reurl.cc Open in urlscan Pro
35.185.130.121 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://reurl.cc/XqAx30
Submission: On March 24 via api (March 24th 2025, 6:53:47 pm UTC) from JP — Scanned from US

Summary HTTP 360 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 55 IPs in 5 countries across 38 domains to perform 360 HTTP transactions. The main IP is 35.185.130.121, located in Taipei, Taiwan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is reurl.cc. The Cisco Umbrella rank of the primary domain is 200657.
TLS certificate: Issued by R11 on March 14th 2025. Valid for: 3 months.

This is the only time reurl.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	35.185.130.121 35.185.130.121	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
5	34.149.98.30 34.149.98.30	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2607:f8b0:400... 2607:f8b0:4004:c07::61	15169 (GOOGLE) (GOOGLE)
50	2607:f8b0:400... 2607:f8b0:4004:c06::9b	15169 (GOOGLE) (GOOGLE)
3	203.137.133.152 203.137.133.152	4694 (IDCF IDC ...) (IDCF IDC Frontier Inc.)
2	168.95.246.2 168.95.246.2	131660 (CHTCDN Da...) (CHTCDN Data Communication Business Group)
2	2a03:2880:f00... 2a03:2880:f003:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
5	2607:f8b0:400... 2607:f8b0:4004:c1d::65	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2607:f8b0:400... 2607:f8b0:4004:c23::66	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c07::9c	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c17::9a	15169 (GOOGLE) (GOOGLE)
10	2607:f8b0:400... 2607:f8b0:4004:c09::64	15169 (GOOGLE) (GOOGLE)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
19	2620:100:a00b... 2620:100:a00b::30	19750 (AS-CRITEO) (AS-CRITEO)
1	104.18.29.101 104.18.29.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c17::84	15169 (GOOGLE) (GOOGLE)
1	2620:100:a00b... 2620:100:a00b::12	19750 (AS-CRITEO) (AS-CRITEO)
1	182.22.28.252 182.22.28.252	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
37	2607:f8b0:400... 2607:f8b0:4004:c17::9d	15169 (GOOGLE) (GOOGLE)
3	119.63.193.220 119.63.193.220	38627 (BAIDUJP B...) (BAIDUJP Baidu)
57	2600:9000:250... 2600:9000:250a:4200:0:e06c:e940:93a1	16509 (AMAZON-02) (AMAZON-02)
8	2600:9000:250... 2600:9000:250a:d000:0:e06c:e940:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	2607:f8b0:400... 2607:f8b0:4004:c1f::9c	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4004:c07::9b	15169 (GOOGLE) (GOOGLE)
17	2607:f8b0:400... 2607:f8b0:4004:c0b::84	15169 (GOOGLE) (GOOGLE)
7	2607:f8b0:400... 2607:f8b0:4004:c1d::68	15169 (GOOGLE) (GOOGLE)
13	54.64.195.61 54.64.195.61	16509 (AMAZON-02) (AMAZON-02)
1	119.63.198.189 119.63.198.189	38627 (BAIDUJP B...) (BAIDUJP Baidu)
1	34.111.12.34 34.111.12.34	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.107.150.21 34.107.150.21	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
24	203.75.214.136 203.75.214.136	3462 (HINET Dat...) (HINET Data Communication Business Group)
3	119.63.198.143 119.63.198.143	38627 (BAIDUJP B...) (BAIDUJP Baidu)
1	34.102.218.41 34.102.218.41	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	107.178.241.176 107.178.241.176	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.160.26.175 34.160.26.175	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	103.132.192.30 103.132.192.30	138552 (RTBHOUSE-...) (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD.)
5	210.59.219.34 210.59.219.34	3462 (HINET Dat...) (HINET Data Communication Business Group)
10 20	35.190.36.98 35.190.36.98	15169 (GOOGLE) (GOOGLE)
10 10	172.104.70.67 172.104.70.67	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
12	2620:100:a00b::5 2620:100:a00b::5	19750 (AS-CRITEO) (AS-CRITEO)
1	2606:4700::68... 2606:4700::6812:5fe1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.0.78.25 192.0.78.25	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700:303... 2606:4700:3034::6815:6009	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	103.1.220.9 103.1.220.9	131149 (YUANJHEN-...) (YUANJHEN-AS-TW Yuan-Jhen Info.)
1	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2600:9000:250... 2600:9000:250b:ba00:1e:5c56:d400:93a1	16509 (AMAZON-02) (AMAZON-02)
1	119.63.198.188 119.63.198.188	38627 (BAIDUJP B...) (BAIDUJP Baidu)
3 3	2001:4998:60:... 2001:4998:60:807::1	14196 (YAHOO-CHA) (YAHOO-CHA)
2 2	23.21.95.27 23.21.95.27	14618 (AMAZON-AES) (AMAZON-AES)
2 2	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1 2	18.207.77.150 18.207.77.150	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:400... 2a04:4e42:400::300	54113 (FASTLY) (FASTLY)
1	2607:f8b0:400... 2607:f8b0:4004:c07::84	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1f::84	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c09::84	15169 (GOOGLE) (GOOGLE)
360	55

1 35.185.130.121 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.130.185.35.bc.googleusercontent.com

reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.149.98.30 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 30.98.149.34.bc.googleusercontent.com

storage.reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c07::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

50 2607:f8b0:4004:c06::9b (Washington, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 203.137.133.152 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)

cpt.geniee.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 168.95.246.2 (Los Angeles, United States)

ASN131660 (CHTCDN Data Communication Business Group, TW)
PTR: 168-95-246-2.hinet-ip.hinet.net

ad-specs.guoshipartners.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f003:100:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c1d::65 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c23::66 (Washington, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c07::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::9a (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4004:c09::64 (Washington, United States)

ASN15169 (GOOGLE, US)

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2620:100:a00b::30 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.29.101 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn-ima.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c17::84 (Washington, United States)

ASN15169 (GOOGLE, US)

aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a00b::12 (United States)

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.28.252 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

yads.c.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 2607:f8b0:4004:c17::9d (Washington, United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 119.63.193.220 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

api.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2600:9000:250a:4200:0:e06c:e940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:250a:d000:0:e06c:e940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adx.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1f::9c (Washington, United States) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4004:c07::9b (Washington, United States)

ASN15169 (GOOGLE, US)

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2607:f8b0:4004:c0b::84 (Washington, United States)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2607:f8b0:4004:c1d::68 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 54.64.195.61 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com

ad.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.63.198.189 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

tw.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.12.34 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 34.12.111.34.bc.googleusercontent.com

ad.tagtoo.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.150.21 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 21.150.107.34.bc.googleusercontent.com

uec.tagtoo.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 203.75.214.136 (Taipei, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 203-75-214-136.hinet-ip.hinet.net

t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 119.63.198.143 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

log.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.218.41 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 41.218.102.34.bc.googleusercontent.com

ecs.tagtoo.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 107.178.241.176 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 176.241.178.107.bc.googleusercontent.com

onead.onevision.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.160.26.175 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 175.26.160.34.bc.googleusercontent.com

re-news.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 103.132.192.30 (Singapore)

ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG)
PTR: ip-103-132-192-30.rtbhouse.net

prebid-asia.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 210.59.219.34 (Taichung City, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 210-59-219-34.hinet-ip.hinet.net

prebid.scupio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 35.190.36.98 (Kansas City, United States) 10 redirects

ASN15169 (GOOGLE, US)
PTR: 98.36.190.35.bc.googleusercontent.com

ad2.apx.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 172.104.70.67 (Tokyo, Japan) 10 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1680-67.members.linode.com

gocm.c.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2620:100:a00b::5 (United States)

ASN19750 (AS-CRITEO, US)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:5fe1 (United States)

ASN13335 (CLOUDFLARENET, US)

mma.prnasia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.78.25 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

creditcards.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3034::6815:6009 (United States)

ASN13335 (CLOUDFLARENET, US)

img.gbyhn.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.1.220.9 (Taiwan)

ASN131149 (YUANJHEN-AS-TW Yuan-Jhen Info., Co., Ltd, TW)
PTR: ph2.g-dns.com

img.racingcharger.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:250b:ba00:1e:5c56:d400:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.wixstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.63.198.188 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

r.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4998:60:807::1 (United States) 3 redirects

ASN14196 (YAHOO-CHA, US)

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.21.95.27 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-95-27.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.71.131.137 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.207.77.150 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-207-77-150.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c07::84 (Washington, United States)

ASN15169 (GOOGLE, US)

eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1f::84 (Washington, United States)

ASN15169 (GOOGLE, US)

280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::84 (Washington, United States)

ASN15169 (GOOGLE, US)

4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
78	holmesmind.com cdn.holmesmind.com — Cisco Umbrella Rank: 144812 adx.holmesmind.com ad.holmesmind.com — Cisco Umbrella Rank: 113263	98 KB
54	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 289 stats.g.doubleclick.net — Cisco Umbrella Rank: 284 td.doubleclick.net — Cisco Umbrella Rank: 327 googleads.g.doubleclick.net — Cisco Umbrella Rank: 70	274 KB
44	googlesyndication.com aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 157 eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com 280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com 4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com 78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com 7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com	380 KB
30	appier.net 20 redirects ad2.apx.appier.net — Cisco Umbrella Rank: 115896 gocm.c.appier.net — Cisco Umbrella Rank: 5598	7 KB
24	hinet.net t.ssp.hinet.net — Cisco Umbrella Rank: 92735 3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net	7 KB
21	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 512 ep2.adtrafficquality.google — Cisco Umbrella Rank: 514	96 KB
19	criteo.net static.criteo.net — Cisco Umbrella Rank: 1135	56 KB
19	google.com analytics.google.com — Cisco Umbrella Rank: 253 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 649 www.google.com — Cisco Umbrella Rank: 10	72 KB
13	criteo.com gum.criteo.com — Cisco Umbrella Rank: 610 bidder.criteo.com — Cisco Umbrella Rank: 1746	2 KB
8	popin.cc api.popin.cc — Cisco Umbrella Rank: 22807 tw.popin.cc — Cisco Umbrella Rank: 125846 log.popin.cc — Cisco Umbrella Rank: 93722 r.popin.cc — Cisco Umbrella Rank: 102226	97 KB
6	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 3260 prebid-asia.creativecdn.com — Cisco Umbrella Rank: 20685	4 KB
6	reurl.cc reurl.cc — Cisco Umbrella Rank: 200657 storage.reurl.cc — Cisco Umbrella Rank: 279374	7 KB
5	scupio.com prebid.scupio.com — Cisco Umbrella Rank: 143006	840 B
5	onevision.com.tw onead.onevision.com.tw — Cisco Umbrella Rank: 153929	2 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 116	22 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 129	227 B
3	yahoo.com 3 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 3132 ups.analytics.yahoo.com — Cisco Umbrella Rank: 830	934 B
3	tagtoo.co ad.tagtoo.co — Cisco Umbrella Rank: 167837 uec.tagtoo.co — Cisco Umbrella Rank: 130520 ecs.tagtoo.co — Cisco Umbrella Rank: 121351	62 KB
3	geniee.jp cpt.geniee.jp — Cisco Umbrella Rank: 35259	70 KB
2	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1557	2 KB
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 564	1 KB
2	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 1587	730 B
2	re-news.tw re-news.tw	31 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 255	80 KB
2	guoshipartners.com ad-specs.guoshipartners.com — Cisco Umbrella Rank: 181880	24 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 107	260 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 427	58 KB
1	taboola.com trc.taboola.com — Cisco Umbrella Rank: 1016	189 B
1	wixstatic.com static.wixstatic.com — Cisco Umbrella Rank: 8835	1011 KB
1	w.org s.w.org — Cisco Umbrella Rank: 7227	731 B
1	racingcharger.tw img.racingcharger.tw	152 KB
1	gbyhn.com.tw img.gbyhn.com.tw	67 KB
1	creditcards.com.tw creditcards.com.tw	65 KB
1	prnasia.com mma.prnasia.com	12 KB
1	yimg.jp yads.c.yimg.jp — Cisco Umbrella Rank: 31472	58 KB
1	33across.com cdn-ima.33across.com — Cisco Umbrella Rank: 1907	7 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 3358	8 KB
0	alphaloan.co Failed blog.alphaloan.co Failed
360	38

	Domain	Requested by
64	cdn.holmesmind.com	securepubads.g.doubleclick.net cdn.holmesmind.com ad.holmesmind.com
50	securepubads.g.doubleclick.net	reurl.cc securepubads.g.doubleclick.net pagead2.googlesyndication.com
37	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
20	ad2.apx.appier.net	10 redirects reurl.cc cdn.holmesmind.com
19	static.criteo.net	securepubads.g.doubleclick.net cdn.holmesmind.com reurl.cc static.criteo.net
18	t.ssp.hinet.net	api.popin.cc cdn.holmesmind.com t.ssp.hinet.net
14	ep2.adtrafficquality.google	pagead2.googlesyndication.com ep2.adtrafficquality.google securepubads.g.doubleclick.net
13	ad.holmesmind.com	cdn.holmesmind.com
12	bidder.criteo.com	static.criteo.net
10	gocm.c.appier.net	10 redirects
10	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
7	www.google.com	ep2.adtrafficquality.google
7	ep1.adtrafficquality.google	pagead2.googlesyndication.com reurl.cc securepubads.g.doubleclick.net
6	3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net	reurl.cc t.ssp.hinet.net
5	prebid.scupio.com	cdn.holmesmind.com
5	prebid-asia.creativecdn.com	cdn.holmesmind.com
5	onead.onevision.com.tw	ad-specs.guoshipartners.com reurl.cc
5	www.google-analytics.com	storage.reurl.cc www.google-analytics.com reurl.cc www.googletagmanager.com
5	storage.reurl.cc	reurl.cc
4	www.facebook.com	reurl.cc
3	log.popin.cc	reurl.cc
3	api.popin.cc	reurl.cc api.popin.cc
3	cpt.geniee.jp	reurl.cc cpt.geniee.jp
2	ps.eyeota.net	1 redirects reurl.cc
2	match.adsrvr.org	2 redirects
2	bcp.crwdcntrl.net	2 redirects
2	ups.analytics.yahoo.com	2 redirects
2	re-news.tw	storage.reurl.cc reurl.cc
2	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com
2	analytics.google.com	www.googletagmanager.com
2	connect.facebook.net	storage.reurl.cc connect.facebook.net
2	ad-specs.guoshipartners.com	reurl.cc
2	www.googletagmanager.com	reurl.cc
2	cdn.jsdelivr.net	reurl.cc
1	b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	trc.taboola.com	reurl.cc
1	cms.analytics.yahoo.com	1 redirects
1	r.popin.cc	reurl.cc
1	static.wixstatic.com	reurl.cc
1	s.w.org	reurl.cc
1	img.racingcharger.tw	reurl.cc
1	img.gbyhn.com.tw	reurl.cc
1	creditcards.com.tw	reurl.cc
1	mma.prnasia.com	reurl.cc
1	ecs.tagtoo.co	ad.tagtoo.co
1	uec.tagtoo.co	api.popin.cc
1	ad.tagtoo.co	api.popin.cc
1	tw.popin.cc	api.popin.cc
1	adx.holmesmind.com	pagead2.googlesyndication.com
1	yads.c.yimg.jp	cpt.geniee.jp
1	gum.criteo.com	static.criteo.net
1	aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	cdn-ima.33across.com	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	td.doubleclick.net	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	reurl.cc
0	blog.alphaloan.co Failed	reurl.cc
360	64

This site contains links to these domains. Also see Links.

Domain
re-news.tw
youtils.cc
www.comptw.com
stockinfo.tw

Subject Issuer	Validity	Valid
reurl.cc R11	`2025-03-14` - `2025-06-12`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
storage.reurl.cc WR3	`2025-03-14` - `2025-06-12`	3 months	crt.sh
*.google-analytics.com WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
*.g.doubleclick.net WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
*.geniee.jp GeoTrust TLS RSA CA G1	`2024-07-30` - `2025-08-30`	a year	crt.sh
ad-specs.guoshipartners.com Go Daddy Secure Certificate Authority - G2	`2025-01-08` - `2026-01-21`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2025-01-02` - `2025-04-02`	3 months	crt.sh
*.google.com WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
*.doubleclick.net WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
oa.openxcdn.net WR3	`2025-03-12` - `2025-06-10`	3 months	crt.sh
invstatic101.creativecdn.com WR3	`2025-02-12` - `2025-05-13`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-03` - `2025-05-03`	3 months	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-30`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-09` - `2025-05-10`	3 months	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2025-02-07` - `2026-03-06`	a year	crt.sh
*.popin.cc Secure Site Pro CA G2	`2024-09-23` - `2025-10-24`	a year	crt.sh
*.holmesmind.com Go Daddy Secure Certificate Authority - G2	`2025-03-06` - `2026-04-07`	a year	crt.sh
adtrafficquality.google WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
ad.tagtoo.co WR3	`2025-02-20` - `2025-05-21`	3 months	crt.sh
uec.tagtoo.co WR3	`2025-02-23` - `2025-05-24`	3 months	crt.sh
*.t.ssp.hinet.net HiPKI OV TLS CA - G1	`2025-02-12` - `2026-02-12`	a year	crt.sh
ecs.tagtoo.co WR3	`2025-03-22` - `2025-06-20`	3 months	crt.sh
onead.onevision.com.tw R10	`2025-02-03` - `2025-05-04`	3 months	crt.sh
wp.re-news.tw WR3	`2025-03-04` - `2025-06-02`	3 months	crt.sh
*.creativecdn.com RapidSSL TLS RSA CA G1	`2024-04-05` - `2025-04-30`	a year	crt.sh
*.scupio.com Sectigo RSA Organization Validation Secure Server CA	`2024-09-27` - `2025-10-28`	a year	crt.sh
*.prnasia.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-23` - `2025-11-23`	a year	crt.sh
tls.automattic.com E6	`2025-02-14` - `2025-05-15`	3 months	crt.sh
gbyhn.com.tw WE1	`2025-03-06` - `2025-06-04`	3 months	crt.sh
img.racingcharger.tw R11	`2025-02-15` - `2025-05-16`	3 months	crt.sh
s.w.org E6	`2025-02-28` - `2025-05-29`	3 months	crt.sh
*.wixstatic.com R11	`2025-01-23` - `2025-04-23`	3 months	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-01` - `2025-12-31`	a year	crt.sh

This page contains 63 frames:

Primary Page: https://reurl.cc/XqAx30
Frame ID: 99883335ABD4CA7A6AC02E8A690B23EA
Requests: 63 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-N394QBRGC0&gacid=1802819371.1742842418&gtm=45je53k0v897965293za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102482433~102788824~102803279~102813109~102887800&z=1184303255
Frame ID: FEAE4240BFE36CDDA4AF9F2CB4316CFF
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: C023D5D77210B21C10BA04F085F2F865
Requests: 1 HTTP requests in this frame

