urlz.fr Open in urlscan Pro
2606:4700:3038::6815:ead6 Malicious Activity! Public Scan

URL:
https://urlz.fr/g0QA
Submission: On June 28 via manual (June 28th 2021, 5:22:17 pm UTC) from HK

Summary HTTP 75 Redirects Behaviour Indicators

Summary

This website contacted 29 IPs in 6 countries across 35 domains to perform 75 HTTP transactions. The main IP is 2606:4700:3038::6815:ead6, located in United States and belongs to CLOUDFLARENET, US. The main domain is urlz.fr.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 12th 2020. Valid for: a year.

This is the only time urlz.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700:303... 2606:4700:3038::6815:ead6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:a823	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	47.254.94.70 47.254.94.70	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co.)
3	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
8	151.139.241.23 151.139.241.23	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
2	20.190.160.2 20.190.160.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
16	152.199.23.37 152.199.23.37	15133 (EDGECAST) (EDGECAST)
2	145.239.131.55 145.239.131.55	16276 (OVH) (OVH)
2	144.76.69.233 144.76.69.233	24940 (HETZNER-AS) (HETZNER-AS)
2	2a02:26f0:6c0... 2a02:26f0:6c00:292::30ec	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:9000:210... 2600:9000:2104:1e00:9:46dc:4700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	145.239.193.145 145.239.193.145	16276 (OVH) (OVH)
1 1	185.86.137.32 185.86.137.32	201081 (SMARTADSE...) (SMARTADSERVER)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba28	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
3	54.38.64.100 54.38.64.100	16276 (OVH) (OVH)
1	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	145.239.193.51 145.239.193.51	16276 (OVH) (OVH)
1	51.38.120.206 51.38.120.206	16276 (OVH) (OVH)
8	2606:4700:10:... 2606:4700:10::ac43:db6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1	52.210.129.48 52.210.129.48	16509 (AMAZON-02) (AMAZON-02)
1	65.9.84.187 65.9.84.187	16509 (AMAZON-02) (AMAZON-02)
1	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:210... 2600:9000:2104:9800:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2 2	37.252.173.38 37.252.173.38	29990 (ASN-APPNEX) (ASN-APPNEX)
2 3	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
2 2	52.17.54.18 52.17.54.18	16509 (AMAZON-02) (AMAZON-02)
1 1	35.176.232.241 35.176.232.241	16509 (AMAZON-02) (AMAZON-02)
1 1	184.30.20.207 184.30.20.207	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	54.246.114.109 54.246.114.109	16509 (AMAZON-02) (AMAZON-02)
75	29

1 2606:4700:3038::6815:ead6 (United States)

ASN13335 (CLOUDFLARENET, US)

urlz.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 47.254.94.70 (United States)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN)

u0zxzrlmymmucrzzoq6wgw-on.drv.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
drv.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.139.241.23 (United States)

ASN33438 (HIGHWINDS2, US)

ads.themoneytizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.190.160.2 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 152.199.23.37 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 145.239.131.55 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 144.76.69.233 (Germany)

ASN24940 (HETZNER-AS, DE)

srv-file8.gofile.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:292::30ec (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

image.flaticon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2104:1e00:9:46dc:4700:93a1 (United States)

ASN16509 (AMAZON-02, US)

quantcast.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.239.193.145 (France)

ASN16276 (OVH, FR)

g.themoneytizer.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.32 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

ww1097.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba28 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ced-ns.sascdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.38.64.100 (France)

ASN16276 (OVH, FR)

c.tmyzer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::1c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.239.193.51 (France)

ASN16276 (OVH, FR)

tag.leadplace.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.38.120.206 (France)

ASN16276 (OVH, FR)
PTR: ip206.ip-51-38-120.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:10::ac43:db6 (United States)

ASN13335 (CLOUDFLARENET, US)

spl.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mwzeom.zeotap.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:f916:5049:f87f:108e (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.129.48 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

p.cpx.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.84.187 (United States)

ASN16509 (AMAZON-02, US)

d2zur9cc2gf1tx.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.21 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2104:9800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.173.38 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 76.223.111.131 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.54.18 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.176.232.241 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.20.207 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-207.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.246.114.109 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

adtrack.adleadevent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	msftauth.net aadcdn.msftauth.net	385 KB
8	zeotap.com spl.zeotap.com mwzeom.zeotap.com	3 KB
8	themoneytizer.com ads.themoneytizer.com	236 KB
4	google-analytics.com www.google-analytics.com	58 KB
4	drv.tw u0zxzrlmymmucrzzoq6wgw-on.drv.tw drv.tw	48 KB
3	adsrvr.org 2 redirects match.adsrvr.org	2 KB
3	tmyzer.com c.tmyzer.com	813 B
3	googletagmanager.com www.googletagmanager.com	107 KB
2	demdex.net 2 redirects dpm.demdex.net	2 KB
2	adnxs.com 2 redirects ib.adnxs.com	2 KB
2	consensu.org quantcast.mgr.consensu.org	74 KB
2	flaticon.com image.flaticon.com	1 KB
2	gofile.io srv-file8.gofile.io	208 B
2	ibb.co i.ibb.co	3 KB
2	live.com login.live.com
2	jquery.com code.jquery.com	59 KB
1	adleadevent.com adtrack.adleadevent.com	518 B
1	googleapis.com ajax.googleapis.com	30 KB
1	mathtag.com 1 redirects pixel.mathtag.com	709 B
1	agkn.com 1 redirects aa.agkn.com	382 B
1	quantcount.com rules.quantcount.com	1 KB
1	indexww.com js-sec.indexww.com	13 KB
1	cloudfront.net d2zur9cc2gf1tx.cloudfront.net	26 KB
1	cpx.to p.cpx.to	3 KB
1	quantserve.com secure.quantserve.com	9 KB
1	onetag-sys.com onetag-sys.com	818 B
1	leadplace.fr tag.leadplace.fr	4 KB
1	criteo.com gum.criteo.com	362 B
1	sascdn.com ced-ns.sascdn.com	11 KB
1	smartadserver.com 1 redirects ww1097.smartadserver.com	132 B
1	themoneytizer.net g.themoneytizer.net	270 B
1	cloudflare.com ajax.cloudflare.com	5 KB
1	urlz.fr urlz.fr	2 KB
0	rlcdn.com Failed api.rlcdn.com Failed
0	doubleclick.net Failed cm.g.doubleclick.net Failed
75	35

	Domain	Requested by
16	aadcdn.msftauth.net	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
8	ads.themoneytizer.com	ajax.cloudflare.com ads.themoneytizer.com
5	mwzeom.zeotap.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	match.adsrvr.org	2 redirects js-sec.indexww.com
3	spl.zeotap.com	ads.themoneytizer.com spl.zeotap.com
3	c.tmyzer.com	ads.themoneytizer.com
3	www.googletagmanager.com	ajax.cloudflare.com drv.tw
2	dpm.demdex.net	2 redirects
2	ib.adnxs.com	2 redirects
2	quantcast.mgr.consensu.org	urlz.fr quantcast.mgr.consensu.org
2	image.flaticon.com	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
2	srv-file8.gofile.io	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
2	i.ibb.co	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
2	login.live.com	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
2	drv.tw	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
2	code.jquery.com	u0zxzrlmymmucrzzoq6wgw-on.drv.tw
2	u0zxzrlmymmucrzzoq6wgw-on.drv.tw	urlz.fr
1	adtrack.adleadevent.com	ajax.googleapis.com
1	ajax.googleapis.com	d2zur9cc2gf1tx.cloudfront.net
1	pixel.mathtag.com	1 redirects
1	aa.agkn.com	1 redirects
1	rules.quantcount.com	secure.quantserve.com
1	js-sec.indexww.com	ads.themoneytizer.com
1	d2zur9cc2gf1tx.cloudfront.net	ads.themoneytizer.com
1	p.cpx.to	ads.themoneytizer.com
1	secure.quantserve.com	ads.themoneytizer.com
1	onetag-sys.com	ads.themoneytizer.com
1	tag.leadplace.fr	ads.themoneytizer.com
1	gum.criteo.com	ads.themoneytizer.com
1	ced-ns.sascdn.com
1	ww1097.smartadserver.com	1 redirects
1	g.themoneytizer.net	ads.themoneytizer.com
1	ajax.cloudflare.com	urlz.fr
1	urlz.fr
0	api.rlcdn.com Failed	js-sec.indexww.com
0	cm.g.doubleclick.net Failed	spl.zeotap.com
75	37

