pwprc=5555275673&format=1200x280&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593970&bpp=1&bdt=963&idt=-M&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=4193969496215&frm=20&pv=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=2080&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=3&uci=a!3&btvi=2&fsb=1&dtd=15

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 408
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jan 2025 05:56:34 GMT
expires: Fri, 10 Jan 2025 05:56:34 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads
googleads.g.doubleclick.net/pagead/ Frame 8586 0
0 372ms
371ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2457458440571846&output=html&h=280&adk=3809598800&adf=54630664&pi=t.aa~a.1182920990~rp.3&w=1200&abgtt=6&fwrn=4&fwrnh=100&lmt=1736082806&rafmt=1&to=qs&pwprc=5555275673&format=1200x280&url=https%3A%2F%2Fimf.qal3a.online%2F2022%2F06%2F2022.html&host=ca-host-pub-1556223355139109&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1736488593970&bpp=1&bdt=964&idt=0&shv=r20250108&mjsv=m202501070101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&prev_fmts=0x0%2C1200x280%2C1200x280&nras=4&correlator=4193969496215&frm=20&pv=1&u_tz=-480&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3003&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250&oid=2&pvsid=278634825985130&tmod=1760994219&uas=0&nvt=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=4&uci=a!4&btvi=3&fsb=1&dtd=19

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 405
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jan 2025 05:56:34 GMT
expires: Fri, 10 Jan 2025 05:56:34 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 40ms
40ms Image
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=3&wpc=ca-pub-2457458440571846&warn=12%2C13&w=1600&h=1200&pp=0&ppp=0&eatf=false&eatfAbg=false&reatf=false&a=6%2C1%2C5%2C7&apv=20250105_093608&sat=1736241734162&afm=0&as_count=0&d_count=0&ng_count=0&am_count=3&atf_count=0&mdns=0&alldns=0.255&allp=9&fd=(0%2C9%2C7)%2C(1%2C0%2C0)%2C(2%2C0%2C0)&pgh=3293&abl=false&rr=n&su=imf.qal3a.online&pvc=278634825985130&r=0.1&eid=31089540%2C95344787%2C95349404%2C31089618%2C31088250

Requested by

Host: imf.qal3a.online
URL: https://imf.qal3a.online/2022/06/2022.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 10 Jan 2025 05:56:34 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 zrt_lookup_fy2021.html
googleads.g.doubleclick.net/pagead/html/r20250108/r20190131/ Frame AA46 0
0 1ms
1ms Document
text/html 172.253.115.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20250108/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

age: 47304
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4144
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 09 Jan 2025 16:48:09 GMT
etag: 7793694970870604198
expires: Thu, 23 Jan 2025 16:48:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 40ms
40ms Fetch
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.63.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f154.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://imf.qal3a.online/

Response headers

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 79ms
46ms XHR
application/json 142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250108&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

be45fe8edbcc0c71b569692578ecf84889aa252d105133b97709b19b8463e66c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13076
date: Fri, 10 Jan 2025 05:56:34 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 img_1716506430580.png
blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvU_VtsfMmR6a5_dNihGM9dhyphenhyphen_TAU99odQNzGSHopfDLpqZ7XMWDfKO_1cpTYU_Q3RSRAx_5n3rs2KhYywsFFX91d5scpWfD8lwlqZHllgh_7_GSL6cZeAX_FWfdX6MuWeHT_qWy... 170 KB
0 0ms
0ms Other
image/png 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

8163c139f394d10a920245789492fd2cc36aeac9e1c1b0690ff10fa3ea0ee148

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
etag: "vb0"
x-content-type-options: nosniff
expires: Sat, 11 Jan 2025 05:56:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174549
date: Fri, 10 Jan 2025 05:56:33 GMT
x-xss-protection: 0
content-type: image/png
vary: Origin
server: fife
content-disposition: inline;filename="img_1716506430580.png"

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
7 KB 97ms
32ms Script
text/javascript 2607:f8b0:4004:c08::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202501070101/show_ads_impl_fy2021.js?bust=31089618