Frame: https://aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: 9B4E6ABCFFA14D6B540A3AE7D3124E9B
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=
Frame ID: 2BB9FAEF280AC13E7B168088817547B1
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvoyXHhm5QoYX_75Aqen0RMO5xNIxNCoCw9W7J4LHXuw4vYcVpclStePNM5ma0krRbFpf7GmuJBJvi_xftFKPKOI4467ptnIdjHKVFviv9iICJ5S-Bh7JEjzQDJLWA-ZLqbLzMTEDhjdh0DzfOPyK5LLC3AbGJZcxhPuRJl4t4mcKOvmbAmg07gd2ZMuLuGCkoGNHSBURrt0qH3Ny3yFFyLXmP_IrOJn4weDxZrpGK0z1U3rPFdyfI08ZfKvKIieSxt9pEepMUAq-02_vNOnQZEJo_ODSRnF4tKa7dgtRUyZZluwetUf29n3NmFP1lgcfrEQfpEzhl9EwkzTbES4-bUpl4qTSu4MoqJpE3Ojjg7fIM3V2lV7hrDp2IR8wDwHTSbN8iXmDvHyM2ZDYT4lVWA6W-11MhxXK_hQITUx9N3H6TngxF9QfmjEA&sai=AMfl-YSeXGjrqxUC1UBkNXh3DPicNuqSuvKWl0VrEmTQuu1JEG-Y5lxbBgZaUdGBcjZw2V2ZqS9_tZYv1BJ8G4G0IOx9N1Xx3YXIqnRGOAzgPRM-lzLOK8GtMb40q6I&sig=Cg0ArKJSzGkEpg9SzlMJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: CEAFFBD687DB6D9284D6C14DFAF8DC4F
Requests: 13 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvVlh_-jfIFeiSJBKUgsmSsh7vxa55Pyoaib3gEhX04iq7H5AhgFP5IIWqeJVWEZY4B3gcL1Fgmr83juzcop66cmW6ep-JKvysdFlQ1cXg1_Ef0xMLX6A4yj0iCuKcOcLMrVVXoQfOoM3qZBvYsACveWuJC_6kBpT7VdEnfv2Q1RCkEJKWsxkYM22RIyqi1z_ZroUZvraUwMU3eVB4OuW4iaC50deHScXSRNNkAAL3kGeorntBwi6J1J1niF-RY4awdVB9k3rZPbIAodsgy37eauux91jbCzkhBNPjMlFaLdI-0Kz5CC72twdxSgjjn8hgCWUi1IznNlhG8KVpctxWFnvK2V-DqG8Y6GDKg5FskuNLqpUJv10GBFLFIW-aFuQr4W2DGCKqAAh0rsdNhORjLC8ZbSw_rwDL4WCCeejoHaHDZmtGvdBzoBQ&sai=AMfl-YReXAc2OijSPyKDq3iEiiRIcAiZ_OPmRsm61t896_MSI4Egb1nKsCmYI00nD29bRRnFlNjXdxrYguVfp1WDlla6sSOMadJq8jIwUJEiAVtn38eX_kXATi7c8Gc&sig=Cg0ArKJSzBDzLQ9Ek3-HEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: A1D2E4AE10CF1B069052955B2D70C963
Requests: 22 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfMLdO8EJnViJDeaJmEhgwek5nJrJ27KH62yMKRmunOVEI4k2B3zfigAzYHdvIXrjlwf2Pr7vT1NYb6uZhGi1bFRGctPkuJSHr6M_-XJHJvQBZ0RIqzoR8cYjH9JX-GM3hxeFTw3q5F5sOomjAvnU6hc3UJXaAvy-AreD6Y1g3P3yTlxXFAVAjprSVyBY2ZvIoW92KUvaV4cL2BeeetfKRibLL8z1qMMQC2Phxo5Nu3rF9t_QepkbEEBifD5aIg9iagPIf8wbh6kpliNtuHjSJ1eXIxxVIeo3CvnXN0Y9fDg_GllCp0V84rygCuTy6GNAY4fLrgzALPAMlL80BmQysAKwbP-Y1naZNvPswcokPT9FhvCIAmGIKrsLA8aLK2vlNgHtvRs-8DCUQdHxiIYSrqjmAauV1PsaXGrylcSpmIA0bFHyyUb5NzJEiM9Xj2rQ&sai=AMfl-YQPloFEkVoV7-EVRCwcDc7Y4lEtdX0ctQZf_O8oWUdEQQBOtdp7IemXAX0KG-yYUYNZHQg1eLosR757PwQABEtIHawIm6NxYE_sNp7ZXzzWUXp-qKgC1N1Wcao&sig=Cg0ArKJSzLOgm8-LoPQ8EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: B65A1C75A6C65F1091FEB6AFF46303EF
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvygvWsUSWBPeUhgs_LyhGhO60HFcUcHYMjML3eiomjwp6dTasw22xFSThSgOfwQSeNZWnqEDace3L3XCl_X1cqd0WEa6SBFYY94KwqFlAtGFwwT-LoDmPVPs9gY6iqw_NwPabIZgQXDSAojzIdk-5hQZlExtODb7-udwR7UHtSwwfs6mNSuIOYLhOGXI8asQzzhZZPEvB8QjDO2cKNE4d43lCapa5HLg5UsveixdmjWLpxCIl7fs0zs_cVyNnZEXZR-bO_UnptRV77wYSc0X108Lsau_Cc9jH8c6-NElAj8zXeud69ao_t-x7BAS_4OcNfkyfEBMNtrDse9NCnqeDAApRnzMXe_NUR2OOTgXbeXVD34wtTmSSd1-ogBucR8NVKAIcFGkgSHpA_7h1pdFapv_BsNtz7yQHOcfbzbyCpS4rZzuue_QS7CHiIH0ZfpMI&sai=AMfl-YS19EpyDoOz-44wizUzeEmTJf0USZ4RPMkay_2oV5ehBXXfm0adwy6bQMqSrQVgsfFSvKsofFVqLTSk2RSR9rRmziTO-DsawtFXKRhK_Og2u_ndVrdvr-xzicc&sig=Cg0ArKJSzDAPpuFb8HkZEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: B401F82B5A2BDBF37D4CBDFECE73AE42
Requests: 6 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 7EBF9B903DC9CEA08010EC7722014ECB
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 9007D689DF00481A1A6F7FD814413DFC
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 12EEC572DE7847261571A1BADE95188F
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: F25F5ACDA0CBBEE6F0D286CB10F6C203
Requests: 23 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250319/r20190131/zrt_lookup.html
Frame ID: 2F0C8EF38F949EB329901A5833193CB3
Requests: 1 HTTP requests in this frame

Frame: https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html
Frame ID: F22BCDBB44469DE227D1C1E9A80A1AAC
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: DF89A48D8A1EDAFCE3FD2EBEDB7E8F20
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 9AEED72CDDE804C58064971FEEC3DA08
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Frame ID: B2B38D2B4515996002EBB0571CEF3D58
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 52A99F82A1A1F2D37343FEBFF7F9958E
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 04AEB0ADB7620D1A29BE0C56E0BA8D65
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 1A4E46B962C44BF85261642DA8B47F28
Requests: 1 HTTP requests in this frame

Frame: https://eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3
Frame ID: 20ACBA91CB90E3CD099FD80F69586260
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 2677286D6B3D499FBDC24E41F02C033F
Requests: 1 HTTP requests in this frame

Frame: https://280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3
Frame ID: 14C078207BD9F04B3E8624A2BB078330
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 47F3119289079B2CB9BEA6B554294C0D
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: B4DD5A12B808D7F6F2A78714035BC8CF
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 76DF959D8251A0F7BC737DB48F2A0B3F
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E14F630251C5139CD2ABF5A019B03A00
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstsMfPTcL0kF-vlaLqLSUbIsdo7CVs52UcQVIeZLwflNI6_OdLjyfnyug9eIf5GZawQAPYo2nzHfgw7rtf1zfMJz-EVNWs2CninmkkZZq5AXdFMl1zE1jp0JhyPtfo8CPgWyPQIgnQcpdI_lejpt2dgNLNF4vxCs2-T_99-gr-MPmw-WRvD393JbMXJSqivahqmzl7R0WSFCPnkA0bvgDylRV3LGn8Jei3CdHdcgdi7OHXvZkN-Lsi1EERQmAxV8bbLUIS_NgFNWXtFA5nWOf_6bAO3WpX1MDwq3opwt1y4ixFflLQbAjxErjScy5tUccH2eX0rlk9eAVtfGWBZ7IGK1489gidIThupiFuajsHy1Tdcl6ubERGOFEbVvPafk_ERaur-M3oHBUi1gtPYeFXGvCV6Lb_hy3G-ZVrUuKpBGCBKefbs2DmjJInq-K6t-mnlGQydD9eKBg&sai=AMfl-YR1ENkRiNW3__B_VZsoBsRHQr1-pBpKXXWn7aNk3ITBoiUkc_du4aUzukKZtlVRNYh-qr7zPIK0ImbBOrNWVUBrvnfudpw0N-iI7iahQ38bBbwyqsTOI_TPIFI&sig=Cg0ArKJSzIGXrKn7zx4IEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: BDDE961F295CA51BAB097AAA8C0B0C11
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Frame ID: E90790FFE2A830DA34956E5E7ED9FE53
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: B05C9FADC12B9EF4A84E3DFEDBC9AC02
Requests: 23 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 6E00272D2B1821E6DC12A14B7041A75F
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: DD0972618C502513009D31CD7EF1F97D
Requests: 1 HTTP requests in this frame

Frame: https://4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=6
Frame ID: FF204E0EB989797DADB6F2D7666FF526
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 534876E85E929737EDD25BA1D3C250B7
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: F3647ED41A5FB1B6894960985B35DDC7
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlM140mWdqtXOXrHAzBCgYmoaBoCF1ui0XaWmLZ8oiYkOOnzD0M15TCp8AH7nCiF7gG2gO0pU2oU2UtcdfDOsVaAkAl_uyeq6FkqcK6arO0BDfi34HZrADu3_Aw7suceS3sDA9yODAAEttdiKR2kKD4Ir-oXAjEGLKqGd8bLxQGTmQBZcu8cfb0BsUDHVFAEW5BgoTIt8q_R5xp_Mhos_fDe0xrVhmvN044RHqrkiulH1-czVotK0MZEtOwYa4zpLj0D8tiLtFzHY4MinUBwBUnkhvt7VOexjWLEcXIwlN43OBEbPsHqY48sHFk_BMzgoG1oZdoW7qtv0OkHf4q40FvBJ5WOLQPJVagD2J4vkr9AOQx_fksMpQDtdEhZT7QMUwCdlenrrG2R4Er-WYgi7XxIwX_QOn6wtD_Rzn8xLfMBGdJZfo6gr06_86L9jqTZeFshzlgAIWhg&sai=AMfl-YQfhlGJN1xk8zyDIdoGkxCnTRhFT_IPtAXkFu_9jvvpYqiKyVRstXa7tRR45V-6Mz_Ctbn0R9inw7Xn7gaUjNJKu_yiUfxyXn2ZAWr_lPyOmSG7V-2hhrRcdAY&sig=Cg0ArKJSzFtvZo-wGX2hEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 57472912A1E10322340DA8DD6126A573
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Frame ID: 41B7A53263E05877E58283E6F5A2355C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 225190747B48C60148D9E7DC26BE1786
Requests: 22 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: C28B00B34A87ED3339257601B4D24692
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 039597AF495947920132187FEF5088AD
Requests: 1 HTTP requests in this frame

Frame: https://78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=9
Frame ID: 6689B222125CB272C564CB20BD70FFD8
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 8E08575492F0BE5BC324978C2B05BDE8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 360D5167B5415F137A124C87A0F7BF74
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGn-JXAtiXVzF6MORYQj88fGbM9iO3LVhoH3_v4PXSJW8W-UIDvCodh2tj6DB0pD_b07i54zTOv_EiO6jXZ_G2WLCWrQeo2E6-1XyhmRBWO8kL8-EbHDWSqmOwMKTz_cIjp9ZYT1MOeRRMtkZh0s999Q0uUF_W9ayeNcs9wV1MTq9dlUb12kR5SG93U2FO3htFNRa0l-_7DFXz8E7SKOVnSBonCfpI7KestCt_SAZgGoFvkZhmBYiQY-BKhApNhjjq8hBf3U6h4EvzNhfwC9lIu9NwdvENTqMwdhD2LOPu7-C6DDPI11b7TbpF1-FP9y4fU9AXqzEcj2pFef4UImgHHcOu7RWMYy9xxTaBBXjfIXvyw_JdLVAqRF8agzbqzktkpy7jkNA2tcupQ5o0TodTbVYQ2Il6K692tf7c_7YhhgM8rT9aZTkHJjFjpdGgG6qTMf7FOaA5xw&sai=AMfl-YSXMTKqnCAq7gYXECRUeEPGLsT0PwiFqWKylSjc36WKrtayDWbO4EOOKSLw74CIdC6PuHOHTYhylcel-gdOLPQ1qDn0zGjTza95lXS90VwfkoAfYiSiOe5WW9M&sig=Cg0ArKJSzGcQqDorS-NJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: FDA66AD9C369F8D7721E474B6507A344
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Frame ID: 237598276C4AE2D35D0F38D5DEDF9322
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 8E701DEE884FB867BDB9B52429D16208
Requests: 22 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 7430D9210B3911A9BF70566B46143F07
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: A658D6A801662673E3742123E5E6D890
Requests: 1 HTTP requests in this frame

Frame: https://7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=12
Frame ID: 97A77A6828BF94562FD30745C0AEA64E
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: D08779F1371CBD74F989121AA35E2F26
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: EC1CB6E1E19860BE129344AC2CC1AFB1
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7vZmlD152FEV_0zjvr3vaMg7bWq63e7XWfBnVecRG_USxy80yjvAHB-vebAuY4EDTsXL-oIblBW-tqCsNeHzvZ7EUWjrkvFyQpPxBB3YpXzVQkh94J99WVxtbmdUZRdDNsSZd_wZsuG1SLfpELYHej0bqkpK056SOEpSExzJcB7BRSIOJ1jL0K-116n4Dx2qX60JlMuFou5XSZgJR0pRwxiKnsL4SqZJPomjnBrtne9i7VtEQoxQQlUxjs-yOsTpaSKk9xQnbC1TIvckqBlDfspMbERBwMzss9K0svkcb2warAlMCRMgQY7zztZehY9UZR1YbiOxkw6RTBCjOxTnrPrdGS0C9fS3ubs4Qkzdprfy6NbW19Nt_xk9ffq6-7YN9otkXfiB1PRG4iqZmH_xYrvnRWmdkyeHauDVcYmpLE5HIlgi0W8lKnsvvGUNvSEt7B7btxxgq8A&sai=AMfl-YT8ujtOaD0ifkmAB7AQ04G9YCIxsmkeXwijZxQlqdxeTRjmFMCDYZiE1fOgOQKa0yrqQdSg0AbXd1H3Lu63lTL9GyG6KjHoBFJIc0JI8AXndsLqA1eF8_wDAGU&sig=Cg0ArKJSzL2VkZFbtsLJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 7A265C9087ABDA9337CEE707FA8175DB
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Frame ID: ADBF0655B8AD10E5786C2EDEEE91D64A
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 1F89315CBD9816A0B6240922A01A4109
Requests: 22 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: B4F31C0979BD11B467EBA5686904199A
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 63CE7974E220A46EAC1E8D95B64E6BB1
Requests: 1 HTTP requests in this frame

Frame: https://b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=15
Frame ID: C3FB1F8DC3ACB0EE6C1CFAD818A53236
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 6C98D9227CAB89456CFADB6505FC284A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 4F5027E136320B9ABD48DB3A381F0912
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsLTl6ShrggpSM1-NytZeZtgUWNEgdDGatrAW_Ro5BS0OW1Nfyqu-o5IG6y7rxYotn3O4VmafD5qVVY7RONnDNvks99H3GIPagasTq5LL-LUYHgkqTc2YM1H5yIZ-mqPmhF7b4Osy4Ksc6GbqZ-Ky0umjEBDP7xlvFUnVA7GVolSdUwe8HH3tvpv91b2adjmy1QyeQvftpYPb_CYaMrBouQJchUJfjYiB48AAHQUW_urNhlL6TsbgQq190g6qhtVz3G3HcsknD03k2qnyu-LWxIgxskrgN66FiyKA9UMpSRQzpEp80GZ3LSM3_7bYcq8MI5Lpmf_uKOO8PnEHRtpfDlBf-k3ByeTgTUdQTBar53HgVLgA1P8eaP5wHV_Xx8nGDGGuyT5oR1FX0467DEMXNcdbcM6AVVr9oqs-_lcOb1pfeGtLg35MYYmexUPgqLm0y0c_2ZJ8qUw&sai=AMfl-YTNO0ZyararGpAhoIAEK65Kp_DqXolP-fpaucd_CZE0XeVvSNVC1iMb17HAtVrjQn_wo0Z0BDL7xQG_L38jrtDgCbeUAv9QB_PNUiMqvvjbD-T_TbHhLGvkua0&sig=Cg0ArKJSzDcURXApRP7YEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 464B107D39E7FB2C070267CA3B87AD6E
Requests: 6 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Frame ID: 3AE45D96D64A6D92E31B4DF09DA3B4F5
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 2EF417243AEEDE6540999E8BA995FDC7
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dynamics 365 Customer Voice

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/vue(?:\.min)?\.js

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

360
Requests

93 %
HTTPS

50 %
IPv6

38
Domains

64
Subdomains

55
IPs

5
Countries

3084 kB
Transfer

13900 kB
Size

46
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://re-news.tw/
Title: Exit

Search URL Search Domain Scan URL

URL: https://re-news.tw/renews/168

Search URL Search Domain Scan URL

URL: https://re-news.tw/prnasia/4647990_XG47990_2

Search URL Search Domain Scan URL

URL: https://re-news.tw/creditcard/233069

Search URL Search Domain Scan URL

URL: https://re-news.tw/gbyhn/61537

Search URL Search Domain Scan URL

URL: https://re-news.tw/racingcharger/54444

Search URL Search Domain Scan URL

URL: https://re-news.tw/golike/22753

Search URL Search Domain Scan URL

URL: https://re-news.tw/zocha/664f06a4333c44b7de8afda5

Search URL Search Domain Scan URL

URL: https://re-news.tw/alphaloan/20451

Search URL Search Domain Scan URL

URL: https://youtils.cc/emoji
Title: Emoji

Search URL Search Domain Scan URL

URL: https://youtils.cc/geoip
Title: Geo IP

Search URL Search Domain Scan URL

URL: https://youtils.cc/big5gb
Title: Big5/GB Converter

Search URL Search Domain Scan URL

URL: https://youtils.cc/qrcode
Title: QR Code

Search URL Search Domain Scan URL

URL: https://youtils.cc/length
Title: Length Converter

Search URL Search Domain Scan URL

URL: https://www.comptw.com/
Title: Taiwan Company

Search URL Search Domain Scan URL

URL: https://stockinfo.tw/
Title: Taiwan Stock

Search URL Search Domain Scan URL

URL: https://youtils.cc/wordcounter/zh-Hants
Title: Word Counter

Search URL Search Domain Scan URL

URL: https://youtils.cc/dateCalculator
Title: Date Calculator

Search URL Search Domain Scan URL

URL: https://youtils.cc/lunarCalendar
Title: Lunar Calendar

Search URL Search Domain Scan URL

URL: https://youtils.cc/utm
Title: UTM tool

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 71

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4485239425924787&output=html&h=250&slotname=2784%2F13803&adk=2220942683&adf=3173046724&pi=t.ma~as.2784%2F13803&w=300&lmt=1742842419&url=https%3A%2F%2Freurl.cc%2FXqAx30&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1742842418918&bpp=94&bdt=190&idt=152&shv=r20250319&mjsv=m202503200101&ptt=5&saldr=sd&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&correlator=717394872010&frm=23&ife=4&pv=2&nhd=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1030&ady=108&biw=1600&bih=1200&isw=300&ish=250&ifk=2061651353&scr_x=0&scr_y=0&eid=31091180%2C42532523%2C95344791%2C95356500%2C95356505%2C31088250%2C95355965%2C95355301&oid=2&pvsid=2946935026510602&tmod=956212469&uas=0&nvt=1&fc=640&brdim=640%2C640%2C640%2C640%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=1.r4nih89skft&fsb=1&dtd=205 HTTP 302
https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html

Request Chain 113

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=al6P4crsA3iat7mnNKrhZw

Request Chain 114

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=cQ656sgiB6uKLgZKNKrhZw

Request Chain 138

https://cms.analytics.yahoo.com/cms?partner_id=OneDATA HTTP 302
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA HTTP 302
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA&verify=true HTTP 302
https://onead.onevision.com.tw/v2/pixel/vzn?id=y-X5vTQglE2p9M0YeLJLYu02mxpxuuyH8dkdEqog--~A

Request Chain 139

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://onead.onevision.com.tw/v2/pixel/ltm?id=1dfd8ff382419ff6ace06f240b39cf69