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-12` - `2021-08-12`	a year	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh
*.drv.tw R3	`2021-04-16` - `2021-07-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-05-31` - `2021-08-23`	3 months	crt.sh
*.themoneytizer.com GoGetSSL RSA DV CA	`2021-02-14` - `2022-03-17`	a year	crt.sh
jquery.org Sectigo RSA Domain Validation Secure Server CA	`2020-10-06` - `2021-10-16`	a year	crt.sh
graph.windows.net DigiCert SHA2 Secure Server CA	`2021-06-08` - `2022-06-08`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2021-05-13` - `2022-05-13`	a year	crt.sh
ibb.co R3	`2021-06-07` - `2021-09-05`	3 months	crt.sh
srv-file8.gofile.io R3	`2021-06-16` - `2021-09-14`	3 months	crt.sh
thumbr.io Sectigo RSA Domain Validation Secure Server CA	`2020-06-05` - `2022-08-04`	2 years	crt.sh
quantcast.mgr.consensu.org Amazon	`2021-04-24` - `2022-05-23`	a year	crt.sh
g.themoneytizer.net GoGetSSL RSA DV CA	`2019-10-16` - `2022-01-17`	2 years	crt.sh
*.sascdn.com DigiCert Secure Site ECC CA-1	`2020-10-14` - `2021-11-11`	a year	crt.sh
c.tmyzer.com R3	`2021-06-04` - `2021-09-02`	3 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-06-27` - `2021-09-24`	3 months	crt.sh
*.leadplace.fr Gandi Standard SSL CA 2	`2020-09-11` - `2021-09-12`	a year	crt.sh
onetag-sys.com R3	`2021-05-02` - `2021-07-31`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
p.cpx.to Sectigo RSA Domain Validation Secure Server CA	`2021-02-02` - `2022-02-02`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-05-31` - `2021-08-23`	3 months	crt.sh
adtrack.adleadevent.com Amazon	`2021-05-17` - `2022-06-15`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://urlz.fr/g0QA
Frame ID: 2DB1305D2B25DA790625088A1FF78CEB
Requests: 31 HTTP requests in this frame

Frame: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Frame ID: 2FA1B7F49A28B2BBC14ED53716794313
Requests: 17 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1624900918511
Frame ID: 5BF6E7B3188B593214363D59596391F3
Requests: 1 HTTP requests in this frame

Frame: https://spl.zeotap.com/cmp?env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258&cmp=0
Frame ID: 87BCFF5790329510140EBA5739E7A18E
Requests: 9 HTTP requests in this frame

Frame: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Frame ID: 1E3FE7C79A1A9141B54E37D2F4E05868
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /\/prebid\.js/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /\.quantserve\.com\/quant\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

75
Requests

97 %
HTTPS

39 %
IPv6

35
Domains

37
Subdomains

29
IPs

6
Countries

1080 kB
Transfer

3275 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://ww1097.smartadserver.com/config.js?nwid=1097 HTTP 302
https://ced-ns.sascdn.com/diff/js/smart.js

Request Chain 46

https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fadnxs_uid%3D%24UID%26zpartnerid%3D2%26env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d14d8e4c%26uc%3D2%26zdid%3D1258 HTTP 302
https://mwzeom.zeotap.com/mw?adnxs_uid=8975679616967768126&zpartnerid=2&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258

Request Chain 48

https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d14d8e4c%26uc%3D2%26zdid%3D1258 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d14d8e4c%26uc%3D2%26zdid%3D1258 HTTP 302
https://mwzeom.zeotap.com/mw?cid=50c228e3-f97f-4abb-8cce-457b18c6d5d9&zpartnerid=6&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258

Request Chain 49

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=043752c2-40f9-4266-5fb0-918cb00c6234&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d14d8e4c%26uc%3D2%26zdid%3D1258 HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=043752c2-40f9-4266-5fb0-918cb00c6234&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d14d8e4c%26uc%3D2%26zdid%3D1258 HTTP 302
https://mwzeom.zeotap.com/mw?cid=18646538367459849653214569977138055572&zpartnerid=314&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258

Request Chain 50

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=DEU&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258 HTTP 302
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1258&cid=CQHsF8TP0DrNx%2BXxbeEswYrbYN%2FgQpr1%2BS41iYitP1U%3D

Request Chain 51

https://pixel.mathtag.com/sync/img?mt_exid=10092&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%5BMM_UUID%5D%26env%3DmWeb%26zpartnerid%3D979%26env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d14d8e4c%26uc%3D2%26zdid%3D1258 HTTP 302
https://mwzeom.zeotap.com/mw?cid=082860da-0536-4a00-b21e-d67ef5732f73&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258

75 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request g0QA Show response
urlz.fr/ 9 KB
2 KB 94ms
68ms Document
text/html 2606:4700:3038::6815:ead6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://urlz.fr/g0QA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:ead6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c939cfbe32d5cbea4ee0557538c2f2ca8f86dc9ce94db41849b2aa7b7a70b90d

Request headers

:method: GET
:authority: urlz.fr
:scheme: https
:path: /g0QA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-type: text/html; charset=UTF-8
cf-cache-status: DYNAMIC
cf-request-id: 0af53d687100004e4f433fd000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=DeGPnziCiA7NgfmeQFAiYK66N8nl7VtE3WSM%2BcnsQq%2FmpWKEMvvIf2LmS%2F%2F1oMxR%2BtsomA%2BUjf4KB%2FCj1HE8uvuUFOFAYS7u5e7%2FZIO92tkAsxAgDi5aR4sfUtcH3XSg7A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 66689820be8e4e4f-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
5 KB 29ms
13ms Script
application/javascript 2606:4700::6810:a823
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: urlz.fr
URL: https://urlz.fr/g0QA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-request-id: 0af53d68c90000074294825000000001
last-modified: Tue, 22 Jun 2021 16:56:35 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"60d21643-302c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=fgIxM2aiTqc1MSLumaejuewzUNlVFWveTcDUwUXrE6bKFjCuDtDFA2GWcAbvpxrZT0kpjWEQ2Rug88gCIprkD1E0s%2B1%2FGITqtOf92gFE95aCNpbvx4SrSd5P89UpFLVTYnD4V821Yt1W92Cs"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 666898214d410742-FRA
expires: Wed, 30 Jun 2021 17:21:55 GMT

GET
H2 200 / Show response
u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/ Frame 2FA1 66 KB
23 KB 2372ms
1950ms Document
text/html 47.254.94.70
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Requested by: Host: urlz.fr
URL: https://urlz.fr/g0QA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 47.254.94.70 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: dc3e1adfd5d48138ad58323a6ce07f03b055b28a5dab8d99b3448a186c7fd3c1

Request headers

:method: GET
:authority: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
:scheme: https
:path: /www.office.com/voicemail/?id=7809790285
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://urlz.fr/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://urlz.fr/

Response headers

server: nginx/1.14.0 (Ubuntu)
date: Mon, 28 Jun 2021 17:21:57 GMT
content-type: text/html
last-modified: Wed, 23 Jun 2021 06:46:03 GMT
cache-control: public, max-age=604800
vary: Accept-Encoding
content-encoding: gzip
x-cache: BYPASS
set-cookie: uid=rBEPrmDaBTU5EgHgq8F9Ag==; domain=.drv.tw; path=/

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 18ms
16ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-162669458-1

Requested by

Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

10a3ee9567f82c11c5e21d3fe55b2ea27a40aee503fb767f0c46981e6839d9fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36350
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 16:32:22 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Jun 2021 17:21:55 GMT