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://imf.qal3a.online/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 10 Jan 2025 05:56:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 10 Jan 2025 05:56:34 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame ECD3 0
0 88ms
30ms Document
text/html 2607:f8b0:4004:c08::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 691
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jan 2025 05:45:03 GMT
expires: Fri, 10 Jan 2025 06:35:03 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 84E9 0
0 108ms
46ms Document
text/html 172.253.63.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f106.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kNDy1QhuUScGauR1LoLHSg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imf.qal3a.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-kNDy1QhuUScGauR1LoLHSg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 10 Jan 2025 05:56:34 GMT
expires: Fri, 10 Jan 2025 05:56:34 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gda_r20250108&jk=278634825985130&bg=!r6ylrOPNAAYsEuUeDBI7ADQBe5WfOI9O0VatAhZNMoxqus2Haj46hHZvdqRVN-VirLesWizGwP2bmgxdlMucwGk50xSPAgAAAEFSAAAABGgBB34ANu1KFJwIH2epu3QS2jPrm1QhV3zo4QVn_QgJW_CbBac2_9rZn_i26Dk-9BkexAK65V5E-iMIHAoAnWJODL1eToLF2dZxYJGhJTVeWmbec7l-QG_gZJFo286dmkGf9Jukt8jL5kZGsfcudn_-sNKrNgfQrp4eFqY3w4N-4B4Jgp5_foZKyDrWn6M7spWOrBWVTeHKHUhyHbfz7VneKBSVEnY8CX7Bq4Rle9azVwlb7AslfL061ovjFIb4GE3MAzA8m79OQbZ0UHPSo8IdwjF8ByFo8cetCqOZApdcJmtJBKBTGO9rU0MH861xAqaL-7gLJnCQwUU2VMea01uM4iBx1CiPUfkCWpYY7YVLqLOdsiNtculvsXKCCK4OPmuRBjok0pbYJGlP6kkaDVb7kxZ-bEa5Ph7KeyBKdyeTvg1AIlfWVMbJPWYlRabmNtte14KeibuftKxvBtQr0byoI6ft_sFR-UqIGoUP79D4ZSKY8RwUE6_xqfJimtUJsKlnIKrKXn-iEX3uddQZDgNCpK6YzP0X18YCrvsvC2qjOtpr7NAYJcteo9RtDET3pvvWz5FL42HLByZO9Vg1HGEPXzkaRRmJqBhku8sHqsMMgM4MY7CgSXqTF1tqhcrFiWCpM6XWLGtN--NqJ3xD2UxLVKYfS51gRbO-fHWo4D7PQBhi9gA-gZ9bQXMCREAfuVcxsIji0kn3sNlZdk60GS_ml2OukfB7Ak8pLHwYqDM-bshAcUEsBAktnDwWGrZ0phgknVDNsRHMv_xoIXDxxbESSbYJyHJyTw0cqIXOZbdSkpx1DgeN1kfKb-DBh-bnrjpySEb-yDRuIlchYpy2xM22_9G-UXWCIGlgM-BOtef_70ibkUOuSuIqsH1ZpuX2Nynk0xu0zYv01JfvZjz2_r88zATsbziUOg50rgglO9lDu5vDFykPaqHwAPCGDSGjtuK69uvvgF_5Y-Y5q_n89AwH-yXX5D1uEt6nO4VJi_xWN8PM1pgBbnxo2AWh8e4LbwgVOjycan3ynH9PV0L-qx8TK1TDcawKSZOfs-Is1mwPVU3NYHVX3lLs9tbSygOSAqLInI-iTPQtVLO38xEV8woLn7XFuTac5KTf3oHNhOMKOrP_NtOp8M3ZtIeCQvkT62BXS1hhlEdca_I4rG7uzIXQjyXExwg