Request Chain 140

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://onead.onevision.com.tw/v2/pixel/ttd?id=b490a08a-66a6-4aa2-8dff-0184c0717707

Request Chain 141

https://ps.eyeota.net/pixel?pid=3m51m51&uid=4d1bba66-08e1-11f0-9211-0242ac120002&t=ajs HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=4d1bba66-08e1-11f0-9211-0242ac120002&t=ajs

Request Chain 188

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=g7j07Mf7CyO_9WmWNarhZw

Request Chain 189

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=xccfBeZHBbOC9iE8NqrhZw

Request Chain 233

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=5cM6QxmsDyG_FqOVN6rhZw

Request Chain 235

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=_UBYu8TuBaCz2pLZN6rhZw

Request Chain 278

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=hdSwcQRQCgiogoxjOKrhZw

Request Chain 279

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=3JAWKQOLDvCupuhNOKrhZw

Request Chain 320

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=L1YUPpNyClO6IAPyOarhZw

Request Chain 321

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=-TRGoMMdArWad_G1OarhZw

360 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request XqAx30 Show response
reurl.cc/ 15 KB
4 KB 638ms
187ms Document
text/html 35.185.130.121
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.130.121 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 121.130.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f4d7d42dbc39cc7838b8ac43f9c9baf89f49202667512fa1e3ed29024a91c501

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 24 Mar 2025 18:53:37 GMT
referrer-policy: no-referrer-when-downgrade
server: nginx/1.18.0 (Ubuntu)
target: https://ecv.microsoft.com/dDTk9Vwh4y
vary: Accept-Encoding Origin
x-request-id: c48af5cb-66a6-46a2-a279-7faf6aebc02e

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/ 152 KB
25 KB 51ms
16ms Stylesheet
text/css 2a04:4e42::485
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/bootstrap.min.css

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"2606e-bhA1SChFSJj9qA9V897LNH/Z7SE"
age: 3413924
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 24 Mar 2025 18:53:37 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230028-FRA, cache-lga21921-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25648
x-jsd-version: 4.3.1

GET
H2 200 style.css
storage.reurl.cc/stylesheets/rwd/ 2 KB
1 KB 40ms
10ms Stylesheet
text/css 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/stylesheets/rwd/style.css?v=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 749079c4e18ad34ac381e98d3fa23e070937ae17b73e27bb066eae5350ed667d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 2231d7f5-0626-4674-88eb-d557f93c8bfc
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
age: 27512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 11:15:05 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=28800
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 904

GET
H2 200 pixel.js Show response
storage.reurl.cc/javascripts/ 429 B
522 B 16ms
10ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/pixel.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 3050a5556edc5876cd83e63f15e56fe19cb428129345a58d1f57687414504698

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 24d1a5dc-4054-4ca0-a115-10bf138c5116
access-control-expose-headers: *, Authorization, X-Authorization
cache-control: public,max-age=28800
age: 9592
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 429
date: Mon, 24 Mar 2025 16:13:45 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/javascript; charset=utf-8
vary: Origin

GET
H2 200 ga2.js Show response
storage.reurl.cc/javascripts/ 536 B
631 B 15ms
11ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/ga2.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 16cf673198b29bb08e83f5d8f74182d97d9c6dfa729c60f90f6195e739de9d20

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: a9b6550e-006b-4bd2-9d00-d74918bdbcba
access-control-expose-headers: *, Authorization, X-Authorization
cache-control: public,max-age=28800
age: 20957
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 536
date: Mon, 24 Mar 2025 13:04:20 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/javascript; charset=utf-8
vary: Origin

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 356 KB
118 KB 97ms
57ms Script
application/javascript 2607:f8b0:4004:c07::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d4474b8452874cfdb506a736b898a56dc90b1ec3aee9cbe81fb6f429307beb4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
content-length: 121095
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 437 KB
141 KB 77ms
38ms Script
application/javascript 2607:f8b0:4004:c07::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f2653c01792aabd651248a7c0e00af87bcc8802bbded85da906a14e11bb197fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
content-length: 144151
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 75ms
37ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H2 200 wrapper.min.js Show response
cpt.geniee.jp/hb/v1/219632/1441/ 12 KB
4 KB 706ms
207ms Script
application/javascript 203.137.133.152
IDCF IDC Frontier...

General

Check archive.org

Download Go to

Full URL: https://cpt.geniee.jp/hb/v1/219632/1441/wrapper.min.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.137.133.152 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 0614ad45d47a5da6d9880c2e175c88526cd223c16d2121e48bab3a9e1121f55d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=3600, private
content-encoding: gzip
etag: W/"67e15db0-2f10"
cross-origin-resource-policy: cross-origin
expires: Mon, 24 Mar 2025 19:53:38 GMT
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Mon, 24 Mar 2025 13:27:12 GMT
server: nginx

GET
H2 200 ad-serv.min.js Show response
ad-specs.guoshipartners.com/static/js/ 50 KB
16 KB 2080ms
188ms Script
application/javascript 168.95.246.2
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 168.95.246.2 Los Angeles, United States, ASN131660 (CHTCDN Data Communication Business Group, TW),
Reverse DNS: 168-95-246-2.hinet-ip.hinet.net
Software: HiNetCDN / OneAD
Resource Hash: 8aad7f034c2e39ee145189b327d6b1df64240486e08c7eba41d399e7e72797a6

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: W/"67dbbf75-c7b9"
age: 0
x-varnish: 79110905
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 20 Mar 2025 07:10:45 GMT
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 onead-lib.min.js Show response
ad-specs.guoshipartners.com/static/js/ 24 KB
7 KB 2080ms
189ms Script
application/javascript 168.95.246.2
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL: https://ad-specs.guoshipartners.com/static/js/onead-lib.min.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 168.95.246.2 Los Angeles, United States, ASN131660 (CHTCDN Data Communication Business Group, TW),
Reverse DNS: 168-95-246-2.hinet-ip.hinet.net
Software: HiNetCDN / OneAD
Resource Hash: 1bf41ca1364230ce3a9cbbac1110ff4d7d287a9f978fa74297aa30117c4da9c0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: W/"67b5a55f-6100"
age: 0
x-varnish: 107515587
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 19 Feb 2025 09:33:19 GMT
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 vue.min.js Show response
cdn.jsdelivr.net/npm/vue@2.5.16/dist/ 84 KB
33 KB 47ms
15ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.5.16/dist/vue.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"151b4-KLsckeN7U/TrtIzkgtzLJAAD4Hg"
age: 909172
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 24 Mar 2025 18:53:37 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230020-FRA, cache-lga21921-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33184
x-jsd-version: 2.5.16

GET
H2 200 renews.js Show response
storage.reurl.cc/javascripts/ 404 B
552 B 39ms
10ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/renews.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 22743d9dc93a38d7096ec7c9a02146da7a721ada15192d87e81d78ff53cb2f2a

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 8e294f4c-c98a-435e-8ee8-a8b9e1093fc7
access-control-expose-headers: *, Authorization, X-Authorization
cache-control: public,max-age=28800
age: 15971
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 404
date: Mon, 24 Mar 2025 14:27:26 GMT
last-modified: Tue, 09 Jul 2024 09:45:35 GMT
content-type: text/javascript; charset=utf-8
vary: Origin

GET
H2 200 loading.js Show response
storage.reurl.cc/javascripts/ 134 B
230 B 40ms
12ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/loading.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: ddd9d29beabaeecc9c76408242dfc2b76305ec52511992d3cfbc81a500ee0670

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: a72e6409-49ae-40c6-be4d-783c7fecc4e1
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
age: 18793
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 13:40:24 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=28800
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 134

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 242 KB
62 KB 38ms
16ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: storage.reurl.cc
URL: https://storage.reurl.cc/javascripts/pixel.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e7bc8cee2dc81120401d7efd046ca7de29edce565de2cf16fbc44ee53d0f5e23

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-FkRpKTqL' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 24 Mar 2025 18:53:37 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-FkRpKTqL' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=23, mss=1232, tbw=4598, tp=9, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: oUvhxwQyW9Fllpd24+qxBmlTfHdtjDxZ1zza0sTK6sNGf3d6tML6495w6vUGZuK8dOKnF3IBtIIvbL65ul3qmw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 63118
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 54ms
17ms Script
text/javascript 2607:f8b0:4004:c1d::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: storage.reurl.cc
URL: https://storage.reurl.cc/javascripts/ga2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
age: 3678
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:52:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 17:52:20 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H3 200 1675200226052423 Show response
connect.facebook.net/signals/config/ 81 KB
18 KB 16ms
16ms Script
application/x-javascript 2a03:2880:f003:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1675200226052423?v=2.9.190&r=stable&domain=reurl.cc&hme=c1f2cecb0bd2e60711f2156ceae0254b57f69ec526dbc6c13633615b2168eda4&ex_m=71%2C124%2C109%2C113%2C62%2C4%2C102%2C70%2C16%2C98%2C90%2C51%2C55%2C178%2C181%2C193%2C189%2C190%2C192%2C29%2C103%2C53%2C78%2C191%2C173%2C176%2C186%2C187%2C194%2C135%2C41%2C199%2C196%2C197%2C34%2C148%2C15%2C50%2C203%2C202%2C137%2C18%2C40%2C1%2C43%2C66%2C67%2C68%2C72%2C94%2C17%2C14%2C97%2C93%2C92%2C110%2C52%2C112%2C39%2C111%2C30%2C95%2C26%2C174%2C177%2C145%2C87%2C57%2C85%2C33%2C74%2C0%2C96%2C32%2C28%2C83%2C84%2C89%2C47%2C46%2C88%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C58%2C63%2C65%2C76%2C54%2C104%2C27%2C77%2C9%2C8%2C81%2C48%2C21%2C106%2C105%2C107%2C99%2C10%2C20%2C3%2C38%2C75%2C19%2C5%2C91%2C82%2C44%2C35%2C86%2C2%2C36%2C64%2C42%2C108%2C45%2C80%2C69%2C114%2C61%2C60%2C31%2C100%2C59%2C56%2C49%2C79%2C73%2C24%2C101%2C115

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:100:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

466b4a6c2c47478a104f80a757d2c06af42c6adfec939b18e7990bc1f6fa5460

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-3dXlpkNX' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-3dXlpkNX' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=78, mss=1232, tbw=72074, tp=69, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: zv/AkqWjQJpykDHGDbbvVR+uDdoMULSnS8KN5IZNMe0Hh6BG4u6khZVdWAGAJL2JzeQydJ2J41uM40LruG/h8Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer: 0
document-policy: force-load-at-top
content-length: 18095
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
385 B 26ms
23ms XHR
text/plain 2607:f8b0:4004:c1d::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1317906616&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2FXqAx30&ul=en-us&de=UTF-8&dt=Dynamics%20365%20Customer%20Voice&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1207857145&gjid=1690469595&cid=1802819371.1742842418&tid=UA-102456694-1&_gid=2042357341.1742842418&_r=1&_slc=1&z=482088747

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 3
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
438 B 16ms
15ms Image
image/gif 2607:f8b0:4004:c1d::65
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1317906616&t=event&_s=2&dl=https%3A%2F%2Freurl.cc%2FXqAx30&ul=en-us&de=UTF-8&dt=Dynamics%20365%20Customer%20Voice&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=pause&ea=3&el=NS4xODEuMjM0LjEzMw&ev=1&_u=IEBAAEABAAAAACAAI~&jid=&gjid=&cid=1802819371.1742842418&tid=UA-102456694-1&_gid=2042357341.1742842418&z=1185543758

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

age: 12770
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 15:20:48 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ 524 KB
164 KB 15ms
15ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 34ms
14ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc&rl=&if=false&ts=1742842418133&sw=1600&sh=1200&v=2.9.190&r=stable&ec=0&o=4252&fbp=fb.1.1742842418129.133581164277613316&cs_est=true&pm=1&hrl=d962bb&ler=empty&cdl=API_unavailable&it=1742842418043&coo=false&cs_cc=1&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=14, rtx=0, c=23, mss=1232, tbw=4373, tp=9, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
192 B 174ms
155ms Image
image/png 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc&rl=&if=false&ts=1742842418133&sw=1600&sh=1200&v=2.9.190&r=stable&ec=0&o=4252&fbp=fb.1.1742842418129.133581164277613316&cs_est=true&pm=1&hrl=d962bb&ler=empty&cdl=API_unavailable&it=1742842418043&coo=false&cs_cc=1&rqm=FGET

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-177RfRVB' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7485451187764204382&cpp=C3&cv=1021190264&st=1742842418204"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: hidMFl1mWzeUkadPvErVi/7UacdykR15YY1xr5bhBlHdgVWF2GLiPT7ym6wYPYex6cIHbyXVsJ2zr6ZBnVaA8A==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7485451187764204382&cpp=C3&cv=1021190264&st=1742842418204", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-177RfRVB' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=23, mss=1232, tbw=5013, tp=13, tpl=0, uplat=140, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 collect
analytics.google.com/g/ 0
0 63ms
25ms Fetch
text/plain 2607:f8b0:4004:c23::66
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je53k0v897965293za200&_p=1742842417946&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109~102887800&cid=1802819371.1742842418&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1742842418&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=page_view&_fv=1&_ss=1&_ee=1&tfd=977
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c23::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to: {"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:137:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 58ms
23ms Ping
text/plain 2607:f8b0:4004:c07::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-N394QBRGC0&cid=1802819371.1742842418&gtm=45je53k0v897965293za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=102482433~102788824~102803279~102813109~102887800
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:112:0
report-to: {"group":"ascnsrsggc:112:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:112:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:112:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame FEAE 0
0 55ms
24ms Document
text/html 2607:f8b0:4004:c17::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-N394QBRGC0&gacid=1802819371.1742842418&gtm=45je53k0v897965293za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102482433~102788824~102803279~102813109~102887800&z=1184303255

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:38 GMT
expires: Mon, 24 Mar 2025 18:53:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 27ms
27ms Fetch
text/plain 2607:f8b0:4004:c1d::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je53k0v9181474282za200&_p=1742842417946&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109&cid=1802819371.1742842418&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1742842418&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1010
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:87:0
report-to: {"group":"ascnsrsggc:87:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:87:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:87:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 128002626 Show response
fundingchoicesmessages.google.com/i/ 196 KB
64 KB 86ms
47ms Script
application/javascript 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/128002626?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

71afc14e1829932d2c76ba5813ef3a39f64c39ed1edf23f119b62ebfcb2a9042

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xtyh523j2QGyS_VoVLpATQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmJw0pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYiFeDg2XWnbzybw4vyltYxKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgbGRsZ6BmbxBQYAGmgsMw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xtyh523j2QGyS_VoVLpATQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ 63 KB
23 KB 19ms
18ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H2 200 AGSKWxUfKM-l2VwUlDjsTLfhG-pXPjv4zZBFL3R8NIvE5L_dbtwuqVAYsF7uy4LnX7HgCC0A4q7x5iLLdzNx2VbcIXgONIa4o-vKn3W0YxiwTuVycN0qfddjJ3IY7Gx_Z1DRWBcuzW8Wqg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 47ms
46ms Script
application/javascript 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUfKM-l2VwUlDjsTLfhG-pXPjv4zZBFL3R8NIvE5L_dbtwuqVAYsF7uy4LnX7HgCC0A4q7x5iLLdzNx2VbcIXgONIa4o-vKn3W0YxiwTuVycN0qfddjJ3IY7Gx_Z1DRWBcuzW8Wqg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODQyNDE4LDQ0OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLG51bGwsW1s4LCJVdjBiVXdSRlhoMCJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.Uv0bUwRFXh0.es5.O/d=1/rs=AJlcJMwELeU25ZBUtQjnSDJ2-o31-N1nxw/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6c5c52c209ca459d0c60b26683a53040eafbb96d0fa5c429564af83c430e928a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zV5M6PX2MuV_l7gWiAN3Og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmLw1JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYiFeDg2XWnbzyaw4-zy54xKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgbGRsZ6BmbxBQYAFpksFw"
content-security-policy: script-src 'report-sample' 'nonce-zV5M6PX2MuV_l7gWiAN3Og' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame C023 0
0 51ms
17ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 108ms
11ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 227521
x-goog-stored-content-encoding: gzip
expires: Sun, 22 Mar 2026 03:41:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sat, 22 Mar 2025 03:41:37 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyIubjrGGNcKZxA_9DTKSBxKddJhKgQKxQNwGYaFk9fhVfCU8bTQYR4sG3gh52fJx-zOF
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 153ms
101ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 2585b648a8dbb9b9fa602c281c754541

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 85ms
32ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b6c5af2d5c532a14b5aa51656c9d5e8be329b1424ec1df2947ad2de309622448

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-a641"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:38 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 72ms
26ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 293955
cf-ray: 92585f5bbb168c8a-EWR
expires: Thu, 27 Mar 2025 18:53:38 GMT
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 183 KB
14 KB 202ms
202ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=835798839463356&correlator=1457221862101378&eid=31091114%2C31091183%2C31091200%2C95355263%2C83321072&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fifs&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C13848%2C18535%2C13856%2C13860%2C14209%2C14210&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6%2C%2F0%2F1%2F7&prev_iu_szs=300x250%2C1x1%7C320x480%2C300x250%2C300x250%2C1x1%7C320x50%7C300x100%7C320x100%2C300x250&ifi=1&didk=3663017418~954026992~3220679602~2335188262~1073006158~4279657583&dids=div-gpt-ad-1692339097859-0~div-gpt-ad-1706005027566-0~div-gpt-ad-1682415009667-0~div-gpt-ad-1682415043506-0~div-gpt-ad-1683598631228-0~div-gpt-ad-1683598657711-0&adfs=1641170635~~3999208325~~4276429512~3230137061&sfv=1-0-41&sc=1&cookie_enabled=1&abxe=1&dt=1742842418471&lmt=1742842418&adxs=1005%2C-9%2C245%2C-9%2C245%2C625&adys=108%2C-9%2C108%2C-9%2C485%2C108&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C-1%7C0%7C-1%7C0%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=380x250%7C0x-1%7C380x250%7C0x-1%7C1140x50%7C380x250&msz=350x250%7C0x-1%7C350x250%7C0x-1%7C1110x50%7C350x250&fws=0%2C2%2C0%2C2%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0%2C0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842417876&idt=372&adks=1451399479%2C4066066610%2C827794272%2C3475397127%2C3271617715%2C3242553145&frm=20&eoidce=1&td=1&egid=34070&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cc946459be42c672452945bcf67119bd6318112ba16b1c205db76e8fe7e2bd1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6690069789,6405456366,6424070779,-2,6499557592,6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138468304473,138452341869,138456634296,-2,138462658624,138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 14548
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 9B4E 0
0 92ms
16ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:38 GMT
expires: Mon, 24 Mar 2025 18:53:38 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 AGSKWxWNYQuoSpjPYvYkOJXTvojQDhcOYpyIIEeRDbFQSsspx8RgyBXBoUm5UDJmNKMbL7CHAQwx9Uft4oTdE7X6gAw7DbtOiSflKRSkcRsUWK-MCRMyD08XeJoSmQ8HO0H3sQGGTcUPRg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 49ms
48ms Script
application/javascript 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWNYQuoSpjPYvYkOJXTvojQDhcOYpyIIEeRDbFQSsspx8RgyBXBoUm5UDJmNKMbL7CHAQwx9Uft4oTdE7X6gAw7DbtOiSflKRSkcRsUWK-MCRMyD08XeJoSmQ8HO0H3sQGGTcUPRg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODQyNDE4LDUwMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcmV1cmwuY2MvWHFBeDMwIixudWxsLFtbOCwiVXYwYlV3UkZYaDAiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0998d6382acb0f6e138b52627326cf92925e5ad7ffa4fdf1e9671fb9b000d1f0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rIeibXmSJk7tszssD3aMuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjctDikmLw1ZBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIhXg4Nl1p288msOLtk3-MShpJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalF8UYGRqYGxkbGegZm8QWGAFrhMZA"
content-security-policy: script-src 'report-sample' 'nonce-rIeibXmSJk7tszssD3aMuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 syncframe
gum.criteo.com/ Frame 2BB9 0
0 50ms
16ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:38 GMT
server: Kestrel
server-processing-duration-in-ticks: 364347
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 yads-async.js Show response
yads.c.yimg.jp/js/ 210 KB
58 KB 1514ms
393ms Script
text/javascript 182.22.28.252
YAHOO Yahoo Japan...