GET
H2 200 requestform.js Show response
ads.themoneytizer.com/s/ 89 KB
14 KB 247ms
115ms Script
text/html 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=6
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: c9d7d2103a91192f3ae8664f18f698d85da9a86564b546afba4a7782f0ad4461

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=86400
accept-ranges: bytes
expires: Tue, 29 Jun 2021 17:21:55 GMT

GET
H2 200 gen.js Show response
ads.themoneytizer.com/s/ 4 KB
2 KB 183ms
52ms Script
text/html 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/s/gen.js?type=6
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: b780c05b9b8e1f7acff640ef794ca777ffa43e5d4354a84eebf3dd98975f8675

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=86400
accept-ranges: bytes
content-length: 2127
expires: Tue, 29 Jun 2021 17:21:52 GMT

GET
H2 200 requestform.js Show response
ads.themoneytizer.com/s/ 93 KB
15 KB 216ms
85ms Script
text/html 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=28
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 02b9c635a0e3e4d665dba94b1f6c527cd20a108b53e15a98816e2d6325a020b0

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=86400
accept-ranges: bytes
expires: Tue, 29 Jun 2021 17:21:55 GMT

GET
H2 200 gen.js Show response
ads.themoneytizer.com/s/ 4 KB
2 KB 182ms
51ms Script
text/html 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/s/gen.js?type=28
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: b780c05b9b8e1f7acff640ef794ca777ffa43e5d4354a84eebf3dd98975f8675

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=86400
accept-ranges: bytes
content-length: 2127
expires: Tue, 29 Jun 2021 17:20:57 GMT

GET
H2 200 requestform.js Show response
ads.themoneytizer.com/s/ 93 KB
15 KB 229ms
98ms Script
text/html 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 15df4a35e492edfaf097578a79ce32acc5d3beff000bac2b850c624fa441f208

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=86400
accept-ranges: bytes
content-length: 14991
expires: Tue, 29 Jun 2021 17:21:55 GMT

GET
H2 200 gen.js Show response
ads.themoneytizer.com/s/ 4 KB
2 KB 231ms
101ms Script
text/html 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/s/gen.js?type=1
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: b780c05b9b8e1f7acff640ef794ca777ffa43e5d4354a84eebf3dd98975f8675

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:55 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
x-cache: HIT
content-type: text/html; charset=UTF-8
cache-control: max-age=86400
accept-ranges: bytes
content-length: 2127
expires: Tue, 29 Jun 2021 17:21:33 GMT

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ Frame 2FA1 85 KB
30 KB 26ms
8ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:57 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2016 22:32:34 GMT
server: nginx
etag: W/"57e45c02-152b5"
vary: Accept-Encoding
x-hw: 1624900917.dop204.fr8.t,1624900917.cds208.fr8.hn,1624900917.cds012.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30070

GET
H2 200 wd.js Show response
drv.tw/inc/ Frame 2FA1 365 B
643 B 218ms
217ms Script
application/javascript 47.254.94.70
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://drv.tw/inc/wd.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 47.254.94.70 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
last-modified: Mon, 28 Dec 2020 05:44:07 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5fe970a7-16d"
x-cache: BYPASS
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 365
expires: Tue, 29 Jun 2021 17:21:58 GMT

GET
H/1.1 200
OK Me.htm
login.live.com/ Frame 2FA1 0
0 526ms
254ms Other
text/html 20.190.160.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com/Me.htm?v=3
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.190.160.2 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 2FA1 105 KB
19 KB 361ms
98ms Stylesheet
text/css 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/371C) /
Resource Hash: 1b31b0ffabf72e2545aaad397417ba58f66eb3d57a232e115085136a497ffb34

Request headers

Origin: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw
Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: 77s7HX/qO+HbHX0PjIhH1A==
age: 11779750
x-cache: HIT
content-length: 19615
x-ms-lease-status: unlocked
last-modified: Thu, 11 Feb 2021 19:27:28 GMT
server: ECAcc (lhd/371C)
etag: 0x8D8CEC311CB1846
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 8a081d76-e01e-0094-231f-017244000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/ Frame 2FA1 429 KB
118 KB 405ms
142ms Script
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35A4) /
Resource Hash: f4eef033057a448d28c81d25b7a2e43f42ecaf1843858f7245bc297f48c82301

Request headers

Origin: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw
Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: uAGaLmkt+ggMrMyfGdkQsg==
age: 11862435
x-cache: HIT
content-length: 120144
x-ms-lease-status: unlocked
last-modified: Wed, 10 Feb 2021 18:32:32 GMT
server: ECAcc (lhd/35A4)
etag: 0x8D8CDF23AD98758
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 2d6bc0b6-501e-0046-6d5e-00c4e6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js Show response
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 2FA1 41 KB
13 KB 348ms
85ms Script
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35B8) /
Resource Hash: 77488a70db590ed9cf98036f9ea317d6822398aeb5ceb6ea3a99021522d2cdcd

Request headers

Origin: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw
Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: WO4uW/y42E/4n+nHz177Gg==
age: 12049924
x-cache: HIT
content-length: 12395
x-ms-lease-status: unlocked
last-modified: Mon, 08 Feb 2021 18:58:52 GMT
server: ECAcc (lhd/35B8)
etag: 0x8D8CC6393EED0A3
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 279d5a62-201e-0038-1caa-fe38d3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ Frame 2FA1 4 KB
2 KB 348ms
85ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/3599) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 572174
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:22 GMT
server: ECAcc (lhd/3599)
etag: 0x8D64101507E84BD
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: bb293f62-501e-0005-300d-67cb24000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker-account.png
i.ibb.co/jg6w34B/ Frame 2FA1 1 KB
1 KB 336ms
144ms Image
image/png 145.239.131.55
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/jg6w34B/picker-account.png
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.239.131.55 , France, ASN16276 (OVH, FR),
Reverse DNS: i.ibb.co
Software: nginx /
Resource Hash: a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
last-modified: Sat, 18 Jan 2020 16:32:59 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1082
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 400 picker_more.png
srv-file8.gofile.io/download/NAGerp/ Frame 2FA1 0
167 B 414ms
97ms Image
text/plain 144.76.69.233
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://srv-file8.gofile.io/download/NAGerp/picker_more.png

Requested by

Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

144.76.69.233 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

/ Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
x-content-type-options: nosniff
x-powered-by: Express
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
aadcdn.msftauth.net/shared/1.0/content/images/ Frame 2FA1 2 KB
915 B 349ms
86ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35ED) /
Resource Hash: a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: 6dTbAT1RVL9d6geobv3IJg==
age: 17249888
x-cache: HIT
content-length: 606
x-ms-lease-status: unlocked
last-modified: Thu, 16 Jan 2020 00:32:49 GMT
server: ECAcc (lhd/35ED)
etag: 0x8D79A1B9DB4199D
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 37c6068e-a01e-003b-2d5f-cfcbb3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 109618.svg
image.flaticon.com/icons/svg/109/ Frame 2FA1 888 B
734 B 32ms
7ms Image
image/svg+xml 2a02:26f0:6c00:292::30ec
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://image.flaticon.com/icons/svg/109/109618.svg

Requested by

Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:292::30ec Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

4d4e0d586734853b1ee051168c1a202f3a88de8ff08d2f9d64c6bb113d2d4553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Tue, 07 Jun 2016 09:04:17 GMT
server: nginx
etag: "57568e11-378"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=285182
date: Mon, 28 Jun 2021 17:21:57 GMT
x-default-rule: YES
accept-ranges: bytes
content-length: 445
expires: Fri, 02 Jul 2021 00:34:59 GMT