Verdicts & Comments Add Verdict or Comment

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.qal3a.online/	1970-01-21 11:43:04	Name: __gads Value: ID=401d21f155ad3d6e:T=1736488593:RT=1736488593:S=ALNI_MZGrDp_0dcCmuK5wKZCanN3G0ns8w
.qal3a.online/	1970-01-21 11:43:04	Name: __gpi Value: UID=00000fccd80e7501:T=1736488593:RT=1736488593:S=ALNI_MYteojktsS_pzbZzw-agb3MIgOiCw
.qal3a.online/	1970-01-21 06:40:40	Name: __eoi Value: ID=77bbeae3e1181964:T=1736488593:RT=1736488593:S=AA-AfjYUIZIWBofMyvESm2kOfQwZ
.doubleclick.net/	1970-01-21 11:57:28	Name: IDE Value: AHWqTUml6VAizVEa8q2UvwDefphxvgbNSAxg8fA_bqwUzcNACRFhmRmT1fNl7BeNiss

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://i.imgur.com/umdRtdF.gif Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/g4G5Sz2.jpeg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/2Z343cB.jpeg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/hDBSzIL.jpg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/Gk1iXHp.jpeg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/dik62Au.jpg Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://i.imgur.com/WX71CLj.jpeg Message: Failed to load resource: the server responded with a status of 429 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blogger.googleusercontent.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
fonts.gstatic.com
googleads.g.doubleclick.net
i.imgur.com
imf.qal3a.online
od-jsc.pages.dev
pagead2.googlesyndication.com
www.facebook.com
www.google.com
ep1.adtrafficquality.google
142.251.111.155
172.253.115.155
172.253.115.94
172.253.63.106
172.253.63.154
172.66.44.220
199.232.192.193
2607:f8b0:4004:c07::79
2607:f8b0:4004:c08::84
2607:f8b0:4004:c1b::9d
2607:f8b0:4004:c21::84
31.13.66.35
0356394fdda7a541bb9d6dae44554831e22f0aa07de2900297e17f36bbbd419b
0a6b3b2583f0b9ea7da829409bcde3dc1641adb9092100bf2e1415d61cde46d6
0facd387627530907acc0b41d7076a1313a748ba84d37983618c04f2e66f1849
39d8ba5c57b637434d21319acfa9fe2029cc88839cab8a4767b8854c60339921
3a4b9e9018d2c90286121ea7ccf547b3304fed1db2da602a1a53600f0f1304c3
50ff52e0b7c92330ec9b5cb0b1431540aadbbb22f02829d0411a28faa4d5db61
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
5ec73cf4d42170b4a8d173b35f0f1b9e2c73a5959fd4c905d0836a6a0612dcd8
7b7cc49ed4945a43ca361ca9e327cd907f5520cec87858b820e02a6db6d55779
8163c139f394d10a920245789492fd2cc36aeac9e1c1b0690ff10fa3ea0ee148
81d62c74016d8779cb91019934882095ad606798f3f32327fa4dadf9d023a4d5
842be935d39dcb195e58cafdaf280ac1088b22e48538b4946fe4fb18e9852706
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
b79aa4d4f529b5c8e977b1f7752bc93869668574f8da2c0fa86528b7817dff99
be45fe8edbcc0c71b569692578ecf84889aa252d105133b97709b19b8463e66c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb96925efcfbe2cf5dbb2a75fc3e8de5aa0afa4787b78d34f45113c1ef96cb8c
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

imf.qal3a.online Open in urlscan Pro 2607:f8b0:4004:c07::79 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

48 Requests

98 %HTTPS

33 %IPv6

10 Domains

11 Subdomains

13 IPs

1 Countries

584 kBTransfer

1378 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

48 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

imf.qal3a.online Open in urlscan Pro
2607:f8b0:4004:c07::79 Public Scan

Screenshot
Live screenshot

Full Image

48
Requests

98 %
HTTPS

33 %
IPv6

10
Domains

11
Subdomains

13
IPs

1
Countries

584 kB
Transfer

1378 kB
Size

4
Cookies

48 HTTP transactions
0 data transactions