General

Check archive.org

Download Go to

Full URL

https://yads.c.yimg.jp/js/yads-async.js

Requested by

Host: cpt.geniee.jp
URL: https://cpt.geniee.jp/hb/v1/219632/1441/wrapper.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.22.28.252 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

Resource Hash

e7e4fb9b3b1239835abc60fd16d2e64da36bfa919b8e81f11eea442c2bbf05f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "fad34f610280b86070657d734b70d7bc"
age: 18
x-content-type-options: nosniff
date: Mon, 24 Mar 2025 18:53:21 GMT
content-type: text/javascript
last-modified: Tue, 18 Mar 2025 07:38:44 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: public, max-age=600, stale-while-revalidate=1200
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
x-amz-request-id: 27e54605-9848-4633-8bfb-ec081033dacb
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
accept-ranges: bytes
content-length: 58654
x-xss-protection: 1; mode=block
x-amz-server-side-encryption: AES256

GET
H2 200 gnshbrequest-v4.23.3.js Show response
cpt.geniee.jp/hb/v1/lib/ 181 KB
66 KB 398ms
398ms Script
application/javascript 203.137.133.152
IDCF IDC Frontier...

General

Check archive.org

Download Go to

Full URL: https://cpt.geniee.jp/hb/v1/lib/gnshbrequest-v4.23.3.js
Requested by: Host: cpt.geniee.jp
URL: https://cpt.geniee.jp/hb/v1/219632/1441/wrapper.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.137.133.152 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: bc73ed340ef20534b613afea9bd95f199a55b77beab7c472e92ad92b4e39a1aa

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, private
content-encoding: gzip
etag: W/"67d140eb-2d3d7"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:38 GMT
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Wed, 12 Mar 2025 08:08:11 GMT
server: nginx

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CEAF 0
0 32ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvoyXHhm5QoYX_75Aqen0RMO5xNIxNCoCw9W7J4LHXuw4vYcVpclStePNM5ma0krRbFpf7GmuJBJvi_xftFKPKOI4467ptnIdjHKVFviv9iICJ5S-Bh7JEjzQDJLWA-ZLqbLzMTEDhjdh0DzfOPyK5LLC3AbGJZcxhPuRJl4t4mcKOvmbAmg07gd2ZMuLuGCkoGNHSBURrt0qH3Ny3yFFyLXmP_IrOJn4weDxZrpGK0z1U3rPFdyfI08ZfKvKIieSxt9pEepMUAq-02_vNOnQZEJo_ODSRnF4tKa7dgtRUyZZluwetUf29n3NmFP1lgcfrEQfpEzhl9EwkzTbES4-bUpl4qTSu4MoqJpE3Ojjg7fIM3V2lV7hrDp2IR8wDwHTSbN8iXmDvHyM2ZDYT4lVWA6W-11MhxXK_hQITUx9N3H6TngxF9QfmjEA&sai=AMfl-YSeXGjrqxUC1UBkNXh3DPicNuqSuvKWl0VrEmTQuu1JEG-Y5lxbBgZaUdGBcjZw2V2ZqS9_tZYv1BJ8G4G0IOx9N1Xx3YXIqnRGOAzgPRM-lzLOK8GtMb40q6I&sig=Cg0ArKJSzGkEpg9SzlMJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame CEAF 40 KB
15 KB 71ms
37ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

154756d9ef9ccda08301e80b17ea39290072b0fc20a78c42a53a0a5ba69fb44e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 16868129732672992835
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 15183
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CEAF 218 KB
67 KB 50ms
16ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A1D2 0
0 31ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvVlh_-jfIFeiSJBKUgsmSsh7vxa55Pyoaib3gEhX04iq7H5AhgFP5IIWqeJVWEZY4B3gcL1Fgmr83juzcop66cmW6ep-JKvysdFlQ1cXg1_Ef0xMLX6A4yj0iCuKcOcLMrVVXoQfOoM3qZBvYsACveWuJC_6kBpT7VdEnfv2Q1RCkEJKWsxkYM22RIyqi1z_ZroUZvraUwMU3eVB4OuW4iaC50deHScXSRNNkAAL3kGeorntBwi6J1J1niF-RY4awdVB9k3rZPbIAodsgy37eauux91jbCzkhBNPjMlFaLdI-0Kz5CC72twdxSgjjn8hgCWUi1IznNlhG8KVpctxWFnvK2V-DqG8Y6GDKg5FskuNLqpUJv10GBFLFIW-aFuQr4W2DGCKqAAh0rsdNhORjLC8ZbSw_rwDL4WCCeejoHaHDZmtGvdBzoBQ&sai=AMfl-YReXAc2OijSPyKDq3iEiiRIcAiZ_OPmRsm61t896_MSI4Egb1nKsCmYI00nD29bRRnFlNjXdxrYguVfp1WDlla6sSOMadJq8jIwUJEiAVtn38eX_kXATi7c8Gc&sig=Cg0ArKJSzBDzLQ9Ek3-HEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK cf_reurl_tw_gam.js Show response
api.popin.cc/searchbox/ Frame A1D2 129 KB
37 KB 737ms
342ms Script
text/javascript 119.63.193.220
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.193.220 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: cd0db2d68f6fb00e1197e823f47e1f53aa2aa2ae85228a5e5d04a4a863629cc1

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Content-Encoding: gzip
ETag: W/"84c303c8957ac66aa38f2a88e2291b99"
x-amz-version-id: u2A0lYWFB7No0ZP_ZBKUcX5kfrhgSMHf
Expires: Mon, 24 Mar 2025 19:53:39 GMT
Date: Mon, 24 Mar 2025 18:53:39 GMT
Last-Modified: Wed, 19 Mar 2025 07:07:58 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
Transfer-Encoding: chunked
X-Cache-Status: HIT from 10.252.55.25
x-amz-replication-status: PENDING
Cache-Control: max-age=3600
Timing-Allow-Origin: *
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Server: nginx
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame A1D2 218 KB
0 40ms
40ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B65A 0
0 32ms
32ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfMLdO8EJnViJDeaJmEhgwek5nJrJ27KH62yMKRmunOVEI4k2B3zfigAzYHdvIXrjlwf2Pr7vT1NYb6uZhGi1bFRGctPkuJSHr6M_-XJHJvQBZ0RIqzoR8cYjH9JX-GM3hxeFTw3q5F5sOomjAvnU6hc3UJXaAvy-AreD6Y1g3P3yTlxXFAVAjprSVyBY2ZvIoW92KUvaV4cL2BeeetfKRibLL8z1qMMQC2Phxo5Nu3rF9t_QepkbEEBifD5aIg9iagPIf8wbh6kpliNtuHjSJ1eXIxxVIeo3CvnXN0Y9fDg_GllCp0V84rygCuTy6GNAY4fLrgzALPAMlL80BmQysAKwbP-Y1naZNvPswcokPT9FhvCIAmGIKrsLA8aLK2vlNgHtvRs-8DCUQdHxiIYSrqjmAauV1PsaXGrylcSpmIA0bFHyyUb5NzJEiM9Xj2rQ&sai=AMfl-YQPloFEkVoV7-EVRCwcDc7Y4lEtdX0ctQZf_O8oWUdEQQBOtdp7IemXAX0KG-yYUYNZHQg1eLosR757PwQABEtIHawIm6NxYE_sNp7ZXzzWUXp-qKgC1N1Wcao&sig=Cg0ArKJSzLOgm8-LoPQ8EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame B65A 9 KB
10 KB 189ms
19ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame B65A 218 KB
0 32ms
32ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B401 0
0 32ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvygvWsUSWBPeUhgs_LyhGhO60HFcUcHYMjML3eiomjwp6dTasw22xFSThSgOfwQSeNZWnqEDace3L3XCl_X1cqd0WEa6SBFYY94KwqFlAtGFwwT-LoDmPVPs9gY6iqw_NwPabIZgQXDSAojzIdk-5hQZlExtODb7-udwR7UHtSwwfs6mNSuIOYLhOGXI8asQzzhZZPEvB8QjDO2cKNE4d43lCapa5HLg5UsveixdmjWLpxCIl7fs0zs_cVyNnZEXZR-bO_UnptRV77wYSc0X108Lsau_Cc9jH8c6-NElAj8zXeud69ao_t-x7BAS_4OcNfkyfEBMNtrDse9NCnqeDAApRnzMXe_NUR2OOTgXbeXVD34wtTmSSd1-ogBucR8NVKAIcFGkgSHpA_7h1pdFapv_BsNtz7yQHOcfbzbyCpS4rZzuue_QS7CHiIH0ZfpMI&sai=AMfl-YS19EpyDoOz-44wizUzeEmTJf0USZ4RPMkay_2oV5ehBXXfm0adwy6bQMqSrQVgsfFSvKsofFVqLTSk2RSR9rRmziTO-DsawtFXKRhK_Og2u_ndVrdvr-xzicc&sig=Cg0ArKJSzDAPpuFb8HkZEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame B401 9 KB
0 180ms
180ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame B401 218 KB
0 24ms
24ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B401 0
0 32ms
30ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A1D2 0
0 24ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame A1D2 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f984bf1d0a76c530de4d80f2c0fb361c90e3bc2aee68d6ea0b2f26f9a2341c97

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B401 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8af9b1ee62f973942149a71cabed6fd4c0ece937718e342101e64e36d36e4248

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B65A 0
0 28ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame CEAF 185 KB
59 KB 41ms
40ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5f6e07c77e56473c5efd8938f520c776b82ea12baead9671524cd8e44836b13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 17384331678090413260
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 60673
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CEAF 0
0 24ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B401 0
0 23ms
22ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A1D2 0
0 46ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B65A 0
0 69ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame CEAF 211 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5b5acd745767a417e4bc397709b7e224ffcbe056b2e84f52eaac884edd02eab7

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B65A 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 356e1291f3462c7ddfe39513724f1c43cabf924d12f2f0b519507bbd3f2a81e7

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CEAF 0
0 82ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 7EBF 0
0 42ms
16ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 5
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: IB56AfQQtv0XvXSy939FBQMDl7nYGhHiCBDhpPyY3EMdRtyihiLqLA==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 9007 11 KB
11 KB 467ms
467ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 12EE 0
0 26ms
26ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 5
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: IB56AfQQtv0XvXSy939FBQMDl7nYGhHiCBDhpPyY3EMdRtyihiLqLA==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame F25F 11 KB
0 451ms
451ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/ Frame CEAF 501 KB
160 KB 16ms
16ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8e9318c3c4d4267ff19a29ff8e36700e7e2b9de1dc992191a6e7157c4b97924

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 16655410260656470125
age: 30740
x-content-type-options: nosniff
expires: Mon, 07 Apr 2025 10:21:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 10:21:19 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 163372
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CEAF 0
0 32ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstmcNgFM-4br_yEtvX7rvFXfK8caqAsI79Bdf0hxntslMOhQV-PcpuTdmw93vyqNhc8LDCzc39MfdwYvqn_Pe0T4I5ryLektcxFX5ylOVmBOTOSpdob8oCkSVgrrq1oHQIAoIKYNvZdgKhAq4OiwO4ifk01RYOiBdq8IgFZFMHhCWEJl3nHxrE5CutZqsrPJiO_yq9zUmLMgP5hnnB9rsBeOydP9w-RiRcc9dVi8CHBk1idYxFMsGLYbogovmtlUJgyp-ckkJvaPELg6d0iZcIEgK8HmnrcSwhv00rkxmvQvXJHIepnScoogobpyo7V8LX7sEwCCiUIs60E40ZUjb6elbeGsRdUN2DLIm_qOkcN6HvD3-ntdQoiyafC4pfgvt80pFCVvsfHAaQD8TxzFEMRTorNu5G2-mCLJ1ZxApvLlEFzFwrxxs_M-lfa&sai=AMfl-YTSdOlCvxU23HT4oyjbmPUPETO9fGtdxUKGyNkLqpYfFeqDZqmlZ6ckwk88-4y22O0IKr8UstTLko4EdTJqFyzSkFWz34wXJdAOis9BVA9YUI8dp8qDpODdE2k&sig=Cg0ArKJSzHpm0l_xY0NvEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20250319/r20190131/ Frame 2F0C 0
0 48ms
15ms Document
text/html 2607:f8b0:4004:c1f::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20250319/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

age: 58915
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4228
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 02:31:44 GMT
etag: 2080659458937595761
expires: Mon, 07 Apr 2025 02:31:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

404

DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html
adx.holmesmind.com/adx-file/20220715/ Frame F22B
Redirect Chain

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4485239425924787&output=html&h=250&slotname=2784%2F13803&adk=2220942683&adf=3173046724&pi=t.ma~as.2784%2F13803&w=300&lmt=17428424...
https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html

0
0

44ms
18ms

Document
application/xml

2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

age: 4
content-type: application/xml
date: Mon, 24 Mar 2025 18:53:35 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: 1_3URiGaMEs4c22dAedmP-UVaGU1kV9a1-AUaM5xd1l5kVcevcuhZg==
x-amz-cf-pop: IAD12-P3
x-cache: Error from cloudfront

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
location: https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame CEAF 17 KB
13 KB 61ms
33ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250319&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41adb3d78536e2e60085bf89e09aaec01a8ce5d471c8464215bea5bbec834091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13086
date: Mon, 24 Mar 2025 18:53:39 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame CEAF 18 KB
7 KB 55ms
16ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H3 200 adriver Show response
fundingchoicesmessages.google.com/f/AGSKWxWQhNTkik6hqfUQa6_D1oc8KmB6L8yTgQtXBiUsJPWAb6hBI3AZ6HS0ArcS3YAhlcwsR7xnU4zOGPQNfVsJiUDujRY8PCD1emgfT9CetixQRZXpYMHhLpxe-Wa2hagM1ZSkl57BAypDZofH_BgHTyZWgjVKQ... 54 B
109 B 32ms
31ms Script
application/javascript 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWQhNTkik6hqfUQa6_D1oc8KmB6L8yTgQtXBiUsJPWAb6hBI3AZ6HS0ArcS3YAhlcwsR7xnU4zOGPQNfVsJiUDujRY8PCD1emgfT9CetixQRZXpYMHhLpxe-Wa2hagM1ZSkl57BAypDZofH_BgHTyZWgjVKQVPs_G2xdHklors0iInzcz0BkqPPKv_y/_/shared/ad_/flashad3./crossdomainads./brightcovead./adv/adriver

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.Uv0bUwRFXh0.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwELeU25ZBUtQjnSDJ2-o31-N1nxw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c6702331c81284a2109563f8711b4da9c155e68ae086edd8e0168f534616a435

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-9vT-m9Qq-CH3WJ5l4dG8QQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmII1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYiFeDg2X2nbzybQcXZiI6OSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGxkbGegVl8gQEA_MErdg"
content-security-policy: script-src 'report-sample' 'nonce-9vT-m9Qq-CH3WJ5l4dG8QQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 250 KB
79 KB 16ms
15ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.Uv0bUwRFXh0.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwELeU25ZBUtQjnSDJ2-o31-N1nxw/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

683d63e065c7f1f8d25da805bf920d2878570d165cd4f242aef222a2cd052b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 1608017097826651892
age: 981
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:37:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:37:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80657
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 55ms
35ms XHR
text/html 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Tqy7hzPxqjmRDYzLsrGsSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw15Bi-FB_mfUHEAvxcGy-0rafTWDD25udjEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDYyFjPwDy-wAAAc90krg"
content-security-policy: script-src 'report-sample' 'nonce-Tqy7hzPxqjmRDYzLsrGsSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame DF89 0
0 489ms
15ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 9AEE 0
0 528ms
35ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 policy-check Show response
cpt.geniee.jp/hb/v1/ 12 B
162 B 521ms
174ms XHR
application/json 203.137.133.152
IDCF IDC Frontier...

General

Check archive.org

Download Go to

Full URL: https://cpt.geniee.jp/hb/v1/policy-check?loc=https%3A%2F%2Freurl.cc%2FXqAx30&list_id=mid-219632&gam_id=gam-424536528%2Cgam-0
Requested by: Host: cpt.geniee.jp
URL: https://cpt.geniee.jp/hb/v1/lib/gnshbrequest-v4.23.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.137.133.152 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 3108e15dfc911f1a730106ee1e44c941639e0b7add838d095680425e86d086c3

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: *
cache-control: max-age=10800, private
content-length: 12
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: application/json
server: nginx
cross-origin-resource-policy: cross-origin

POST
H3 204 AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 32ms
31ms XHR
text/html 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-aUgYLp4q3MRdyY3xvreUNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAvxcGy-0rafTeDHnNNTGJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGxkbGegXl8gQEAbgUkmw"
content-security-policy: script-src 'report-sample' 'nonce-aUgYLp4q3MRdyY3xvreUNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 31ms
29ms XHR
text/html 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-k0XBL0TbWJMXlwGI1UkSRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw1ZBi-FB_mfUHEAvxcGy-0rafTaDhStcsRiWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamBsZKxnYB5fYAAATxQkLQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-k0XBL0TbWJMXlwGI1UkSRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 33ms
31ms XHR
text/html 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUd-HUbzNeRZdd6hXWAcg6LeJup0a3WWhp_w6rSKRzU_6tGJwiaggY_akbWIaI56oX9UzERWP8KSN1PTWpxuZvL57GQQ0kq7lIKwCEjsJSza-i5MuAnMPaXfwG9y0ST2fjkO0B_bg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dxOPenz59DKYIL3BWkBXzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII0pBi-FB_mfUHEAvxcGy-0rafTeDHhL2zGJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGxkbGegXl8gQEAbv8kmQ"
content-security-policy: script-src 'report-sample' 'nonce-dxOPenz59DKYIL3BWkBXzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxWjxC17N0DnRBQ1KXf5GTWK3JzVfh5xnx5I-Oq1AV87w5nKKiwx7ONHXQCiyVk8MGWkSesHeh30O8O_CF-XKgyqIjBG7EINuMr3Ddzui_ScLgzOfAgnOn35a4s176PwEV5z6Y9VFw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 38ms
37ms Script
application/javascript 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWjxC17N0DnRBQ1KXf5GTWK3JzVfh5xnx5I-Oq1AV87w5nKKiwx7ONHXQCiyVk8MGWkSesHeh30O8O_CF-XKgyqIjBG7EINuMr3Ddzui_ScLgzOfAgnOn35a4s176PwEV5z6Y9VFw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODQyNDE5LDMwNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLG51bGwsW1s4LCJVdjBiVXdSRlhoMCJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab2487bc853dc41b472be1d0b2695310c8945fd79bc0c6da93fea72f3c4a9573

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-whMYQCy3UuZ7BX0Hv3vfDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmJw1ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYiFeDg2X2nbzyawYPLCuYxKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgbGRsZ6BmbxBQYA-HUrcg"
content-security-policy: script-src 'report-sample' 'nonce-whMYQCy3UuZ7BX0Hv3vfDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame F25F 2 KB
795 B 667ms
203ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame F25F 30 KB
30 KB 514ms
514ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 9007 7 KB
1 KB 368ms
204ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14209
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 43a71fb6e8f61126f7dfb3fe8a1a01eba8cfbff5cd7d681bba0e62f64ad924c7