GET
H2 200 converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 2FA1 0
19 KB 85ms
84ms Other
text/css 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/371C) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: 77s7HX/qO+HbHX0PjIhH1A==
age: 11779750
x-cache: HIT
content-length: 19615
x-ms-lease-status: unlocked
last-modified: Thu, 11 Feb 2021 19:27:28 GMT
server: ECAcc (lhd/371C)
etag: 0x8D8CEC311CB1846
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 8a081d76-e01e-0094-231f-017244000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 2FA1 0
12 KB 72ms
72ms Other
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35B8) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
content-md5: WO4uW/y42E/4n+nHz177Gg==
age: 12049924
x-cache: HIT
content-length: 12395
x-ms-lease-status: unlocked
last-modified: Mon, 08 Feb 2021 18:58:52 GMT
server: ECAcc (lhd/35B8)
etag: 0x8D8CC6393EED0A3
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 279d5a62-201e-0038-1caa-fe38d3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
DATA 200
OK truncated
/ Frame 2FA1 222 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3-29 200 js Show response
www.googletagmanager.com/gtag/ Frame 2FA1 90 KB
36 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-85417367-1

Requested by

Host: drv.tw
URL: https://drv.tw/inc/wd.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

44f1de4e3e7e780f13e8cac2ae97ddd2bb7f962b8813c54dcb1fc98acfdd26b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36325
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 16:32:22 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Jun 2021 17:21:58 GMT

GET
H2 200 choice.js Show response
quantcast.mgr.consensu.org/choice/6Fv0cGNfc_bw8/www.themoneytizer.com/ 3 KB
2 KB 56ms
18ms Script
application/javascript 2600:9000:2104:1e00:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/choice/6Fv0cGNfc_bw8/www.themoneytizer.com/choice.js
Requested by: Host: urlz.fr
URL: https://urlz.fr/g0QA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:1e00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9358f222ba40b683e83f1705f68d251bf6002d597f38707e59abef418d6dfc37

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 28 Jun 2021 17:21:33 GMT
content-encoding: br
last-modified: Tue, 22 Dec 2020 18:58:46 GMT
server: AmazonS3
age: 28
etag: W/"ba5d12764ba6d8c6ecc9135d06608e70"
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 cc03ea6a31b592e93e84115778cdc495.cloudfront.net (CloudFront)
cache-control: max-age=900
cross-origin-resource-policy: cross-origin
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: 9lUUWyHJjyGy0gBIa51V2Y5cTOHgEsaA2cMpsaZha5q7p9ox7z940g==

GET
H/1.1 200
OK / Show response
g.themoneytizer.net/g/ 26 B
270 B 343ms
111ms Script
text/html 145.239.193.145
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://g.themoneytizer.net/g/
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/gen.js?type=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 145.239.193.145 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx /
Resource Hash: f2af6a03599a30f21216920acbab05ce2903a5f62b4a6b4f9b0a2b234004e53e

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 17:21:58 GMT
Server: nginx
X-IPLB-Request-ID: C2636963:CB22_91EFC191:01BB_60DA0536_AE825A:27AE6
X-IPLB-Instance: 29820
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 moneybile.js Show response
ads.themoneytizer.com/ 38 KB
16 KB 83ms
82ms Script
application/javascript 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/moneybile.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/gen.js?type=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 4006e0481f9cfffd3a579c3dcbdad1b6953e844c1e3c76a8d9f86844c98d87a3

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
last-modified: Fri, 12 Mar 2021 17:07:19 GMT
server: nginx
etag: "604b9fc7-981e"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 16267
expires: Tue, 29 Jun 2021 17:21:11 GMT

GET
H/1.1

200
OK

smart.js Show response
ced-ns.sascdn.com/diff/js/
Redirect Chain

https://ww1097.smartadserver.com/config.js?nwid=1097
https://ced-ns.sascdn.com/diff/js/smart.js

35 KB
11 KB

36ms
22ms

Script
application/x-javascript

2a02:26f0:6c00::210:ba28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ced-ns.sascdn.com/diff/js/smart.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba28 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 1967a54ac0a585a7b888a93e6cfc624f5623b0e94a9a301a8f671d63a06f8d94

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 17:21:58 GMT
Content-Encoding: gzip
Last-Modified: Thu, 17 Jun 2021 14:01:29 GMT
Server: AkamaiNetStorage
ETag: "b4d028ec3146b48fd67b6682c7b63880:1623938492.975877"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11155

Redirect headers

location: https://ced-ns.sascdn.com/diff/js/smart.js
date: Mon, 28 Jun 2021 17:21:57 GMT
content-length: 0

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 2FA1 48 KB
19 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 6110
date: Mon, 28 Jun 2021 15:40:08 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Mon, 28 Jun 2021 17:40:08 GMT

GET
H/1.1 200
OK / Show response
c.tmyzer.com/c/ 0
271 B 418ms
149ms XHR
text/html 54.38.64.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tmyzer.com/c/?s=15056&f=1&fi=99
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.38.64.100 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 28 Jun 2021 17:21:58 GMT
Server: nginx
X-IPLB-Request-ID: C2636963:B572_36264064:01BB_60DA0536_225F243:29B19
X-IPLB-Instance: 20686
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 sync Show response
gum.criteo.com/ 49 B
362 B 68ms
22ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=147&r=2&j=criteoCallback

Requested by

Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

005c3133bf387e1b00a5ec25effc468f7752591adac19a3782d200bf68a970f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
date: Mon, 28 Jun 2021 17:21:58 GMT
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1713
content-length: 165
expires: 60

GET
H/1.1 200
OK libJsLP.js Show response
tag.leadplace.fr/ 4 KB
4 KB 321ms
74ms Script
application/javascript 145.239.193.51
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.leadplace.fr/libJsLP.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 145.239.193.51 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx/1.14.2 /
Resource Hash: 8da935c18168ab5561137d875449b7b5b4e38ec854c5f3d2296823cf0b93a3f9

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 17:21:58 GMT
Last-Modified: Mon, 31 May 2021 09:07:48 GMT
Server: nginx/1.14.2
X-IPLB-Request-ID: C2636963:3C94_91EFC133:01BB_60DA0536_560A6DD:152D
ETag: "60b4a764-10b7"
X-IPLB-Instance: 29922
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 4279

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 5BF6 2 KB
818 B 224ms
74ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=2a897e3f18e6769&cb=1624900918511

Requested by

Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

:method: GET
:authority: onetag-sys.com
:scheme: https
:path: /usync/?pubId=2a897e3f18e6769&cb=1624900918511
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://urlz.fr/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://urlz.fr/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
strict-transport-security: max-age=15552000

GET
H2 200 / Show response
spl.zeotap.com/ Frame 87BC 2 KB
1 KB 80ms
62ms Document
text/html 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/?env=mWeb&uc=2&zdid=1258&eventType=map
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a4b1b5cf62c7b75bfd7faab36c916eb6858c968a347f656c91396ac2e50050b

Request headers

:method: GET
:authority: spl.zeotap.com
:scheme: https
:path: /?env=mWeb&uc=2&zdid=1258&eventType=map
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://urlz.fr/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://urlz.fr/

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
content-type: text/html
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://urlz.fr
set-cookie: zc=043752c2-40f9-4266-5fb0-918cb00c6234; Path=/; Domain=.zeotap.com; Max-Age=31536000; SameSite=None; Secure zsc=%7C%FEi%13%17%06%23%27%10%82%10%AE%AD%40T%E7%7B%F7%99%8C%86s%DD%B4%26%E5%99OJ%C6%1CB%96%FD%B1%8E%FAyj%1F%98%3F%F6%0F%0E%EE%92%01%D8%A6Ld%A3%93%99%C5%16%EA%CD%B5%D5%E6%FC%0D%0B%FFSz%ED%0D%EA%7B%AD2%F2%FDh_%A5%8F%8A%C6%AD%0C%92i%1E%5Cq%89k%28%9FC%C6%86%CD%12%14%8E%3Bl%09%9F%23; Path=/; Domain=.zeotap.com; Max-Age=86400; SameSite=None; Secure
vary: Origin
via: 1.1 google
cf-cache-status: DYNAMIC
cf-request-id: 0af53d750400004e8cdbbf6000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 66689834db2e4e8c-FRA
content-encoding: br

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 29ms
9ms Script
application/javascript 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Mon, 05 Jul 2021 17:21:58 GMT