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 9007 30 KB
0 218ms
218ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST
H3 204 AGSKWxU47dqHFxYvnLN6M6WMBSf_Sza5WdCj_P0cIBLZryD9LH4WXWvIWoMRu5rufefS-_K0j9mW8Xam3mnyJMS1vCKcMKU9Udq5cw1-SAaZo5LymYQtwZCboh4UezyRE-1RnEy81oWF6g== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 35ms
34ms XHR
text/html 2607:f8b0:4004:c09::64
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU47dqHFxYvnLN6M6WMBSf_Sza5WdCj_P0cIBLZryD9LH4WXWvIWoMRu5rufefS-_K0j9mW8Xam3mnyJMS1vCKcMKU9Udq5cw1-SAaZo5LymYQtwZCboh4UezyRE-1RnEy81oWF6g==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::64 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0ShqGgR7FYRl2hb8ElNoWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw0JBi-FB_mfUHEAvxcGy-0rafTeDGtWm_mJRckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRqYGxkbGegXl8gQEAg0Mk5w"
content-security-policy: script-src 'report-sample' 'nonce-0ShqGgR7FYRl2hb8ElNoWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK td_js_sdk_171.js Show response
api.popin.cc/ Frame A1D2 68 KB
16 KB 343ms
343ms Script
application/javascript 119.63.193.220
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://api.popin.cc/td_js_sdk_171.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.193.220 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 3402df1af7b8665c51ac7e2d4fed5dc6cac147d61966672d9cf32a34acafedfe

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Transfer-Encoding: chunked
X-Cache-Status: HIT from 10.252.55.25
Cache-Control: max-age=3600
Timing-Allow-Origin: *
Content-Encoding: gzip
ETag: W/"d7d7ebc58d77dc27a2c068acdf41021d"
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Expires: Mon, 24 Mar 2025 19:53:39 GMT
Date: Mon, 24 Mar 2025 18:53:39 GMT
Last-Modified: Tue, 28 May 2024 09:22:02 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Server: nginx
x-amz-server-side-encryption: AES256

GET
H2 200 recommend Show response
tw.popin.cc/popin_discovery/ Frame A1D2 689 B
893 B 607ms
215ms Script
application/javascript 119.63.198.189
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://tw.popin.cc/popin_discovery/recommend?mode=new&url=https%3A%2F%2Freurl.cc%2FXqAx30&&device=pc&media=reurl.cc&extra=windows&agency=popinag&topn=50&ad=10&r_category=all&country=tw&redirect=true&uid=de8fe32331a4d603d731742878419835&info=eyJ1c2VyX3RkX29zIjoiV2luZG93cyIsInVzZXJfdGRfb3NfdmVyc2lvbiI6IjEwLjAuMCIsInVzZXJfdGRfYnJvd3NlciI6IkNocm9tZSIsInVzZXJfdGRfYnJvd3Nlcl92ZXJzaW9uIjoiODguMC40MzI0IiwidXNlcl90ZF9zY3JlZW4iOiIxNjAweDEyMDAiLCJ1c2VyX3RkX3ZpZXdwb3J0IjoiMzAweDI1MCIsInVzZXJfdGRfdXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIEhlYWRsZXNzQ2hyb21lLzg4LjAuNDMyNC4xOTAgU2FmYXJpLzUzNy4zNiIsInVzZXJfdGRfcmVmZXJyZXIiOiJodHRwczovL3JldXJsLmNjL1hxQXgzMCIsInVzZXJfdGRfcGF0aCI6Ii9YcUF4MzAiLCJ1c2VyX3RkX2NoYXJzZXQiOiJ1dGYtOCIsInVzZXJfdGRfbGFuZ3VhZ2UiOiJlbi11cyIsInVzZXJfdGRfY29sb3IiOiIyNC1iaXQiLCJ1c2VyX3RkX3RpdGxlIjoiIiwidXNlcl90ZF91cmwiOiJodHRwczovL3JldXJsLmNjL1hxQXgzMCIsInVzZXJfdGRfcGxhdGZvcm0iOiJMaW51eCB4ODZfNjQiLCJ1c2VyX3RkX2hvc3QiOiJyZXVybC5jYyIsInVzZXJfZGV2aWNlIjoicGMiLCJ1c2VyX3RpbWUiOjE3NDI4NDI0MTk4MzcsImZydWl0X2JveF9wb3NpdGlvbiI6IiIsImZydWl0X3N0eWxlIjoiIn0=&alg=ltr&uis=%7B%22ss_fl_pp%22%3Anull%2C%22ss_yh_tag%22%3Anull%2C%22ss_pub_pp%22%3Anull%2C%22ss_im_pp%22%3Anull%2C%22ss_im_id%22%3Anull%2C%22ss_gn_pp%22%3Anull%7D&callback=_p6_9e82b6555a3e
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.189 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: fdcb21ac3668fc76876634684b5d8eb7caf582058b60e452575201bb1b8e88f1

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-length: 689
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript;charset=UTF-8
server: nginx/1.13.5
cross-origin-resource-policy: cross-origin

GET
H2 200 track.js Show response
ad.tagtoo.co/media/ad/ Frame A1D2 7 KB
2 KB 61ms
11ms Script
text/javascript 34.111.12.34
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad.tagtoo.co/media/ad/track.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.12.34 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 34.12.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 80279f6baf172b794e35da391ac30711c57a3276abda4280d170920df9cca9b1

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type,Access-Control-Allow-Origin
content-encoding: gzip
x-goog-hash: crc32c=wTuGGA==, md5=5ROst+pHZlGo3jXf0Ga7EA==
etag: "e513acb7ea476651a8de35dfd066bb10"
age: 2171
x-goog-stored-content-encoding: gzip
expires: Tue, 08 Apr 2025 18:17:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 1810
date: Mon, 24 Mar 2025 18:17:28 GMT
last-modified: Thu, 20 Mar 2025 09:18:49 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvZOteoGKtLDb730ZFe69SNR1tVpWq9rlJAisvfEwtm1AixhXjqdw5MpwwScsmjLtZHjK5T5_Y
cache-control: public, max-age=1296000
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1742462329152868
content-length: 1810
server: UploadServer

GET
H2 200 tuec.js Show response
uec.tagtoo.co/ Frame A1D2 10 KB
4 KB 47ms
10ms Script
application/javascript 34.107.150.21
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://uec.tagtoo.co/tuec.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.150.21 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 21.150.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 698fe0a6500f771d98d1ca713a5445d523fac649207572b69123699702854c0b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=IxwxIw==, md5=L6Ez21DNgdh7j/uHKaarNQ==
etag: "2fa133db50cd81d87b8ffb8729a6ab35"
age: 1188
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 3770
date: Mon, 24 Mar 2025 18:33:51 GMT
last-modified: Tue, 12 Dec 2023 09:08:46 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIuEF_ltCde6St3UQdu1v6odJiJcdXRZLxuDyseqgmrulCLhrNwfpGL80kkzdd_OVzie1xI1eo8
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
x-goog-generation: 1702372126688115
content-length: 3770
server: UploadServer

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame A1D2 5 KB
3 KB 615ms
200ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H/1.1 200
OK popin_discovery5-min.js Show response
api.popin.cc/ Frame A1D2 156 KB
43 KB 675ms
341ms Script
application/javascript 119.63.193.220
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://api.popin.cc/popin_discovery5-min.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.193.220 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 46e977bd2e693545c10424af0ca8ae2061ce096d8e5658d997fa9ca60471e26d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Content-Encoding: gzip
ETag: W/"51910bb1cd9873a17caea8588a900e56"
x-amz-version-id: MCe3oXQalSYt2eLBNz01lVj92TQAzYxl
Expires: Mon, 24 Mar 2025 19:53:40 GMT
Date: Mon, 24 Mar 2025 18:53:40 GMT
Last-Modified: Mon, 24 Mar 2025 06:26:46 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Transfer-Encoding: chunked
X-Cache-Status: HIT from 10.252.55.25
x-amz-replication-status: PENDING
Cache-Control: max-age=3600
Timing-Allow-Origin: *
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Server: nginx
x-amz-server-side-encryption: AES256

GET
H2 200 discoverylogs
log.popin.cc/log/popin_media/ Frame A1D2 66 B
223 B 555ms
173ms Image
image/jpeg 119.63.198.143
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://log.popin.cc/log/popin_media/discoverylogs?data=eyJ0eXBlIjoxNCwidWEiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBIZWFkbGVzc0Nocm9tZS84OC4wLjQzMjQuMTkwIFNhZmFyaS81MzcuMzYiLCJhcGlfaG9zdCI6InR3LnBvcGluLmNjIiwiZGV2aWNlIjoicGMiLCJtZWRpYSI6InJldXJsLmNjIiwidXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJsb2MiOiJodHRwczovL3JldXJsLmNjL1hxQXgzMCIsInRkX29zIjoiV2luZG93cyIsInRkX3VzZXJfYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBIZWFkbGVzc0Nocm9tZS84OC4wLjQzMjQuMTkwIFNhZmFyaS81MzcuMzYiLCJ0ZF9vc192ZXJzaW9uIjoiMTAuMC4wIiwidGRfYnJvd3NlciI6IkNocm9tZSIsInRkX2Jyb3dzZXJfdmVyc2lvbiI6Ijg4LjAuNDMyNCJ9&t=1742842419839
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.143 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: 654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5e186130-42"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 66
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/jpeg
last-modified: Fri, 10 Jan 2020 11:34:08 GMT
server: nginx/1.13.5

GET
H2 200 discoverylogs
log.popin.cc/log/popin_media/ Frame A1D2 66 B
223 B 511ms
173ms Image
image/jpeg 119.63.198.143
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://log.popin.cc/log/popin_media/discoverylogs?data=eyJ0eXBlIjoxNSwicGFyYW0xIjowLCJhcGlfaG9zdCI6InR3LnBvcGluLmNjIiwiZGV2aWNlIjoicGMiLCJtZWRpYSI6InJldXJsLmNjIiwidXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ1aWQiOiJkZThmZTMyMzMxYTRkNjAzZDczMTc0Mjg3ODQxOTgzNSIsInRkX3RpdGxlIjoiIiwiZXh0cmEiOiIiLCJpbnRlcmFjdGlvbl9udW1iZXIiOjAsInBvcGluX3ZlcnNpb24iOjYsInRkX29zIjoiV2luZG93cyIsInRkX29zX3ZlcnNpb24iOiIxMC4wLjAiLCJ0ZF9icm93c2VyIjoiQ2hyb21lIiwidGRfYnJvd3Nlcl92ZXJzaW9uIjoiODguMC40MzI0IiwidGRfdXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIEhlYWRsZXNzQ2hyb21lLzg4LjAuNDMyNC4xOTAgU2FmYXJpLzUzNy4zNiJ9&t=1742842419842
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.143 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: 654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5e186130-42"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 66
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/jpeg
last-modified: Fri, 10 Jan 2020 11:34:08 GMT
server: nginx/1.13.5

GET
H2 200 0.js Show response
ecs.tagtoo.co/js/ Frame A1D2 201 KB
56 KB 69ms
11ms Script
text/javascript 34.102.218.41
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ecs.tagtoo.co/js/0.js
Requested by: Host: ad.tagtoo.co
URL: https://ad.tagtoo.co/media/ad/track.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.218.41 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 41.218.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: ed1353670cbe52a301571e6717fab543726f43f7bed2edd0ffca2e74f6a1d8bf

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type, Access-Control-Allow-Origin
content-encoding: gzip
x-goog-hash: crc32c=2mAcSQ==, md5=ijKbxOP20q6Aq4WlmoGeCA==
etag: "8a329bc4e3f6d2ae80ab85a59a819e08"
age: 3345
x-goog-stored-content-encoding: gzip
expires: Mon, 24 Mar 2025 19:27:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 56322
date: Mon, 24 Mar 2025 17:57:54 GMT
last-modified: Fri, 14 Feb 2025 14:16:26 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItH3W1anyk0Va2SLmv56ejWCBVJUE517uiCk44VGLpxMCDauT4USeodZxOLpd4mfcmDFU2QT4M
cache-control: public, max-age=5400
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1739542586669957
content-length: 56322
server: UploadServer

GET
H2 200 oid Show response
onead.onevision.com.tw/v2/et/ 372 B
980 B 364ms
206ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://onead.onevision.com.tw/v2/et/oid?cb=window.text_etag_callback_1wncs
Requested by: Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: fa26861b2c0ce3230e2337b5dd41c5801c9683ba0c1cd13c60fa1f9509648146

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
etag: 4d1bba58-08e1-11f0-9211-0242ac120002
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 156587663
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Mon, 24 Mar 2025 18:53:40 GMT
cache-control: max-age=600
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 372
x-onead-backend: onead-http-event-d11z-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 page.php
www.facebook.com/plugins/ Frame B2B3 0
0 157ms
144ms Document
text/html 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-KXtDCXSz' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-KXtDCXSz' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:40 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7485451196974230761&cpp=C3&cv=1021190264&st=1742842420099"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7485451196974230761&cpp=C3&cv=1021190264&st=1742842420099", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=17, rtx=0, c=23, mss=1232, tbw=4905, tp=11, tpl=0, uplat=126, ullat=0
x-fb-debug: nE54ZoqmRllKowqWMBuqWBTSrnFOOhzXJcoDehwsiWzJFx2RXidbpt+9tldJp+A7DVVCddJB9Jd04BMMIaD9/A==
x-xss-protection: 0

GET
H2 200 feeds Show response
re-news.tw/ 6 KB
7 KB 152ms
15ms XHR
text/html 34.160.26.175
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://re-news.tw/feeds
Requested by: Host: storage.reurl.cc
URL: https://storage.reurl.cc/javascripts/renews.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.26.175 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 175.26.160.34.bc.googleusercontent.com
Software: / Express
Resource Hash: c280d38004a82811e8659f68bbd6dc8dde7f7c6a95d3172d7ddec4acf8c96d6f

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: public,max-age=3600
etag: W/"19c2-9Jo9tz+a9s2SjM8/XubeyhnT+f4"
age: 3375
via: 1.1 google
access-control-allow-origin: https://reurl.cc
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6594
date: Mon, 24 Mar 2025 17:57:25 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
vary: Origin

GET
H3 200 /
www.facebook.com/tr/ Frame A1D2 0
16 B 21ms
21ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?eid=1742842420058&id=404012299753340&ev=PageView&dl=https%3A%2F%2Freurl.cc%2FXqAx30&rl=https%3A%2F%2Freurl.cc%2FXqAx30&if=true&ts=1742842420057&sw=1600&sh=1200&v=2.9.44&r=stable&fbp=fb.1.1742842418129.133581164277613316&it=1742842420049&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=13, rtx=0, c=27, mss=1232, tbw=9489, tp=20, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CEAF 42 B
65 B 29ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssWEMqw9PATpdbPAXSunwLo30otgLR5qDgS0Qi3UBDzq_LJVC5sRrfZNhCsZsqZWatiIxEgVrCu1EY0X0SUC5uRlJLIprlRGK8fImjGSvZcpGkiRxM_Qiwmx-qYggbT2m3fNO29JhlpaTKZhL1lCVngWKZIRooZXl3-3PYwzV0GUAk&sig=Cg0ArKJSzEWozzDHFWXeEAE&id=lidar2&mcvt=1000&p=108,1030,358,1330&tm=1148.2999992370605&tu=148.19999980926514&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250319&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1451399479&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3877521800&rst=1742842418729&rpt=354&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 24 Mar 2025 18:53:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame F25F 2 KB
1 KB 218ms
213ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=50&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 93148e62c4898c0d782a7ea80f16e62774f7c58d81436f9c1cf40defd44dd6cc

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame F25F 3 KB
3 KB 23ms
18ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: xkLkw77854B4mX-W9-rNpOk8S27q076s3PcRsQZu6ZQ-SifHszQBgg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame F25F 130 KB
42 KB 27ms
23ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:40 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame F25F 3 KB
4 KB 24ms
19ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: 6D1CLIkr1IeCc2H8ADaGaAnYUciLZPr0vsKZMDZCaVj-YtGMM82lcg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame F25F 3 KB
4 KB 24ms
20ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: 0WayM2KTZqbX1Rm9k6jSgxCgTo7BxyKJvNaasleybLuZYOpA_uYWcA==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame F25F 3 KB
4 KB 22ms
19ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 6
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: MDa-FoyQO5_TM-gqRIdFEB-ZCyu1WWyGEQUA_NOQjn4QfcFo5RLAYg==
date: Mon, 24 Mar 2025 18:53:35 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame F25F 5 KB
6 KB 22ms
19ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: 9ofEUo0kclN-FnDO4ogTumr6U-rF45UnR-YHWA2E8X2K0CCq8--dyQ==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 9007 2 KB
1 KB 260ms
258ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14209&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=389&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: e2c5c24736cd092e4c6eccfe2fbf4d481efbd14132097abc0cfd26d68addd347

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame F25F 0
171 B 763ms
239ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame F25F 0
168 B 730ms
223ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.14248019365885312
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Mon, 24 Mar 2025 18:53:40 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H2

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame F25F
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=al6P4crsA3iat7mnNKrhZw

2 B
158 B

193ms
191ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=al6P4crsA3iat7mnNKrhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=al6P4crsA3iat7mnNKrhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:40 GMT
Server: nginx

POST
H2

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame F25F
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=cQ656sgiB6uKLgZKNKrhZw

2 B
130 B

187ms
186ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=cQ656sgiB6uKLgZKNKrhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=cQ656sgiB6uKLgZKNKrhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:40 GMT
Server: nginx

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame F25F 0
187 B 85ms
27ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=31030696884

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:39 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H3 200 renews-title1.png
re-news.tw/images/ 24 KB
24 KB 66ms
44ms Image
image/png 34.160.26.175
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://re-news.tw/images/renews-title1.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.26.175 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 175.26.160.34.bc.googleusercontent.com
Software: / Express
Resource Hash: e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: public,max-age=3600
etag: W/"5fad-191b5b37a20"
age: 3735
via: 1.1 google
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24493
date: Mon, 24 Mar 2025 17:51:25 GMT
last-modified: Tue, 03 Sep 2024 02:25:24 GMT
x-powered-by: Express
content-type: image/png

GET
H2 200 Microip_Inc_Logo.jpg
mma.prnasia.com/media2/2428123/ 12 KB
12 KB 161ms
34ms Image
image/jpeg 2606:4700::6812:5fe1
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://mma.prnasia.com/media2/2428123/Microip_Inc_Logo.jpg?p=medium600
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:5fe1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 039e147a3d5e4b0857c0230686525f58ab3b688ea092c8d963be13ac1ae0bc19

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 15324
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 24 Mar 2025 04:08:04 GMT
server-timing: intid;desc=d0beb93f3999a7cb
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/jpeg
last-modified: Mon, 24 Mar 2025 04:08:03 GMT
vary: *, Accept-Encoding
access-control-allow-headers: Content-Type
cache-control: public, max-age=1
cf-ray: 92585f671bcf19c7-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12105
x-powered-by: ASP.NET
server: cloudflare

GET
H2 200 %E5%8F%B0%E7%81%A3-Pay-%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1%E6%8E%A8%E8%96%A6%E8%88%87%E6%8C%87%E5%AE%9A%E9%80%9A%E8%B7%AF%E5%84%AA%E6%83%A0%E5%BD%99%E6%95%B4-1080x630.jpg
creditcards.com.tw/wp-content/uploads/2020/10/ 65 KB
65 KB 271ms
16ms Image
image/webp 192.0.78.25
AUTOMATTIC

General

Check archive.org

Download Go to Show image

Full URL

https://creditcards.com.tw/wp-content/uploads/2020/10/%E5%8F%B0%E7%81%A3-Pay-%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1%E6%8E%A8%E8%96%A6%E8%88%87%E6%8C%87%E5%AE%9A%E9%80%9A%E8%B7%AF%E5%84%AA%E6%83%A0%E5%BD%99%E6%95%B4-1080x630.jpg?crop=1

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

92f9f001e9f335dc3ba11338e516af016b641679e9195f7aeb9a753b05ee750a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "251aef38d12d2b34"
x-content-type-options: nosniff
access-control-allow-methods: GET, HEAD
expires: Wed, 03 Mar 2027 02:56:22 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/webp
last-modified: Sun, 02 Mar 2025 14:56:22 GMT
vary: Accept
strict-transport-security: max-age=31536000
cache-control: public, max-age=63115200
timing-allow-origin: *
x-nc: HIT bur 7
access-control-allow-origin: *
content-length: 66404
x-ac: 2.jfk _atomic_dca HIT
server: nginx

GET
H3 200 1742800023-1384b5e7572f24a117a0ac78b2d642f2-840x525.jpg
img.gbyhn.com.tw/2025/03/ 66 KB
67 KB 304ms
34ms Image
image/jpeg 2606:4700:3034::6815:6009
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://img.gbyhn.com.tw/2025/03/1742800023-1384b5e7572f24a117a0ac78b2d642f2-840x525.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::6815:6009 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 395afb1491e62cb0666325882b2d9ffd6258f76bc2da4f8c163e0b484d82927e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cf-cache-status: HIT
age: 41457
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WbTASJcKqOMxXydxy0I8AuoVZjy7V4Nd%2FXC2XwMAmnRrarzXiPOVf7sNr0du4lI3w19g2HDLn9K0WpMQu55vg8MHUbzVJJJa9TfCxe7tbU1qHBYvPmh%2BUsjrkyngX6tT0ky2u9ObfyxcsFzsopER"}],"group":"cf-nel","max_age":604800}
expires: Mon, 31 Mar 2025 07:08:29 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=16777&min_rtt=16279&rtt_var=3836&sent=13&recv=9&lost=0&retrans=0&sent_bytes=4181&recv_bytes=4414&delivery_rate=35443&cwnd=12000&unsent_bytes=0&cid=dc33fff2e036c337&ts=44&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/jpeg
last-modified: Mon, 24 Mar 2025 07:07:03 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 92585f68094943c8-EWR
accept-ranges: bytes
content-length: 67916
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 200 2025032402565924.jpg
img.racingcharger.tw/wp-content/uploads/ 152 KB
152 KB 1295ms
459ms Image
image/jpeg 103.1.220.9
YUANJHEN-AS-TW Yu...