GET
H/1.1 200
OK px.js Show response
p.cpx.to/p/12773/ 3 KB
3 KB 357ms
84ms Script
application/javascript 52.210.129.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.cpx.to/p/12773/px.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.129.48 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: d59dad5bf9bca39dfb380810d40113b65d904f3734e9db845901bcb6189a618b

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 17:21:58 GMT
Cache-Control: max-age=2419200, public
Connection: keep-alive
Content-Length: 3015
Content-Type: application/javascript; charset=UTF-8

GET
H/1.1 200
OK notifyme.js Show response
d2zur9cc2gf1tx.cloudfront.net/a96081b6-db78-48c4-9f82-b93e316fb1f7/ 25 KB
26 KB 199ms
70ms Script
text/javascript 65.9.84.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2zur9cc2gf1tx.cloudfront.net/a96081b6-db78-48c4-9f82-b93e316fb1f7/notifyme.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.84.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: b47b4ca26c57e3dceebd7abd067df9622599bed6bfb11b480f92d09a945cd213

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 27 Jun 2021 19:39:11 GMT
Via: 1.1 fb8f21b90b0483bdc64e7c79b3e007e0.cloudfront.net (CloudFront)
Last-Modified: Mon, 18 Feb 2019 16:54:28 GMT
Server: Apache
Age: 78167
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
X-Amz-Cf-Pop: AMS1-C1
Accept-Ranges: bytes
Content-Length: 25704
X-Amz-Cf-Id: vdoJydPsFNwABy74xsO3cbuQ-_UFMEsW5wpcCwqp_t1AbxIrkU7sag==

GET
H/1.1 200
OK 186329-261067657875242.js Show response
js-sec.indexww.com/ht/p/ 37 KB
13 KB 827ms
691ms Script
text/javascript 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/186329-261067657875242.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7e176e51c1dff07522d527754e78745b4fe73db4b875ab85be5ec57e2e35346c

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 28 Jun 2021 17:21:59 GMT
Content-Encoding: gzip
Last-Modified: Mon, 28 Jun 2021 17:21:10 GMT
Server: Apache
ETag: "7621ba-930b-5c5d6b72d11d7"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3582
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 12788
Expires: Mon, 28 Jun 2021 18:21:41 GMT

GET
H2 200 prebid.js Show response
ads.themoneytizer.com/moneybid4_40/build_quantcast/dist/ 541 KB
169 KB 81ms
80ms Script
application/javascript 151.139.241.23
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.themoneytizer.com/moneybid4_40/build_quantcast/dist/prebid.js
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.241.23 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 92cbdf981e972713803322bc00a0e26ad84949715baaaf07149cfae4d9949d78

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
date: Mon, 28 Jun 2021 17:21:58 GMT
content-encoding: gzip
last-modified: Mon, 31 May 2021 09:40:23 GMT
server: nginx
etag: "60b4af07-87529"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 172361
expires: Tue, 29 Jun 2021 17:21:15 GMT

GET
H/1.1 200
OK / Show response
c.tmyzer.com/c/ 0
271 B 386ms
111ms XHR
text/html 54.38.64.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tmyzer.com/c/?s=15056&f=28&fi=99
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=28
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.38.64.100 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 28 Jun 2021 17:21:58 GMT
Server: nginx
X-IPLB-Request-ID: C2636963:B56A_36264064:01BB_60DA0536_22728B9:1A003
X-IPLB-Instance: 38432
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK / Show response
c.tmyzer.com/c/ 0
271 B 830ms
551ms XHR
text/html 54.38.64.100
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tmyzer.com/c/?s=15056&f=6&fi=99
Requested by: Host: ads.themoneytizer.com
URL: https://ads.themoneytizer.com/s/requestform.js?siteId=15056&formatId=6
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.38.64.100 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Mon, 28 Jun 2021 17:21:59 GMT
Server: nginx
X-IPLB-Request-ID: C2636963:B578_36264064:01BB_60DA0536_2267C15:2EE37
X-IPLB-Instance: 38439
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 / Show response
u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/ Frame 1E3F 66 KB
23 KB 1685ms
1684ms Document
text/html 47.254.94.70
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Requested by: Host: urlz.fr
URL: https://urlz.fr/g0QA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 47.254.94.70 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: dc3e1adfd5d48138ad58323a6ce07f03b055b28a5dab8d99b3448a186c7fd3c1

Request headers

:method: GET
:authority: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
:scheme: https
:path: /www.office.com/voicemail/?id=7809790285
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://urlz.fr/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://urlz.fr/

Response headers

server: nginx/1.14.0 (Ubuntu)
date: Mon, 28 Jun 2021 17:22:00 GMT
content-type: text/html
last-modified: Wed, 23 Jun 2021 06:46:03 GMT
cache-control: public, max-age=604800
vary: Accept-Encoding
content-encoding: gzip
x-cache: BYPASS
set-cookie: uid=rBEPrmDaBTg5EgHgq8GMAg==; domain=.drv.tw; path=/

GET
H3-29 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-162669458-1

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 6110
date: Mon, 28 Jun 2021 15:40:08 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Mon, 28 Jun 2021 17:40:08 GMT

GET
H2 200 rules-p-6Fv0cGNfc_bw8.js Show response
rules.quantcount.com/ 1 KB
1 KB 47ms
14ms Script
application/javascript 2600:9000:2104:9800:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-6Fv0cGNfc_bw8.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:9800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 46d5273d735391f5c05f0fb82df9a363a290419c3aeea2d64dfc0d46de9a9681

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:18:12 GMT
content-encoding: gzip
age: 227
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
last-modified: Mon, 19 Mar 2018 22:28:36 GMT
server: AmazonS3
etag: W/"9a93052877e57b42aeefaab6e7ec5f90"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 f32f19f2f9b3c0c60a4ff31c809ed008.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: 5mclHgyCZoObNXMH6jBNbpixCxEjJ-KiLWoeR1QzWLibml4I_LTTqA==

GET
H2 200 cmp2.js Show response
quantcast.mgr.consensu.org/tcfv2/23/ 266 KB
72 KB 15ms
15ms Script
text/javascript 2600:9000:2104:1e00:9:46dc:4700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js
Requested by: Host: quantcast.mgr.consensu.org
URL: https://quantcast.mgr.consensu.org/choice/6Fv0cGNfc_bw8/www.themoneytizer.com/choice.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:1e00:9:46dc:4700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7baadf42bdd7151de787de3b98f1c65f55cc2b3d34d4fbe90a0e490756dd3a1b

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:38 GMT
content-encoding: gzip
age: 20
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
access-control-max-age: 86400
access-control-allow-origin: *
last-modified: Fri, 18 Dec 2020 15:09:37 GMT
server: AmazonS3
etag: W/"1d55b13d85c9837da884d1e8594cc025"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/javascript;charset=UTF-8
via: 1.1 cc03ea6a31b592e93e84115778cdc495.cloudfront.net (CloudFront)
cache-control: max-age=172800
x-amz-meta-qc-ineu: True
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: D3pdGABwuyHsaf8JWz6U8M4Vf4gdoPzIXmg3jhXqYNFK5smpdp8XMQ==

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 14ms
14ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j91&a=495355773&t=pageview&_s=1&dl=https%3A%2F%2Furlz.fr%2Fg0QA&ul=en-us&de=UTF-8&dt=voicemail&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1758732268&gjid=490494161&cid=742329401.1624900919&tid=UA-162669458-1&_gid=254827136.1624900919&_r=1&gtm=2ou6n0&z=1993552695

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 28 Jun 2021 17:21:58 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://urlz.fr
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 87BC
Redirect Chain

https://ib.adnxs.com/getuid?https://mwzeom.zeotap.com/mw?adnxs_uid=$UID&zpartnerid=2&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&...
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fadnxs_uid%3D%24UID%26zpartnerid%3D2%26env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%2...
https://mwzeom.zeotap.com/mw?adnxs_uid=8975679616967768126&zpartnerid=2&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258

95 B
178 B

42ms
41ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?adnxs_uid=8975679616967768126&zpartnerid=2&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:59 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 666898382d3c4e8c-FRA
access-control-allow-headers: *
content-length: 95
cf-request-id: 0af53d771900004e8c1b0a4000000001

Redirect headers

Pragma: no-cache
Date: Mon, 28 Jun 2021 17:21:59 GMT
X-Proxy-Origin: 194.99.105.99; 194.99.105.99; 537.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 489745e4-c994-4e87-89eb-d2844748f044
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://mwzeom.zeotap.com/mw?adnxs_uid=8975679616967768126&zpartnerid=2&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET pixel
cm.g.doubleclick.net/ Frame 87BC 0
0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 87BC
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d1...
https://match.adsrvr.org/track/cmb/generic?ttd_pid=2xlgrzl&ttd_tpi=1&ttd_puid=env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c2-40f9-4266-5fb0-918cb00c6234%26reqId%3D7764aea3-cbe6-430e-5969-93f9d1...
https://mwzeom.zeotap.com/mw?cid=50c228e3-f97f-4abb-8cce-457b18c6d5d9&zpartnerid=6&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc...

95 B
178 B

34ms
34ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=50c228e3-f97f-4abb-8cce-457b18c6d5d9&zpartnerid=6&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 666898370a0b4e8c-FRA
access-control-allow-headers: *
content-length: 95
cf-request-id: 0af53d766700004e8ce08f6000000001

Redirect headers

pragma: no-cache
date: Mon, 28 Jun 2021 17:21:58 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://mwzeom.zeotap.com/mw?cid=50c228e3-f97f-4abb-8cce-457b18c6d5d9&zpartnerid=6&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 449

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 87BC
Redirect Chain

https://dpm.demdex.net/ibs:dpid=199624&dpuuid=043752c2-40f9-4266-5fb0-918cb00c6234&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env%3DmWeb%26eventType%3D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=199624&dpuuid=043752c2-40f9-4266-5fb0-918cb00c6234&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%24%7BDD_UUID%7D%26zpartnerid%3D314%26env...
https://mwzeom.zeotap.com/mw?cid=18646538367459849653214569977138055572&zpartnerid=314&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4...

95 B
201 B

34ms
34ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=18646538367459849653214569977138055572&zpartnerid=314&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:59 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 66689837fcb14e8c-FRA
access-control-allow-headers: *
content-length: 95
cf-request-id: 0af53d76fb00004e8c342c0000000001

Redirect headers

DCS: dcs-prod-irl1-2-v010-077d05b68.edge-irl1.demdex.com 6.3.1.20210623115127
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: UXVCt+TkThE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://mwzeom.zeotap.com/mw?cid=18646538367459849653214569977138055572&zpartnerid=314&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 87BC
Redirect Chain

https://aa.agkn.com/adscores/g.pixel?sid=9212299398&zctry=DEU&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1258&cid=CQHsF8TP0DrNx%2BXxbeEswYrbYN%2FgQpr1%2BS41iYitP1U%3D

95 B
178 B

33ms
33ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1258&cid=CQHsF8TP0DrNx%2BXxbeEswYrbYN%2FgQpr1%2BS41iYitP1U%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 66689836b91b4e8c-FRA
access-control-allow-headers: *
content-length: 95
cf-request-id: 0af53d763700004e8ce8330000000001

Redirect headers

pragma: no-cache
date: Mon, 28 Jun 2021 17:21:58 GMT
server: AAWebServer
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://mwzeom.zeotap.com/mw?zpartnerid=660&env=mWeb&zctry=DEU&zdid=1258&cid=CQHsF8TP0DrNx%2BXxbeEswYrbYN%2FgQpr1%2BS41iYitP1U%3D
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 87BC
Redirect Chain

https://pixel.mathtag.com/sync/img?mt_exid=10092&redir=https%3A%2F%2Fmwzeom.zeotap.com%2Fmw%3Fcid%3D%5BMM_UUID%5D%26env%3DmWeb%26zpartnerid%3D979%26env%3DmWeb%26eventType%3Dmap%26id_mid_4%3D043752c...
https://mwzeom.zeotap.com/mw?cid=082860da-0536-4a00-b21e-d67ef5732f73&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9...

95 B
189 B

19ms
18ms

Image
image/png

2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mwzeom.zeotap.com/mw?cid=082860da-0536-4a00-b21e-d67ef5732f73&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer: https://spl.zeotap.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
content-type: image/png
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
cf-ray: 66689836a8db4e8c-FRA
access-control-allow-headers: *
content-length: 95
cf-request-id: 0af53d762700004e8c26262000000001

Redirect headers

Date: Mon, 28 Jun 2021 17:21:58 GMT
Server: MT3 3759 5f8f15b master zrh-pixel-x26
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://mwzeom.zeotap.com/mw?cid=082860da-0536-4a00-b21e-d67ef5732f73&env=mWeb&zpartnerid=979&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 0
Expires: Mon, 28 Jun 2021 17:22:01 GMT

GET
H2 200 cmp.min.js Show response
spl.zeotap.com/ Frame 87BC 541 B
482 B 45ms
44ms Script
text/plain 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/cmp.min.js?env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/?env=mWeb&uc=2&zdid=1258&eventType=map
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74f8433197886195f331fa0a56ec3d9ed8366b6a2fa1292fa479b5e422be03ff

Request headers

Referer: https://spl.zeotap.com/?env=mWeb&uc=2&zdid=1258&eventType=map
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-ray: 666898354cb54e8c-FRA
date: Mon, 28 Jun 2021 17:21:58 GMT
via: 1.1 google
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://spl.zeotap.com
access-control-allow-credentials: true
content-encoding: br
access-control-allow-headers: *
cf-request-id: 0af53d754900004e8cea8c3000000001

GET
H2 204 cmp
spl.zeotap.com/ Frame 87BC 0
0 38ms
38ms Document
text/plain 2606:4700:10::ac43:db6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://spl.zeotap.com/cmp?env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258&cmp=0
Requested by: Host: spl.zeotap.com
URL: https://spl.zeotap.com/cmp.min.js?env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:db6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: spl.zeotap.com
:scheme: https
:path: /cmp?env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258&cmp=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://spl.zeotap.com/?env=mWeb&uc=2&zdid=1258&eventType=map
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: zc=043752c2-40f9-4266-5fb0-918cb00c6234; zsc=%7C%FEi%13%17%06%23%27%10%82%10%AE%AD%40T%E7%7B%F7%99%8C%86s%DD%B4%26%E5%99OJ%C6%1CB%96%FD%B1%8E%FAyj%1F%98%3F%F6%0F%0E%EE%92%01%D8%A6Ld%A3%93%99%C5%16%EA%CD%B5%D5%E6%FC%0D%0B%FFSz%ED%0D%EA%7B%AD2%F2%FDh_%A5%8F%8A%C6%AD%0C%92i%1E%5Cq%89k%28%9FC%C6%86%CD%12%14%8E%3Bl%09%9F%23
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://spl.zeotap.com/?env=mWeb&uc=2&zdid=1258&eventType=map

Response headers

date: Mon, 28 Jun 2021 17:21:58 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
access-control-allow-origin: https://spl.zeotap.com
vary: Origin
via: 1.1 google
cf-cache-status: DYNAMIC
cf-request-id: 0af53d757f00004e8ced8e9000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 666898359da94e8c-FRA

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.0.0/ 84 KB
30 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.0.0/jquery.min.js

Requested by

Host: d2zur9cc2gf1tx.cloudfront.net
URL: https://d2zur9cc2gf1tx.cloudfront.net/a96081b6-db78-48c4-9f82-b93e316fb1f7/notifyme.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 23 Jun 2021 10:25:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 457018
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30186
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 23 Jun 2022 10:25:00 GMT