General

Check archive.org

Download Go to Show image

Full URL: https://img.racingcharger.tw/wp-content/uploads/2025032402565924.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.1.220.9 , Taiwan, ASN131149 (YUANJHEN-AS-TW Yuan-Jhen Info., Co., Ltd, TW),
Reverse DNS: ph2.g-dns.com
Software: Apache /
Resource Hash: 95634eb651772e9ecc489c8a2e12cccb71cd06089ae3f03f8dab3654ce669c8c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

accept-ranges: bytes
content-length: 155748
date: Mon, 24 Mar 2025 18:53:40 GMT
last-modified: Mon, 24 Mar 2025 02:57:04 GMT
content-type: image/jpeg
server: Apache

GET
H2 200 1f449.png
s.w.org/images/core/emoji/15.0.3/72x72/ 423 B
731 B 80ms
17ms Image
image/png 192.0.77.48
AUTOMATTIC

General

Check archive.org

Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/15.0.3/72x72/1f449.png

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

9cf1114324a6653750f0f8af7783a744e45adadca47c48844e4ee0f11df269bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=315360000
x-nc: HIT jfk 1
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 423
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/png
last-modified: Tue, 30 Jan 2024 01:21:05 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 file.png
static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/ 1010 KB
1011 KB 85ms
20ms Image
image/png 2600:9000:250b:ba00:1e:5c56:d400:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250b:ba00:1e:5c56:d400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.27.1.1 /
Resource Hash: 76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-cf-id: eZU-JnDicqEPFDfjv_ufdltW962DW5HNN1G8T55dg7eaWCR_1TWBSw==
cache-control: public, max-age=15552000, immutable
timing-allow-origin: *
age: 3689800
via: 1.1 google, 1.1 383ad280f1e2a4497aecb7ee8d8e9144.cloudfront.net (CloudFront)
x-wixmp-trace: projects/wix-media-infrastructure/traces/2spVhEK7hN7G4oknE9KNdNWC2Cu
access-control-allow-origin: *
x-seen-by: image-manipulator-79c6fd85fd-jw8kv
content-length: 1033732
alt-svc: h3=":443"; ma=86400
date: Mon, 10 Feb 2025 01:57:00 GMT
content-type: image/png
x-cache: Hit from cloudfront
server: openresty/1.27.1.1
x-amz-cf-pop: IAD12-P4

GET %E6%A8%82%E5%A4%A9%E8%B2%B8-%E4%BF%A1%E7%94%A8%E7%AE%A1%E7%90%86%E6%8C%87%E5%8D%97-1.jpg
blog.alphaloan.co/wp-content/uploads/2021/04/ 0
0

POST
H2 204 events
bidder.criteo.com/csm/ Frame F25F 0
186 B 20ms
16ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:39 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame F25F 43 B
365 B 22ms
18ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://static.criteo.net/images/pixel.gif?ch=1

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame F25F 43 B
365 B 21ms
18ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://static.criteo.net/images/pixel.gif?ch=2

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame F25F 5 KB
0 141ms
141ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 9007 5 KB
0 139ms
139ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame F25F 13 KB
13 KB 28ms
26ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=50&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: AraVf6324shg17nXN5VzQvXfDjDk12mFjGlgLd5n-1hJcPzvxGFkuA==
date: Mon, 24 Mar 2025 18:53:20 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 9007 13 KB
0 8ms
8ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14209&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=389&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: AraVf6324shg17nXN5VzQvXfDjDk12mFjGlgLd5n-1hJcPzvxGFkuA==
date: Mon, 24 Mar 2025 18:53:20 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 adsrv Show response
onead.onevision.com.tw/v2/ 177 B
464 B 217ms
212ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://onead.onevision.com.tw/v2/adsrv?version=20240208&uid=1000480&category=-1&cookie=true&ip=&guid=4d1bba66-08e1-11f0-9211-0242ac120002&channel=0&volume=0.5&r=&adid=&response_freq_multiple=native-drive.0&web_location=https%3A%2F%2Freurl.cc%2FXqAx30&title=Dynamics%20365%20Customer%20Voice&fp=04c6d3e15a52f9e0d5fe2d47f4a29cde&_t=1742842420415&cb=ONEAD_text_response_1wncs&pb=0&spid=&bgid=0
Requested by: Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0bfbf9c7b3d1a2d375e53ae92784a94bf72d26ebea6a9da9959534c25d735edb

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 569710278
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-onead-guid: 4d1bba66-08e1-11f0-9211-0242ac120002
access-control-allow-credentials: true
x-onead-message: browser_incompatible
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 177
x-onead-backend: onead-http-query-xvl9-gohttp
server: gws
x-powered-by: OneAD

GET sodar
ep1.adtrafficquality.google/pagead/ Frame CEAF 0
0

GET
H2 200 discoverylogs
log.popin.cc/log/popin_media/ Frame A1D2 66 B
223 B 176ms
169ms Image
image/jpeg 119.63.198.143
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://log.popin.cc/log/popin_media/discoverylogs?data=eyJ0eXBlIjoxNSwicGFyYW0xIjoyLCJhcGlfaG9zdCI6InR3LnBvcGluLmNjIiwiZGV2aWNlIjoicGMiLCJtZWRpYSI6InJldXJsLmNjIiwidXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ1aWQiOiJkZThmZTMyMzMxYTRkNjAzZDczMTc0Mjg3ODQxOTgzNSIsInRkX3ZlcnNpb24iOiIxLjcuMSIsInRkX2NsaWVudF9pZCI6IjJlZjExMzNhLTA3YTUtNDgwMS04MDQxLTcxNzBjNWY2Y2I0YiIsInRkX2NoYXJzZXQiOiJ1dGYtOCIsInRkX2xhbmd1YWdlIjoiZW4tdXMiLCJ0ZF9jb2xvciI6IjI0LWJpdCIsInRkX3NjcmVlbiI6IjE2MDB4MTIwMCIsInRkX3ZpZXdwb3J0IjoiMzAweDI1MCIsInRkX3RpdGxlIjoiIiwidGRfdXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ0ZF91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgSGVhZGxlc3NDaHJvbWUvODguMC40MzI0LjE5MCBTYWZhcmkvNTM3LjM2IiwidGRfcGxhdGZvcm0iOiJMaW51eCB4ODZfNjQiLCJ0ZF9ob3N0IjoicmV1cmwuY2MiLCJ0ZF9wYXRoIjoiL1hxQXgzMCIsInRkX3JlZmVycmVyIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ0ZF9icm93c2VyIjoiQ2hyb21lIiwidGRfYnJvd3Nlcl92ZXJzaW9uIjoiODguMC40MzI0IiwidGRfb3MiOiJXaW5kb3dzIiwidGRfb3NfdmVyc2lvbiI6IjEwLjAuMCIsImNsaWVudF9pZCI6IjJlZjExMzNhLTA3YTUtNDgwMS04MDQxLTcxNzBjNWY2Y2I0YiIsImV4dHJhIjoiIiwiaW50ZXJhY3Rpb25fbnVtYmVyIjowLCJwb3Bpbl92ZXJzaW9uIjo2fQ==&t=1742842420455
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.143 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: 654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5e186130-42"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 66
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/jpeg
last-modified: Fri, 10 Jan 2020 11:34:08 GMT
server: nginx/1.13.5

GET
H2 200 log.gif
r.popin.cc/ Frame A1D2 35 B
185 B 581ms
176ms Image
image/gif 119.63.198.188
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://r.popin.cc/log.gif?type=related-tw&uid=de8fe32331a4d603d731742878419835&url=https%3A%2F%2Freurl.cc%2FXqAx30&t=1742842420458
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.188 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "6142ee5a-23"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 35
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Thu, 16 Sep 2021 07:12:26 GMT
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame A1D2 36 B
399 B 209ms
200ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

cd795f959cb737bc280b0558d6e0c798e465a3c56e5bdc28051ef8e523d8f86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame F25F 36 B
399 B 411ms
203ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

cd795f959cb737bc280b0558d6e0c798e465a3c56e5bdc28051ef8e523d8f86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 9007 36 B
399 B 611ms
201ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

cd795f959cb737bc280b0558d6e0c798e465a3c56e5bdc28051ef8e523d8f86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H3

200

vzn
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=OneDATA
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA&verify=true
https://onead.onevision.com.tw/v2/pixel/vzn?id=y-X5vTQglE2p9M0YeLJLYu02mxpxuuyH8dkdEqog--~A

170 B
200 B

194ms
194ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://onead.onevision.com.tw/v2/pixel/vzn?id=y-X5vTQglE2p9M0YeLJLYu02mxpxuuyH8dkdEqog--~A
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
x-vendor: vzn
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 186675009
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: y-X5vTQglE2p9M0YeLJLYu02mxpxuuyH8dkdEqog--~A
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-d11z-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

strict-transport-security: max-age=31536000
location: https://onead.onevision.com.tw/v2/pixel/vzn?id=y-X5vTQglE2p9M0YeLJLYu02mxpxuuyH8dkdEqog--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/html
server: ATS

GET
H3

200

ltm
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://onead.onevision.com.tw/v2/pixel/ltm?id=1dfd8ff382419ff6ace06f240b39cf69

170 B
200 B

196ms
195ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://onead.onevision.com.tw/v2/pixel/ltm?id=1dfd8ff382419ff6ace06f240b39cf69
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
x-vendor: ltm
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 209375946
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 1dfd8ff382419ff6ace06f240b39cf69
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-d11z-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

expires: 0
cache-control: no-cache
location: https://onead.onevision.com.tw/v2/pixel/ltm?id=1dfd8ff382419ff6ace06f240b39cf69
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Mon, 24 Mar 2025 18:53:40 GMT
pragma: no-cache

GET
H3

200

ttd
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://onead.onevision.com.tw/v2/pixel/ttd?id=b490a08a-66a6-4aa2-8dff-0184c0717707

170 B
200 B

193ms
193ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://onead.onevision.com.tw/v2/pixel/ttd?id=b490a08a-66a6-4aa2-8dff-0184c0717707
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
x-vendor: ttd
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 137199332
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: b490a08a-66a6-4aa2-8dff-0184c0717707
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-d11z-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

location: https://onead.onevision.com.tw/v2/pixel/ttd?id=b490a08a-66a6-4aa2-8dff-0184c0717707
content-length: 197
date: Mon, 24 Mar 2025 18:53:40 GMT
server: Kestrel

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=3m51m51&uid=4d1bba66-08e1-11f0-9211-0242ac120002&t=ajs
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=4d1bba66-08e1-11f0-9211-0242ac120002&t=ajs

1 KB
1 KB

20ms
20ms

Image
application/javascript

18.207.77.150
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=4d1bba66-08e1-11f0-9211-0242ac120002&t=ajs
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: HTTP/1.1
Server: 18.207.77.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-207-77-150.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Content-Length: 1228
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 24 Mar 2025 18:53:40 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=3m51m51&uid=4d1bba66-08e1-11f0-9211-0242ac120002&t=ajs
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Mon, 24 Mar 2025 18:53:40 GMT

GET
H2 200 cm
trc.taboola.com/sg/onedata/1/ 0
189 B 74ms
18ms Image
text/plain 2a04:4e42:400::300
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://trc.taboola.com/sg/onedata/1/cm
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-fastly-to-nlb-rtt: 943
x-timer: S1742842421.700804,VS0,VE2
x-vcl-time-ms: 2
via: 1.1 varnish
accept-ranges: bytes
x-cache: MISS
content-length: 0
date: Mon, 24 Mar 2025 18:53:40 GMT
x-service-version: v1
server: nginx
x-cache-hits: 0
x-served-by: cache-lga21932-LGA

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame A1D2 30 B
271 B 203ms
203ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=3c9e96b0-c72a-461c-98d7-c7c3700bb867

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame F25F 0
187 B 206ms
204ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&mp=3c9e96b0-c72a-461c-98d7-c7c3700bb867

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/ Frame F25F 0
177 B 798ms
198ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/pixel?bd=3c9e96b0-c72a-461c-98d7-c7c3700bb867&t=50ef57&referrer=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Mon, 24 Mar 2025 18:53:41 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 9007 0
187 B 202ms
202ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 52A9 107 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 04AE 107 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ Frame 52A9 524 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame A1D2 0
0 32ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuCI5rMVuK3-xnUKMzig9Nsn2I9PelzGfJ44EyGMbMHvPw7skYyUIChBh_jLMV9Ubwo-KPqck-Eng2rDU89BAhsgR8JU-cuc2EOu0s8DkOJmbCLPJAt0ZNUwGn9vtyetcozQz0yWb07CCcYon5gg2kBuy0XlggOxmvh1LvMyWBUh8cEbYwetShJvFGlzm_aWjmH4Dg_0wRBSYTElnCeOZ7JKVQgLwQ44mzU37iqATxrqQftDk46haKXHcnSUsy6CrC9tWQBQZf1ampkPAoJX06igQa7x6LANrfX8KcW5WK2p_ZXnEPDpS6tLAixc61yZb3U-5jEhvSc42A6AZvKPiiAaeQY2uKJB4vlsybKSSzzhQhuLjQGkLU5WcgK06aMsD7GcKd_IVke2D2yd1GGZMFCFQAiSZgQInRjgXjzX2Xo4ereIBIYWGJkE8L2&sai=AMfl-YSeq5ne6h3hjc-RSYAhhiLIGcz7ZsB_ffNogT8z9wurpZVFqFG6jwIfk-hN5E11AiP4aP0p5wIDNzlxabm733ZpLs2Pm0AEF_OEOXQOeVrH_qJtqOCys6U0CWA&sig=Cg0ArKJSzB9HqPx_ayW2EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:41 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ Frame 04AE 524 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame 52A9 63 KB
0 1ms
1ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame 04AE 63 KB
0 3ms
3ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H/1.1 200
OK pixel
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/ Frame 9007 0
177 B 1078ms
197ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/pixel?bd=3c9e96b0-c72a-461c-98d7-c7c3700bb867&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Mon, 24 Mar 2025 18:53:42 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 1A4E 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 52A9 17 KB
13 KB 34ms
34ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8536556ee8cc8c7415f96bd98e7a1b6454c7c3351ab498bde21c555ffefce05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13044
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 52A9 36 KB
8 KB 119ms
119ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2228542608900059&correlator=268491727592457&eid=31086814%2C31090917%2C31091040%2C83321073%2C95340252%2C95340254&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=3758817455&sfv=1-0-41&sc=1&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&abxe=1&dt=1742842421125&lmt=1742842421&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=h4kip8a9aq48&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=3&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842421015&idt=65&adks=3360245792&frm=23&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&td=1&egid=59215&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4602462940e2fd6d0b728b0b5153eba2e87fff5925bde6e7f2932fefd0d66e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7937
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 20AC 0
0 70ms
16ms Document
text/html 2607:f8b0:4004:c07::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:41 GMT
expires: Mon, 24 Mar 2025 18:53:41 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 2677 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 04AE 17 KB
13 KB 38ms
31ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f909dd342aef5ab96540e18355cd9b2def60e3a7c1a07bafb80ee5d68706dc7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13016
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 04AE 519 B
295 B 135ms
135ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2779968489831959&correlator=3056283367279952&eid=83321073&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14209-2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C320x100%7C300x100&ifi=1&didk=607409652&dids=gpt-passback&adfs=3758817452&sfv=1-0-41&sc=1&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&abxe=1&dt=1742842421153&lmt=1742842421&adxs=640&adys=455&biw=1600&bih=1200&isw=320&ish=100&scr_x=0&scr_y=0&btvi=0&ucis=omhltzivm13f&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=3&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=320x100&msz=320x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842421025&idt=83&adks=1212019568&frm=23&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&td=1&egid=59215&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8fae9fe9566bc3457a4ac2b0e84907bdabbb890bb99c377ff49048ace7772151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 265
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 14C0 0
0 94ms
18ms Document
text/html 2607:f8b0:4004:c1f::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:41 GMT
expires: Mon, 24 Mar 2025 18:53:41 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 52A9 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 47F3 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame B4DD 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 04AE 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 76DF 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame E14F 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame BDDE 0
0 31ms
30ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstsMfPTcL0kF-vlaLqLSUbIsdo7CVs52UcQVIeZLwflNI6_OdLjyfnyug9eIf5GZawQAPYo2nzHfgw7rtf1zfMJz-EVNWs2CninmkkZZq5AXdFMl1zE1jp0JhyPtfo8CPgWyPQIgnQcpdI_lejpt2dgNLNF4vxCs2-T_99-gr-MPmw-WRvD393JbMXJSqivahqmzl7R0WSFCPnkA0bvgDylRV3LGn8Jei3CdHdcgdi7OHXvZkN-Lsi1EERQmAxV8bbLUIS_NgFNWXtFA5nWOf_6bAO3WpX1MDwq3opwt1y4ixFflLQbAjxErjScy5tUccH2eX0rlk9eAVtfGWBZ7IGK1489gidIThupiFuajsHy1Tdcl6ubERGOFEbVvPafk_ERaur-M3oHBUi1gtPYeFXGvCV6Lb_hy3G-ZVrUuKpBGCBKefbs2DmjJInq-K6t-mnlGQydD9eKBg&sai=AMfl-YR1ENkRiNW3__B_VZsoBsRHQr1-pBpKXXWn7aNk3ITBoiUkc_du4aUzukKZtlVRNYh-qr7zPIK0ImbBOrNWVUBrvnfudpw0N-iI7iahQ38bBbwyqsTOI_TPIFI&sig=Cg0ArKJSzIGXrKn7zx4IEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame BDDE 9 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame BDDE 218 KB
0 7ms
7ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame E907 0
0 16ms
15ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 7
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: o2b5u9MExQ8azvC1WQQ_7bJSFXaFXLA1Ts17WXmo_UqPEygmzm3m1w==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame B05C 11 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BDDE 0
0 23ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BDDE 0
0 24ms
24ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame BDDE 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41f1e998e52a0d2246aafeebc3e4de5954376a9ce825bec7dec508f4735e967d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame B05C 2 KB
794 B 204ms
203ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame B05C 30 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame B05C 2 KB
1 KB 217ms
212ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=593&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 2b278a587d7e8f768a5ef65c2c68d1582d0973bfc0bba7b00bb6e79c91bedf33