GET
H/1.1 200
OK notifyme.php Show response
adtrack.adleadevent.com/ 0
518 B 487ms
71ms XHR
application/x-javascript 54.246.114.109
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://adtrack.adleadevent.com/notifyme.php?st=a96081b6-db78-48c4-9f82-b93e316fb1f7
Requested by: Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.0.0/jquery.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.114.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 28 Jun 2021 17:21:59 GMT
Content-Encoding: gzip
Last-Modified: Mon, 28 Jun 2021 17:21:59 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: https://urlz.fr
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET identity
api.rlcdn.com/api/ 0
0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 108 B
646 B 73ms
73ms XHR
application/json 76.223.111.131
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=186329
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/186329-261067657875242.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.111.131 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a97adde81b00f2ca4.awsglobalaccelerator.com
Software: /
Resource Hash: da2d7f502ca822e89104193cef30a292c790e076efc84cc1299ae6b3315be689

Request headers

Referer: https://urlz.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 28 Jun 2021 17:21:59 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://urlz.fr
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 108
expires: Wed, 28 Jul 2021 17:21:59 GMT

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ Frame 1E3F 85 KB
30 KB 9ms
8ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2016 22:32:34 GMT
server: nginx
etag: W/"57e45c02-152b5"
vary: Accept-Encoding
x-hw: 1624900920.dop204.fr8.t,1624900920.cds208.fr8.hn,1624900920.cds012.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30070

GET
H2 200 wd.js Show response
drv.tw/inc/ Frame 1E3F 365 B
643 B 199ms
199ms Script
application/javascript 47.254.94.70
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: https://drv.tw/inc/wd.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 47.254.94.70 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:22:00 GMT
last-modified: Mon, 28 Dec 2020 05:44:07 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5fe970a7-16d"
x-cache: BYPASS
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 365
expires: Tue, 29 Jun 2021 17:22:00 GMT

GET
H/1.1 200
OK Me.htm
login.live.com/ Frame 1E3F 0
0 208ms
208ms Other
text/html 20.190.160.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.live.com/Me.htm?v=3
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.190.160.2 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 1E3F 105 KB
19 KB 62ms
60ms Stylesheet
text/css 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/371C) /
Resource Hash: 1b31b0ffabf72e2545aaad397417ba58f66eb3d57a232e115085136a497ffb34

Request headers

Origin: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw
Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: 77s7HX/qO+HbHX0PjIhH1A==
age: 11779752
x-cache: HIT
content-length: 19615
x-ms-lease-status: unlocked
last-modified: Thu, 11 Feb 2021 19:27:28 GMT
server: ECAcc (lhd/371C)
etag: 0x8D8CEC311CB1846
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 8a081d76-e01e-0094-231f-017244000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js Show response
aadcdn.msftauth.net/shared/1.0/content/js/ Frame 1E3F 429 KB
117 KB 65ms
63ms Script
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_FZ20atAlhirHa_737xNftg2.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35A4) /
Resource Hash: f4eef033057a448d28c81d25b7a2e43f42ecaf1843858f7245bc297f48c82301

Request headers

Origin: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw
Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: uAGaLmkt+ggMrMyfGdkQsg==
age: 11862437
x-cache: HIT
content-length: 120144
x-ms-lease-status: unlocked
last-modified: Wed, 10 Feb 2021 18:32:32 GMT
server: ECAcc (lhd/35A4)
etag: 0x8D8CDF23AD98758
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 2d6bc0b6-501e-0046-6d5e-00c4e6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js Show response
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 1E3F 41 KB
12 KB 94ms
93ms Script
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35B8) /
Resource Hash: 77488a70db590ed9cf98036f9ea317d6822398aeb5ceb6ea3a99021522d2cdcd

Request headers

Origin: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw
Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: WO4uW/y42E/4n+nHz177Gg==
age: 12049926
x-cache: HIT
content-length: 12395
x-ms-lease-status: unlocked
last-modified: Mon, 08 Feb 2021 18:58:52 GMT
server: ECAcc (lhd/35B8)
etag: 0x8D8CC6393EED0A3
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 279d5a62-201e-0038-1caa-fe38d3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/ests/2.1/content/images/ Frame 1E3F 4 KB
1 KB 60ms
59ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/3599) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 572176
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:22 GMT
server: ECAcc (lhd/3599)
etag: 0x8D64101507E84BD
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: bb293f62-501e-0005-300d-67cb24000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 picker-account.png
i.ibb.co/jg6w34B/ Frame 1E3F 1 KB
1 KB 69ms
68ms Image
image/png 145.239.131.55
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/jg6w34B/picker-account.png
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.239.131.55 , France, ASN16276 (OVH, FR),
Reverse DNS: i.ibb.co
Software: nginx /
Resource Hash: a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:22:00 GMT
last-modified: Sat, 18 Jan 2020 16:32:59 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 1082
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 400 picker_more.png
srv-file8.gofile.io/download/NAGerp/ Frame 1E3F 0
41 B 63ms
62ms Image
text/plain 144.76.69.233
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://srv-file8.gofile.io/download/NAGerp/picker_more.png

Requested by

Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

144.76.69.233 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

/ Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:22:00 GMT
x-content-type-options: nosniff
x-powered-by: Express
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 0
x-xss-protection: 1; mode=block

GET
H2 200 documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
aadcdn.msftauth.net/shared/1.0/content/images/ Frame 1E3F 2 KB
673 B 60ms
59ms Image
image/svg+xml 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/documentation_bcb4d1dc4eae64f0b2b2538209d8435a.svg
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35ED) /
Resource Hash: a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: 6dTbAT1RVL9d6geobv3IJg==
age: 17249890
x-cache: HIT
content-length: 606
x-ms-lease-status: unlocked
last-modified: Thu, 16 Jan 2020 00:32:49 GMT
server: ECAcc (lhd/35ED)
etag: 0x8D79A1B9DB4199D
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 37c6068e-a01e-003b-2d5f-cfcbb3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 109618.svg
image.flaticon.com/icons/svg/109/ Frame 1E3F 888 B
734 B 7ms
6ms Image
image/svg+xml 2a02:26f0:6c00:292::30ec
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://image.flaticon.com/icons/svg/109/109618.svg

Requested by

Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:292::30ec Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

4d4e0d586734853b1ee051168c1a202f3a88de8ff08d2f9d64c6bb113d2d4553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: public
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Tue, 07 Jun 2016 09:04:17 GMT
server: nginx
etag: "57568e11-378"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=285179
date: Mon, 28 Jun 2021 17:22:00 GMT
x-default-rule: YES
accept-ranges: bytes
content-length: 445
expires: Fri, 02 Jul 2021 00:34:59 GMT

GET
H2 200 converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 1E3F 0
19 KB 59ms
59ms Other
text/css 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/371C) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: 77s7HX/qO+HbHX0PjIhH1A==
age: 11779752
x-cache: HIT
content-length: 19615
x-ms-lease-status: unlocked
last-modified: Thu, 11 Feb 2021 19:27:28 GMT
server: ECAcc (lhd/371C)
etag: 0x8D8CEC311CB1846
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 8a081d76-e01e-0094-231f-017244000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ Frame 1E3F 0
12 KB 68ms
67ms Other
application/x-javascript 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_asthhb7t8jihncsg5l7_cg2.js
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35B8) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: gzip
content-md5: WO4uW/y42E/4n+nHz177Gg==
age: 12049926
x-cache: HIT
content-length: 12395
x-ms-lease-status: unlocked
last-modified: Mon, 08 Feb 2021 18:58:52 GMT
server: ECAcc (lhd/35B8)
etag: 0x8D8CC6393EED0A3
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 279d5a62-201e-0038-1caa-fe38d3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
DATA 200
OK truncated
/ Frame 1E3F 222 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/ Frame 1E3F 987 B
1 KB 65ms
65ms Image
image/jpeg 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/358B) /
Resource Hash: 8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-md5: 5YqvyYBhSpzXeWvqe16o8A==
age: 17508680
x-cache: HIT
content-length: 987
x-ms-lease-status: unlocked
last-modified: Fri, 27 Mar 2020 19:42:36 GMT
server: ECAcc (lhd/358B)
etag: 0x8D7D287001BC861
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 6e9a83be-b01e-0016-1804-cd876c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 49_7916a894ebde7d29c2cc29b267f1299f.jpg
aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/ Frame 1E3F 17 KB
17 KB 65ms
65ms Image
image/jpeg 152.199.23.37
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49_7916a894ebde7d29c2cc29b267f1299f.jpg
Requested by: Host: u0zxzrlmymmucrzzoq6wgw-on.drv.tw
URL: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/www.office.com/voicemail/?id=7809790285
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.37 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (lhd/35DF) /
Resource Hash: d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 28 Jun 2021 17:22:00 GMT
content-md5: eRaolOvefSnCzCmyZ/Epnw==
age: 17508684
x-cache: HIT
content-length: 17453
x-ms-lease-status: unlocked
last-modified: Fri, 27 Mar 2020 19:42:36 GMT
server: ECAcc (lhd/35DF)
etag: 0x8D7D2870015D3DE
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: bbbb728f-901e-0004-5804-cd3529000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ Frame 1E3F 90 KB
36 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-85417367-1