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame B05C 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: xkLkw77854B4mX-W9-rNpOk8S27q076s3PcRsQZu6ZQ-SifHszQBgg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame B05C 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:40 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame B05C 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: 6D1CLIkr1IeCc2H8ADaGaAnYUciLZPr0vsKZMDZCaVj-YtGMM82lcg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame B05C 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: 0WayM2KTZqbX1Rm9k6jSgxCgTo7BxyKJvNaasleybLuZYOpA_uYWcA==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame B05C 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 6
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: MDa-FoyQO5_TM-gqRIdFEB-ZCyu1WWyGEQUA_NOQjn4QfcFo5RLAYg==
date: Mon, 24 Mar 2025 18:53:35 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame B05C 5 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: 9ofEUo0kclN-FnDO4ogTumr6U-rF45UnR-YHWA2E8X2K0CCq8--dyQ==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame B05C 0
170 B 240ms
238ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:41 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame B05C 0
168 B 224ms
223ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.7532606015555636
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Mon, 24 Mar 2025 18:53:41 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame B05C
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=g7j07Mf7CyO_9WmWNarhZw

2 B
20 B

189ms
187ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=g7j07Mf7CyO_9WmWNarhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:42 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=g7j07Mf7CyO_9WmWNarhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:41 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame B05C
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=xccfBeZHBbOC9iE8NqrhZw

2 B
20 B

188ms
188ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=xccfBeZHBbOC9iE8NqrhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:42 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=xccfBeZHBbOC9iE8NqrhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:42 GMT
Server: nginx

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame B05C 0
186 B 19ms
17ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=92473508661

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 events
bidder.criteo.com/csm/ Frame B05C 0
186 B 18ms
16ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:40 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame B05C 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame B05C 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame B05C 5 KB
0 0ms
0ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame B05C 36 B
399 B 201ms
201ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

cd795f959cb737bc280b0558d6e0c798e465a3c56e5bdc28051ef8e523d8f86d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:41 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame B05C 13 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=593&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: AraVf6324shg17nXN5VzQvXfDjDk12mFjGlgLd5n-1hJcPzvxGFkuA==
date: Mon, 24 Mar 2025 18:53:20 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame BDDE 0
0 31ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsssZqjb3lTawwoh7khQ7-xmCHoLcZNs0YjUJteVEsW76hUw3UDap_vZ4upE-Oc1VEe_DEFys_FFK_Wm0lyJy_K-_06DcoIEZH87WXC0KKH_9zf14BGPAED2vWnPZgQIWDytfFsvSM0fAzCXl9gEc2OWEsYTqM8DWcSb9PWqBtESgikGne3b6joOCbgSZepDe11ysT0NnmlxLCZKrxP_lgXk6UKviS0MZLrz0JgejWy5ON01ZmW-g7I9oHspVCK3aNP3z9cJSWXdiQDzbns7OiKkutXhQxq3qDPvmM6635qOR1XZBVU-lsJeSxavBLp5hKV2qGH5tcKSppSn_c4ObL1cE5Q88VtHbFIQX6X4kTRpucB0YEIC1ZLQw5rtS1D0Zd79_DdJlBslkUpvMtU3riQewzpMkLjl-9danha9NU8pyPPLYwdG_xizzg9otvksvn3RlUnTcvYwka3Z&sai=AMfl-YT7okpmxNypYM9ubJQ_bzed2wWUMMYvsyWRHxjLy-qCmLr6BHt9D9KdGOHYxSDfBUNe7pfiN5pN7gWqnh8OxeXTA3v5VeckRD8Esv-kzkQzO6UY1xiJIr7Q4ZA&sig=Cg0ArKJSzMELlGib7Yk9EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:41 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:41 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 52A9 0
0

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 04AE 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A1D2 42 B
65 B 26ms
25ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsur-XVjQd5t5Bin0UgNzDEEQebXrt7XabAYNmDsl1im4-7l7LTV1PCj7al6e6M5cc1mOCVkBDHXGz7yytXIMKeSmMzoNUtPtem1Lt7z3aVRevQwN4iRof-YqUkL6MqD-KT8oU9aTD-coH8_OC_gH5Gud8icBCkv7KAOEXalPi80AaY&sig=Cg0ArKJSzJbvWWH25NF5EAE&id=lidar2&mcvt=1001&p=108,270,358,570&tm=3169.0999994277954&tu=2167.7999992370605&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20250319&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=827794272&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3877521800&rst=1742842418743&rpt=2302&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 24 Mar 2025 18:53:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame B05C 0
187 B 203ms
202ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&mp=3c9e96b0-c72a-461c-98d7-c7c3700bb867

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:42 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/ Frame B05C 0
177 B 396ms
197ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/pixel?bd=3c9e96b0-c72a-461c-98d7-c7c3700bb867&t=50ef57&referrer=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Mon, 24 Mar 2025 18:53:42 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame 52A9 0
0 25ms
24ms Fetch
text/html 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 6E00 107 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ Frame 6E00 524 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame 6E00 63 KB
0 0ms
0ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame DD09 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 6E00 17 KB
13 KB 43ms
43ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb646ba72130ce91f6f7de7af02891539e2f1ea5da8816d56fc3c96772ad46a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13139
date: Mon, 24 Mar 2025 18:53:42 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 6E00 36 KB
8 KB 129ms
128ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1526968813130016&correlator=2883880316622664&eid=31090594%2C31091041%2C31091114%2C31091184%2C31091185%2C31091201%2C83321266%2C95347490&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=2044026223&sfv=1-0-41&sc=1&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&abxe=1&dt=1742842422469&lmt=1742842422&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=yc0h862knfhw&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=6&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842422360&idt=79&adks=3360245792&frm=23&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&td=1&egid=59215&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31a5f757ff8d7554aeb08a7d3d6eb2b53105d17a65edd83ea2069c2fbd7078d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:42 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7957
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame FF20 0
0 51ms
15ms Document
text/html 2607:f8b0:4004:c09::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=6

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:42 GMT
expires: Mon, 24 Mar 2025 18:53:42 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 6E00 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 5348 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame F364 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5747 0
0 30ms
30ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvlM140mWdqtXOXrHAzBCgYmoaBoCF1ui0XaWmLZ8oiYkOOnzD0M15TCp8AH7nCiF7gG2gO0pU2oU2UtcdfDOsVaAkAl_uyeq6FkqcK6arO0BDfi34HZrADu3_Aw7suceS3sDA9yODAAEttdiKR2kKD4Ir-oXAjEGLKqGd8bLxQGTmQBZcu8cfb0BsUDHVFAEW5BgoTIt8q_R5xp_Mhos_fDe0xrVhmvN044RHqrkiulH1-czVotK0MZEtOwYa4zpLj0D8tiLtFzHY4MinUBwBUnkhvt7VOexjWLEcXIwlN43OBEbPsHqY48sHFk_BMzgoG1oZdoW7qtv0OkHf4q40FvBJ5WOLQPJVagD2J4vkr9AOQx_fksMpQDtdEhZT7QMUwCdlenrrG2R4Er-WYgi7XxIwX_QOn6wtD_Rzn8xLfMBGdJZfo6gr06_86L9jqTZeFshzlgAIWhg&sai=AMfl-YQfhlGJN1xk8zyDIdoGkxCnTRhFT_IPtAXkFu_9jvvpYqiKyVRstXa7tRR45V-6Mz_Ctbn0R9inw7Xn7gaUjNJKu_yiUfxyXn2ZAWr_lPyOmSG7V-2hhrRcdAY&sig=Cg0ArKJSzFtvZo-wGX2hEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame 5747 9 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 5747 218 KB
0 7ms
7ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5747 0
0 24ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 5747 217 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41b6df60b231652947d4a4da0453deb794071493603286fb01c14db9b1d7340e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 41B7 0
0 0ms
0ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 7
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: o2b5u9MExQ8azvC1WQQ_7bJSFXaFXLA1Ts17WXmo_UqPEygmzm3m1w==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 2251 11 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5747 0
0 24ms
24ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 2251 2 KB
794 B 203ms
202ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:42 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 2251 30 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BDDE 42 B
65 B 27ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuzSQJtWexr4eebLM3Op7RPv4swEnHf27BRcQo24_17FRQk_l-U7MpAXt1F8wzdUSldNWjERz30_wF9laKr1Vrm3pDWwQM8-ruTh-8XpzGdnbcGYOflv8dkEXOq6DS2uTztFfuIUKUl8wuIleG-bqTUXCy8cnNSDqc1KQXlLT46Ly0&sig=Cg0ArKJSzMJy7Cgl8UkJEAE&id=lidar2&mcvt=1000&p=108,650,358,950&tm=1452.8999996185303&tu=452.69999980926514&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250319&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3360245792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3877522100&rst=1742842421258&rpt=501&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 24 Mar 2025 18:53:42 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 2251 2 KB
1 KB 230ms
225ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=547&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: fd491a1edce925c3fdb8647416511e31d6d4f72213eb144f5ead2d6b2654d638

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 2251 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: xkLkw77854B4mX-W9-rNpOk8S27q076s3PcRsQZu6ZQ-SifHszQBgg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 2251 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:40 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 2251 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: 6D1CLIkr1IeCc2H8ADaGaAnYUciLZPr0vsKZMDZCaVj-YtGMM82lcg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 2251 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: 0WayM2KTZqbX1Rm9k6jSgxCgTo7BxyKJvNaasleybLuZYOpA_uYWcA==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 2251 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 6
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: MDa-FoyQO5_TM-gqRIdFEB-ZCyu1WWyGEQUA_NOQjn4QfcFo5RLAYg==
date: Mon, 24 Mar 2025 18:53:35 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 2251 5 KB
0 4ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: 9ofEUo0kclN-FnDO4ogTumr6U-rF45UnR-YHWA2E8X2K0CCq8--dyQ==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame 2251 0
170 B 243ms
239ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:43 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 2251
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=5cM6QxmsDyG_FqOVN6rhZw

2 B
20 B

188ms
186ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=5cM6QxmsDyG_FqOVN6rhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=5cM6QxmsDyG_FqOVN6rhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:43 GMT
Server: nginx

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 2251 0
168 B 224ms
221ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.8544099811259362
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Mon, 24 Mar 2025 18:53:42 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 2251
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=_UBYu8TuBaCz2pLZN6rhZw

2 B
20 B

188ms
187ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=_UBYu8TuBaCz2pLZN6rhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=_UBYu8TuBaCz2pLZN6rhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:43 GMT
Server: nginx

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 2251 0
186 B 17ms
16ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=7726051174

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:42 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 events
bidder.criteo.com/csm/ Frame 2251 0
186 B 19ms
16ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:42 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 2251 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 2251 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 2251 5 KB
0 0ms
0ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 2251 13 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=547&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: AraVf6324shg17nXN5VzQvXfDjDk12mFjGlgLd5n-1hJcPzvxGFkuA==
date: Mon, 24 Mar 2025 18:53:20 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 6E00 0
0

POST
H2 204 collect
analytics.google.com/g/ 0
0 27ms
26ms Fetch
text/plain 2607:f8b0:4004:c23::66
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je53k0v897965293za200&_p=1742842417946&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109~102887800&cid=1802819371.1742842418&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1742842418&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=scroll&epn.percent_scrolled=90&_et=92&tfd=6070
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c23::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to: {"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:137:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 26ms
26ms Fetch
text/plain 2607:f8b0:4004:c1d::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je53k0v9181474282za200&_p=1742842417946&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109&cid=1802819371.1742842418&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1742842418&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=scroll&epn.percent_scrolled=90&_et=65&tfd=6080
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:87:0
report-to: {"group":"ascnsrsggc:87:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:87:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:87:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5747 0
0 31ms
30ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv3CBQih9wDiKpAR7zgZUgZyO-5GQYkTB315GL19B2NJMDxkXDC1VBJz4Kpl0u0_1AMeaF0rKm93oTgbHPpZLi9IkgaRkH9bHqti-dKeoW7BXdrLn06MUC2rihhRkjvq1xWopS6Im3InSR6p0QOrd_tnpo3XcWezSEc7sUmlkMAz_iM_9s786DMBQzzKiPE2PaGs5WIiYYf7HydwZvxiKAI7LcIe8AxsoQ_gVMc9qUqraVnOtBN4virbubNw9UE8lT6pIH6nRZM1yOL2ilAwHf22FrTsz-hHtzFXdkHCn2gzyj8Wxo8dCBCP4wDR7h8DrB5EqlVIbBUwmlBlVicSZB2l4xuSwump_Dybkt6KswRAi8wR-kDKAZzp9xJS3-Sx1NLGCmSKU6yVvXH6Nwkj4c4neHhBa7GFAzmJ_24UFPcNsmT-t6myRyk5v3ufwBYoedjQiO2XefS-QzR&sai=AMfl-YSVOUYZ-5fmSdv8GC0mOIhuDjesK9hrtlh8XncUrTN0OSZhXiE8dOgfzWL2mFgmCuHyix0o8ikedXH0nNKIp2-JSJEq1IQzdXXlt7zt_8Efg8u4T5bv2iIfu1k&sig=Cg0ArKJSzM2UYQyd-gD_EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:43 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:43 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 2251 0
187 B 202ms
202ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&mp=3c9e96b0-c72a-461c-98d7-c7c3700bb867

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/ Frame 2251 0
177 B 397ms
197ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/pixel?bd=3c9e96b0-c72a-461c-98d7-c7c3700bb867&t=50ef57&referrer=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Mon, 24 Mar 2025 18:53:43 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame C28B 107 KB
0 1ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ Frame C28B 524 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame C28B 63 KB
0 0ms
0ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 0395 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame C28B 17 KB
13 KB 34ms
33ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f657e73f3a6891ab1c889b8c2aaf6c1b3242902d0f7d47b9e846ab1e33d95d71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13167
date: Mon, 24 Mar 2025 18:53:43 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame C28B 36 KB
8 KB 105ms
104ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2560791326938257&correlator=1376513110126775&eid=31091199%2C31091201%2C83321072&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=610111617&sfv=1-0-41&sc=1&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&abxe=1&dt=1742842423823&lmt=1742842423&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=i0tyze4mc6ur&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=9&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842423721&idt=64&adks=3360245792&frm=23&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&td=1&egid=59215&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

94c63f262e0481bf1f206e6ed8ec68a8c1726032a819cb7f2b445b95c56de82d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:43 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7937
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 6689 0
0 91ms
16ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=9

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:43 GMT
expires: Mon, 24 Mar 2025 18:53:43 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame C28B 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 8E08 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 360D 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FDA6 0
0 33ms
32ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGn-JXAtiXVzF6MORYQj88fGbM9iO3LVhoH3_v4PXSJW8W-UIDvCodh2tj6DB0pD_b07i54zTOv_EiO6jXZ_G2WLCWrQeo2E6-1XyhmRBWO8kL8-EbHDWSqmOwMKTz_cIjp9ZYT1MOeRRMtkZh0s999Q0uUF_W9ayeNcs9wV1MTq9dlUb12kR5SG93U2FO3htFNRa0l-_7DFXz8E7SKOVnSBonCfpI7KestCt_SAZgGoFvkZhmBYiQY-BKhApNhjjq8hBf3U6h4EvzNhfwC9lIu9NwdvENTqMwdhD2LOPu7-C6DDPI11b7TbpF1-FP9y4fU9AXqzEcj2pFef4UImgHHcOu7RWMYy9xxTaBBXjfIXvyw_JdLVAqRF8agzbqzktkpy7jkNA2tcupQ5o0TodTbVYQ2Il6K692tf7c_7YhhgM8rT9aZTkHJjFjpdGgG6qTMf7FOaA5xw&sai=AMfl-YSXMTKqnCAq7gYXECRUeEPGLsT0PwiFqWKylSjc36WKrtayDWbO4EOOKSLw74CIdC6PuHOHTYhylcel-gdOLPQ1qDn0zGjTza95lXS90VwfkoAfYiSiOe5WW9M&sig=Cg0ArKJSzGcQqDorS-NJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:43 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame FDA6 9 KB
0 1ms
0ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame FDA6 218 KB
0 1ms
1ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 2375 0
0 0ms
0ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 7
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: o2b5u9MExQ8azvC1WQQ_7bJSFXaFXLA1Ts17WXmo_UqPEygmzm3m1w==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 8E70 11 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FDA6 0
0 26ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame FDA6 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 667e34f03f50b1c07d822ad2f55165c960d0804feedd94c3fc3ead74d94a5896

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FDA6 0
0 24ms
23ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 8E70 2 KB
794 B 204ms
202ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 8E70 30 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 8E70 2 KB
1 KB 212ms
212ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=109&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: f7ca876c0cb02210c50ef29c5047b4cc3f10f1273b3ea317362df7fb55559391

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:44 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 8E70 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: xkLkw77854B4mX-W9-rNpOk8S27q076s3PcRsQZu6ZQ-SifHszQBgg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 8E70 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:40 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 8E70 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: 6D1CLIkr1IeCc2H8ADaGaAnYUciLZPr0vsKZMDZCaVj-YtGMM82lcg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 8E70 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: 0WayM2KTZqbX1Rm9k6jSgxCgTo7BxyKJvNaasleybLuZYOpA_uYWcA==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 8E70 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 6
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: MDa-FoyQO5_TM-gqRIdFEB-ZCyu1WWyGEQUA_NOQjn4QfcFo5RLAYg==
date: Mon, 24 Mar 2025 18:53:35 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 8E70 5 KB
0 4ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: 9ofEUo0kclN-FnDO4ogTumr6U-rF45UnR-YHWA2E8X2K0CCq8--dyQ==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame 8E70 0
170 B 239ms
238ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:44 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 8E70 0
186 B 20ms
18ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=23181441591

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:43 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 8E70 0
168 B 223ms
222ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.20890148636213035
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Mon, 24 Mar 2025 18:53:43 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 8E70
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=hdSwcQRQCgiogoxjOKrhZw

2 B
20 B

191ms
190ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=hdSwcQRQCgiogoxjOKrhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:44 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=hdSwcQRQCgiogoxjOKrhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:44 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 8E70
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=3JAWKQOLDvCupuhNOKrhZw

2 B
20 B

190ms
188ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=3JAWKQOLDvCupuhNOKrhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:44 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=3JAWKQOLDvCupuhNOKrhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:44 GMT
Server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 8E70 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 8E70 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

POST
H2 204 events
bidder.criteo.com/csm/ Frame 8E70 0
186 B 18ms
16ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:43 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5747 42 B
65 B 27ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssq3WT17GVCK6UJSeSAjgYXLb6DKCc87ulKX6UWPci-1FfCTt02G9VAGQXQzjJ0aky7lKM8A0ynhNZD0zRj2KrJOtikHiizI7m-Pwh5F0F0GWggQhoPKMOhOPkVb2MHguGDTjQspB3Ds2r2rM3rccqvB4aTSKCaa1SfDXFCdC3d7T0&sig=Cg0ArKJSzLIatoV558_-EAE&id=lidar2&mcvt=1000&p=108,650,358,950&tm=1700.0999994277954&tu=700&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250319&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3360245792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3877522200&rst=1742842422612&rpt=729&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 24 Mar 2025 18:53:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 8E70 5 KB
0 0ms
0ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 8E70 13 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=109&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: AraVf6324shg17nXN5VzQvXfDjDk12mFjGlgLd5n-1hJcPzvxGFkuA==
date: Mon, 24 Mar 2025 18:53:20 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FDA6 0
0 34ms
33ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLmUthF6v4d7k5zJI_nQU-B27XhmrLPh0ZUX_pYOXW4jIDfrrUX8hzJpU_t3-x5Q4hfQg-eKYWZ0RG5BMR4qvinrMa_bxDt-6N2id9z62j2-GLwK1-lY64oCccsKpG-VGbNs5LT6XkPNh56cc6qIJ7zTBdUXyp6H5MF_GojsKkV_UHwuoFLQxuHQutkLzXnRom6G5tU4OT5eN54rjBhQXHIQ3A_FjTIU-1kaq1sI-vMiUpSdT0i6fRw6JxGpuov7agNlSOvMr6vq1DeSSJkSy9YsXzS56iZNq4VQcnpry8NiGloAEXvKstzjuAu-YR_vQBymGwOVI70WqewwjdxKyiYkwVlwMXlQJ3pEARWU3xKDZGOS51zYhg1gKxmhWTLtVsueMeXB_Ufah42RyYG6LK38QWuDx-N2T3MGklOSsqSAaVMeEpCTvGDvMD8ooI2DgNJEhIInSIqClB&sai=AMfl-YTueww_DsSjHvatFSKJlxDPCUFmF8xXkS3or_Mp2ytkfJbFcW82rfSoW7DtWlU9bpb1IoE9v1-PLZqAE9Q4jYb0rVuZIAQufKdVFDzxpxxntnX29_-2Olu72Xc&sig=Cg0ArKJSzK_YeXWp7XMuEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:44 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:44 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET sodar
ep1.adtrafficquality.google/pagead/ Frame C28B 0
0