Requested by

Host: drv.tw
URL: https://drv.tw/inc/wd.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c596a211c9237a0f928bd98f566b25b78d543b7bfdde69678a1729315e8d2321

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 28 Jun 2021 17:22:00 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36326
x-xss-protection: 0
last-modified: Mon, 28 Jun 2021 16:32:22 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 28 Jun 2021 17:22:00 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 1E3F 48 KB
19 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://u0zxzrlmymmucrzzoq6wgw-on.drv.tw/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Jun 2021 17:36:57 GMT
server: Golfe2
age: 6112
date: Mon, 28 Jun 2021 15:40:08 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19661
expires: Mon, 28 Jun 2021 17:40:08 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=043752c2-40f9-4266-5fb0-918cb00c6234&reqId=7764aea3-cbe6-430e-5969-93f9d14d8e4c&uc=2&zdid=1258

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

160 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://quantcast.mgr.consensu.org/tcfv2/23/cmp2.js(Line 1) Message: TypeError: Cannot read property 'getItem' of null

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
aadcdn.msftauth.net
ads.themoneytizer.com
adtrack.adleadevent.com
ajax.cloudflare.com
ajax.googleapis.com
api.rlcdn.com
c.tmyzer.com
ced-ns.sascdn.com
cm.g.doubleclick.net
code.jquery.com
d2zur9cc2gf1tx.cloudfront.net
dpm.demdex.net
drv.tw
g.themoneytizer.net
gum.criteo.com
i.ibb.co
ib.adnxs.com
image.flaticon.com
js-sec.indexww.com
login.live.com
match.adsrvr.org
mwzeom.zeotap.com
onetag-sys.com
p.cpx.to
pixel.mathtag.com
quantcast.mgr.consensu.org
rules.quantcount.com
secure.quantserve.com
spl.zeotap.com
srv-file8.gofile.io
tag.leadplace.fr
u0zxzrlmymmucrzzoq6wgw-on.drv.tw
urlz.fr
ww1097.smartadserver.com
www.google-analytics.com
www.googletagmanager.com
api.rlcdn.com
cm.g.doubleclick.net
144.76.69.233
145.239.131.55
145.239.193.145
145.239.193.51
151.139.241.23
152.199.23.37
184.30.20.207
185.86.137.32
2.18.234.21
20.190.160.2
2001:4de0:ac18::1:a:2a
2600:9000:2104:1e00:9:46dc:4700:93a1
2600:9000:2104:9800:6:44e3:f8c0:93a1
2606:4700:10::ac43:db6
2606:4700:3038::6815:ead6
2606:4700::6810:a823
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:82f::2008
2a00:1450:4001:830::200a
2a00:1450:4001:830::200e
2a02:2638::1c
2a02:26f0:6c00:292::30ec
2a02:26f0:6c00::210:ba28
35.176.232.241
37.252.173.38
47.254.94.70
51.38.120.206
52.17.54.18
52.210.129.48
54.246.114.109
54.38.64.100
65.9.84.187
76.223.111.131
005c3133bf387e1b00a5ec25effc468f7752591adac19a3782d200bf68a970f0
02b9c635a0e3e4d665dba94b1f6c527cd20a108b53e15a98816e2d6325a020b0
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
10a3ee9567f82c11c5e21d3fe55b2ea27a40aee503fb767f0c46981e6839d9fb
15df4a35e492edfaf097578a79ce32acc5d3beff000bac2b850c624fa441f208
1967a54ac0a585a7b888a93e6cfc624f5623b0e94a9a301a8f671d63a06f8d94
1b31b0ffabf72e2545aaad397417ba58f66eb3d57a232e115085136a497ffb34
266bcea0bb58b26aa5b16c5aee60d22ccc1ae9d67daeb21db6bad56119c3447d
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
4006e0481f9cfffd3a579c3dcbdad1b6953e844c1e3c76a8d9f86844c98d87a3
44f1de4e3e7e780f13e8cac2ae97ddd2bb7f962b8813c54dcb1fc98acfdd26b1
46d5273d735391f5c05f0fb82df9a363a290419c3aeea2d64dfc0d46de9a9681
4a4b1b5cf62c7b75bfd7faab36c916eb6858c968a347f656c91396ac2e50050b
4d4e0d586734853b1ee051168c1a202f3a88de8ff08d2f9d64c6bb113d2d4553
621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
74f8433197886195f331fa0a56ec3d9ed8366b6a2fa1292fa479b5e422be03ff
77488a70db590ed9cf98036f9ea317d6822398aeb5ceb6ea3a99021522d2cdcd
7baadf42bdd7151de787de3b98f1c65f55cc2b3d34d4fbe90a0e490756dd3a1b
7e176e51c1dff07522d527754e78745b4fe73db4b875ab85be5ec57e2e35346c
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
8da935c18168ab5561137d875449b7b5b4e38ec854c5f3d2296823cf0b93a3f9
92cbdf981e972713803322bc00a0e26ad84949715baaaf07149cfae4d9949d78
9358f222ba40b683e83f1705f68d251bf6002d597f38707e59abef418d6dfc37
a3ec79086c71191b0dbc128b397d1a27d132bd2b658667bc4229b53cbcb20b05
a76c08e9cdc3bb87bfb57627ad8f6b46f0e5ef826cc7f046dfbaf25d7b7958ea
b47b4ca26c57e3dceebd7abd067df9622599bed6bfb11b480f92d09a945cd213
b780c05b9b8e1f7acff640ef794ca777ffa43e5d4354a84eebf3dd98975f8675
bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012
c596a211c9237a0f928bd98f566b25b78d543b7bfdde69678a1729315e8d2321
c939cfbe32d5cbea4ee0557538c2f2ca8f86dc9ce94db41849b2aa7b7a70b90d
c9d7d2103a91192f3ae8664f18f698d85da9a86564b546afba4a7782f0ad4461
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d59dad5bf9bca39dfb380810d40113b65d904f3734e9db845901bcb6189a618b
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
da2d7f502ca822e89104193cef30a292c790e076efc84cc1299ae6b3315be689
dc3e1adfd5d48138ad58323a6ce07f03b055b28a5dab8d99b3448a186c7fd3c1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f2af6a03599a30f21216920acbab05ce2903a5f62b4a6b4f9b0a2b234004e53e
f4eef033057a448d28c81d25b7a2e43f42ecaf1843858f7245bc297f48c82301

urlz.fr Open in urlscan Pro 2606:4700:3038::6815:ead6 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

75 Requests

97 %HTTPS

39 %IPv6

35 Domains

37 Subdomains

29 IPs

6 Countries

1080 kBTransfer

3275 kBSize

0 Cookies

0 Outgoing links

Redirected requests

75 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

urlz.fr Open in urlscan Pro
2606:4700:3038::6815:ead6 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

75
Requests

97 %
HTTPS

39 %
IPv6

35
Domains

37
Subdomains

29
IPs

6
Countries

1080 kB
Transfer

3275 kB
Size

0
Cookies

75 HTTP transactions
2 data transactions