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 8E70 0
187 B 206ms
205ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&mp=3c9e96b0-c72a-461c-98d7-c7c3700bb867

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:45 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/ Frame 8E70 0
177 B 397ms
197ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/pixel?bd=3c9e96b0-c72a-461c-98d7-c7c3700bb867&t=50ef57&referrer=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Mon, 24 Mar 2025 18:53:45 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 7430 107 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ Frame 7430 524 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame 7430 63 KB
0 0ms
0ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame A658 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 7430 17 KB
13 KB 32ms
31ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c428b740924097b3a2ea1f0e7eb0c6aeb3bb4bd0f590894a5e87919c8f4ab7a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12990
date: Mon, 24 Mar 2025 18:53:45 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 7430 36 KB
8 KB 114ms
113ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1673063210722150&correlator=2267567946533755&eid=31086815%2C31091114%2C31091183%2C83321073&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=2122355459&sfv=1-0-41&sc=1&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&abxe=1&dt=1742842425193&lmt=1742842425&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=p35bkomz1i73&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=12&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842425036&idt=69&adks=3360245792&frm=23&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&td=1&egid=59215&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53ac2c4022ed265cc386becd9a35906eda0605ec279afd17aa504b623589304d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:45 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7926
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 97A7 0
0 27ms
16ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=12

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:45 GMT
expires: Mon, 24 Mar 2025 18:53:45 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 7430 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame D087 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame EC1C 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7A26 0
0 33ms
32ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7vZmlD152FEV_0zjvr3vaMg7bWq63e7XWfBnVecRG_USxy80yjvAHB-vebAuY4EDTsXL-oIblBW-tqCsNeHzvZ7EUWjrkvFyQpPxBB3YpXzVQkh94J99WVxtbmdUZRdDNsSZd_wZsuG1SLfpELYHej0bqkpK056SOEpSExzJcB7BRSIOJ1jL0K-116n4Dx2qX60JlMuFou5XSZgJR0pRwxiKnsL4SqZJPomjnBrtne9i7VtEQoxQQlUxjs-yOsTpaSKk9xQnbC1TIvckqBlDfspMbERBwMzss9K0svkcb2warAlMCRMgQY7zztZehY9UZR1YbiOxkw6RTBCjOxTnrPrdGS0C9fS3ubs4Qkzdprfy6NbW19Nt_xk9ffq6-7YN9otkXfiB1PRG4iqZmH_xYrvnRWmdkyeHauDVcYmpLE5HIlgi0W8lKnsvvGUNvSEt7B7btxxgq8A&sai=AMfl-YT8ujtOaD0ifkmAB7AQ04G9YCIxsmkeXwijZxQlqdxeTRjmFMCDYZiE1fOgOQKa0yrqQdSg0AbXd1H3Lu63lTL9GyG6KjHoBFJIc0JI8AXndsLqA1eF8_wDAGU&sig=Cg0ArKJSzL2VkZFbtsLJEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame 7A26 9 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7A26 218 KB
0 1ms
1ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame ADBF 0
0 0ms
0ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 7
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: o2b5u9MExQ8azvC1WQQ_7bJSFXaFXLA1Ts17WXmo_UqPEygmzm3m1w==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 1F89 11 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 1F89 2 KB
794 B 205ms
202ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 1F89 30 KB
0 2ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A26 0
0 24ms
24ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 7A26 207 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7865980e9f454d04131ef3fa51798d6cc10444ba66e98ee167fb21350374de4

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7A26 0
0 26ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame FDA6 42 B
65 B 26ms
26ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsteHNhXzaSlS5K2vOvdRGmDzO1ggtMqf1Dlx5uria8675bMymhZGywCqCnVnahNXLH0vrIuFLZwQu1Y2MYF7YXCPzMiCwcWaW1uh_3y2YYDGj1hprTeDBCyZWwvYb9USZ0cP7Izb2ccdEDOkIOqPhTndPOk7KGpFV9t7YNiFWAxC9c&sig=Cg0ArKJSzPq8r-t880lXEAE&id=lidar2&mcvt=1000&p=108,650,358,950&tm=1452.6000003814697&tu=453&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250319&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3360245792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3877522300&rst=1742842423943&rpt=493&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Mon, 24 Mar 2025 18:53:45 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 1F89 2 KB
1 KB 214ms
210ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=677&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 59401c1a8084a5decb6f46cf4f61e8fe03757bc0a12b2f3fdf74d16c167e464d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 1F89 3 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: xkLkw77854B4mX-W9-rNpOk8S27q076s3PcRsQZu6ZQ-SifHszQBgg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 1F89 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:40 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 1F89 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: 6D1CLIkr1IeCc2H8ADaGaAnYUciLZPr0vsKZMDZCaVj-YtGMM82lcg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 1F89 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: 0WayM2KTZqbX1Rm9k6jSgxCgTo7BxyKJvNaasleybLuZYOpA_uYWcA==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 1F89 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 6
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: MDa-FoyQO5_TM-gqRIdFEB-ZCyu1WWyGEQUA_NOQjn4QfcFo5RLAYg==
date: Mon, 24 Mar 2025 18:53:35 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 1F89 5 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: 9ofEUo0kclN-FnDO4ogTumr6U-rF45UnR-YHWA2E8X2K0CCq8--dyQ==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame 1F89 0
170 B 240ms
238ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:45 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 1F89 0
168 B 222ms
221ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.7546772566267643
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Mon, 24 Mar 2025 18:53:45 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 1F89
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=L1YUPpNyClO6IAPyOarhZw

2 B
20 B

189ms
188ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=L1YUPpNyClO6IAPyOarhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:46 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=L1YUPpNyClO6IAPyOarhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:45 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 1F89
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=-TRGoMMdArWad_G1OarhZw

2 B
20 B

188ms
187ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=-TRGoMMdArWad_G1OarhZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Mon, 24 Mar 2025 18:53:46 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=-TRGoMMdArWad_G1OarhZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Mon, 24 Mar 2025 18:53:45 GMT
Server: nginx

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 1F89 0
186 B 18ms
17ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=7939709468

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:45 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 events
bidder.criteo.com/csm/ Frame 1F89 0
186 B 17ms
15ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:44 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 1F89 43 B
0 0ms
0ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 1F89 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 1F89 5 KB
0 0ms
0ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Mon, 24 Mar 2025 19:03:40 GMT
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 1F89 13 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=677&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: AraVf6324shg17nXN5VzQvXfDjDk12mFjGlgLd5n-1hJcPzvxGFkuA==
date: Mon, 24 Mar 2025 18:53:20 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 7430 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7A26 0
0 32ms
32ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvfY6Giw_TQFXxbPBojn_NIcqUgTQKXlee-_uQ7CvS6NaR1EPCujNbn4oNy-nsupN8FkKzHvT8Qqrjef7ZikXep2yKnGUus2mZ-vhZTTRbH7ldiupxcZZlLfJU1l3q4ja8hd7qzZYANuNzy1mGjQ6JHzX5-_7ofxzQosHGMMYv81ZPJW3wVRo8zggt9sVxELVs0kY7Owf7tu_3C9Vk24EuJVeEgxTCLkslXmqxKvic_viXalhKBQEaS708Ew85QB77zUyiA1Z2FzeC-y-VWfHuD9N2c3vqu893mm2LTiOYfpq6rBB0us1H2LQ_cQlka0aTPhPzXrXdkP74B9ptlivaNVCOT2IzJrrQdwdv0KZEsdHFgHe1Z2QdkjGUvSQgh1YuMd1akWlODq70HyObaqYthWMpv2FaULZSKyRjoDat5iu0mUipj3ENqsGh36arxtg_8GH5I4vd7cpRN&sai=AMfl-YS33Umfx4ysEwbJ04fkPFJhv_mgF0MLD6jjdPhZPWGpq4nbFTF-nSqfD0Ob1w9qdrtiWeHRgRvsBazWVgofepIa5_8PLdFkQ25fwccvaluEnJkLhH6-kBerVn8&sig=Cg0ArKJSzPbR68adxjbXEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:46 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:46 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 1F89 0
187 B 203ms
202ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&mp=3c9e96b0-c72a-461c-98d7-c7c3700bb867

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:46 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/ Frame 1F89 0
177 B 396ms
197ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net/pixel?bd=3c9e96b0-c72a-461c-98d7-c7c3700bb867&t=50ef57&referrer=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Mon, 24 Mar 2025 18:53:46 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame B4F3 107 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 825 / 20171 / m202503180101 / config-hash: 8758327484111636908
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33585
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/ Frame B4F3 524 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8549058430066818552
age: 24911
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 11:58:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 11:58:27 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 168179
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame B4F3 63 KB
0 1ms
1ms Other
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 20372
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 13:14:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:14:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 63CE 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 72
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28720
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:52:26 GMT
expires: Mon, 24 Mar 2025 19:42:26 GMT
last-modified: Mon, 17 Mar 2025 19:42:52 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame B4F3 17 KB
13 KB 30ms
30ms XHR
application/json 2607:f8b0:4004:c07::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503180101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c07::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b442b0c5b3649c17a9e7e8e616bb0b976fb6467f6d864360b6ca8427af348896

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12905
date: Mon, 24 Mar 2025 18:53:46 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame B4F3 36 KB
8 KB 107ms
106ms Fetch
text/plain 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2896531595156795&correlator=3043898554167486&eid=31090916%2C31091186%2C31091200%2C83321073&output=ldjh&gdfp_req=1&vrg=202503180101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=583656235&sfv=1-0-41&sc=1&cookie=ID%3D24006709dfda166e%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA&gpic=UID%3D00000f177bda34b1%3AT%3D1742842418%3ART%3D1742842418%3AS%3DALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g&abxe=1&dt=1742842426522&lmt=1742842426&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=5krhgfp7c0m7&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=15&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742842426395&idt=78&adks=3360245792&frm=23&eo_id_str=ID%3Dbe60748eefae2607%3AT%3D1742842418%3ART%3D1742842418%3AS%3DAA-AfjbUCrwU3AH4rbq_zcs8wUQB&td=1&egid=59215&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff5eb6b0e75f6c88f7a5f11ea8006315132f8b2fc2310bd3dd8ac0c03578dbaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 18:53:46 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7945
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame C3FB 0
0 43ms
15ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=15

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:46 GMT
expires: Mon, 24 Mar 2025 18:53:46 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame B4F3 18 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 18:53:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:53:39 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 6C98 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c0b::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c0b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1785
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:23:54 GMT
expires: Mon, 24 Mar 2025 19:13:54 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 4F50 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::68
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::68 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-MYPqU-TDPfNTx7deakj-og' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 18:53:39 GMT
expires: Mon, 24 Mar 2025 18:53:39 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 464B 0
0 32ms
31ms Fetch
image/gif 2607:f8b0:4004:c06::9b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvsLTl6ShrggpSM1-NytZeZtgUWNEgdDGatrAW_Ro5BS0OW1Nfyqu-o5IG6y7rxYotn3O4VmafD5qVVY7RONnDNvks99H3GIPagasTq5LL-LUYHgkqTc2YM1H5yIZ-mqPmhF7b4Osy4Ksc6GbqZ-Ky0umjEBDP7xlvFUnVA7GVolSdUwe8HH3tvpv91b2adjmy1QyeQvftpYPb_CYaMrBouQJchUJfjYiB48AAHQUW_urNhlL6TsbgQq190g6qhtVz3G3HcsknD03k2qnyu-LWxIgxskrgN66FiyKA9UMpSRQzpEp80GZ3LSM3_7bYcq8MI5Lpmf_uKOO8PnEHRtpfDlBf-k3ByeTgTUdQTBar53HgVLgA1P8eaP5wHV_Xx8nGDGGuyT5oR1FX0467DEMXNcdbcM6AVVr9oqs-_lcOb1pfeGtLg35MYYmexUPgqLm0y0c_2ZJ8qUw&sai=AMfl-YTNO0ZyararGpAhoIAEK65Kp_DqXolP-fpaucd_CZE0XeVvSNVC1iMb17HAtVrjQn_wo0Z0BDL7xQG_L38jrtDgCbeUAv9QB_PNUiMqvvjbD-T_TbHhLGvkua0&sig=Cg0ArKJSzDcURXApRP7YEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Mon, 24 Mar 2025 18:53:46 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame 464B 9 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 1
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: zbUd08tNLFgh54iGW7DdHnNFZzZFb3wh_wn6gVvpMUfYtiCYHf6LDw==
date: Mon, 24 Mar 2025 18:53:38 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 464B 218 KB
0 1ms
1ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503180101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8765629121096803701
age: 331
x-content-type-options: nosniff
expires: Mon, 24 Mar 2025 19:48:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 18:48:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68860
x-xss-protection: 0
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 3AE4 0
0 0ms
0ms Document
text/html 2600:9000:250a:d000:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:d000:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 7
content-length: 12184
content-type: text/html
date: Mon, 24 Mar 2025 18:53:35 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 7375f2360b80ec8c602f04aa2cc7a57c.cloudfront.net (CloudFront)
x-amz-cf-id: o2b5u9MExQ8azvC1WQQ_7bJSFXaFXLA1Ts17WXmo_UqPEygmzm3m1w==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 11 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 10957
x-amz-cf-id: gr1m2FKwaOysxKdZYUcX602S7KY_bkEDzOH9YqySrBarXtrBlLqJwA==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 464B 0
0 24ms
24ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:46 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 464B 0
0 25ms
25ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Mon, 24 Mar 2025 18:53:46 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 464B 208 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b9192ddddddb3faebed59feae18e58144be0bf5307ef9d4eceaf6cc5e3e4027a

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 2EF4 2 KB
794 B 207ms
202ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Mon, 24 Mar 2025 18:53:46 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 30 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 30621
x-amz-cf-id: Bg29lKVoUluM6JrMXGclGtoeDhr8AASobKOOD6cIMy8eLUYfIAiL3g==
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET ads.js
ad.holmesmind.com/adserver/ Frame 2EF4 0
0

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: xkLkw77854B4mX-W9-rNpOk8S27q076s3PcRsQZu6ZQ-SifHszQBgg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 2EF4 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 18:53:40 GMT
access-control-allow-origin: *
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 40
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: 6D1CLIkr1IeCc2H8ADaGaAnYUciLZPr0vsKZMDZCaVj-YtGMM82lcg==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: 0WayM2KTZqbX1Rm9k6jSgxCgTo7BxyKJvNaasleybLuZYOpA_uYWcA==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 6
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: MDa-FoyQO5_TM-gqRIdFEB-ZCyu1WWyGEQUA_NOQjn4QfcFo5RLAYg==
date: Mon, 24 Mar 2025 18:53:35 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 2EF4 5 KB
0 4ms
4ms Script
application/javascript 2600:9000:250a:4200:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:4200:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 13
via: 1.1 f57a09c5455a80253c61001d750462e6.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: 9ofEUo0kclN-FnDO4ogTumr6U-rF45UnR-YHWA2E8X2K0CCq8--dyQ==
date: Mon, 24 Mar 2025 18:53:34 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST bids
prebid-asia.creativecdn.com/bidder/prebid/ Frame 2EF4 0
0

POST prebid.aspx
prebid.scupio.com/recweb/ Frame 2EF4 0
0

POST bid
ad2.apx.appier.net/v1/prebid/ Frame 2EF4 0
0

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 2EF4 0
186 B 17ms
16ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=62778089511

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:46 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 events
bidder.criteo.com/csm/ Frame 2EF4 0
186 B 17ms
16ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Mon, 24 Mar 2025 18:53:46 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 2EF4 43 B
0 0ms
0ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 2EF4 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Thu, 19 Mar 2026 18:53:40 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Mon, 24 Mar 2025 18:53:40 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 7A26 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: blog.alphaloan.co
URL: https://blog.alphaloan.co/wp-content/uploads/2021/04/%E6%A8%82%E5%A4%A9%E8%B2%B8-%E4%BF%A1%E7%94%A8%E7%AE%A1%E7%90%86%E6%8C%87%E5%8D%97-1.jpg

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gda_r20250319&jk=2946935026510602&bg=!np2lndLNAAaCZO-FomQ7ADQBe5WfODHGPx1igh-KWRntEooZUVtuJz8OG_S9JSdhs9hHh7OCnBlLtbYSI2Be87WXUfIRAgAAAFNSAAAABWgBB34ANW_8q_LLJIxAsXrpRhd8KPAMbcrfqCAx9uaFGnuPa_oYXaTGAR1vl4UbWUJUEizX_Vyx1jfLmQKckVQWqIJ-HN49AAQ4qeDylz3yH7K_hzhlZ9Ink-uWCdVZ2OIEsXRzGDwUXzGDDeEnDmD_m8jUXei9IL7Pjej32vEXLVZeGIFaNPDWnfXHYr0Fvu8BgFCZagZ4_DgT09ZqaaPDn0QSCQlP4AUYduMUjaJtzU--_FRum6Os3AsoJt3WNPbcPatDAXPZj9PnFMOGPrHMZVoYtuKEhNjmYZTH-QwmhdJMwy4i3BPQHv_d_8qj0fGmLqziJKua__lS8mYC4aPwRU-7LaQG5kGPacwawUYDr1pM9z_aD9C_JeVLSEZvI0bNq8QgZ6Y0fBgNJbImTCLdF0iFEj5iReAuRVQu6ZUQS0luADkz69fYTLlWEm-UITzQziSMrrTYxlhEQva47JoFixfhTBHLRSsXeFd1KM_RbtlMnd66FvPCxhaG1XYOX5rdWt47nUEowPusQTQt9M6QpHvc1dHZzqvesqVeJMPqHGHr0LdVY3LMf8K-dt91qXMlPKt6EwxlNZ40mIq5iNBeqq0l0giqirM3DrcQc0rCC-NxNjFncNJnboSllw7kdVdY7UEt9yq6_er2b8v-HMXMKCsB4GafjHZ29pqNvZ3HuYIC8CNwZzcb2Rjb31ufsLWT0KdZzIldBAZyZuzrJUJXHxXeC1RkgL2usnGyhO8L4USBJ7V-Uc9nS2XiSbdUg2Ci87BoMQ2KXpiMRj_3USle5VCyGbggP9bVIN_Hm39JunL1cjVK1HLhRwjzTW4eig70AsCMS1Pe59cUTrs1OafAdF3n9nkdwoHDYTfsr0TwV369b6ZI7x2h8B88GO8X9GDcpmnnIr-99UNjXEQJb8CRrOwJWIX0mejKC_hU_ONaizZFJMeYN-MD6CDsz2kyYojrNSmjnvCKHZU

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503180101&jk=2228542608900059&bg=!q6ilqOfNAAaCZO-FomQ7ADQBe5WfOB0pTEPYd6_8oFe89M2W4ocYhOQAvV5j_xnpccPFE0zXDTagxd39FI8u1m-NauXdAgAAAIlSAAAACGgBB34ANSJUVGtIxHxhC5gxamphJy3wQDLuO8NhNM7NmjSGzWj8_xlaNIYLifTlHUge20EMKOqaSn5FCgAscxG7bwUE-Kqv_jm4gsqR9IdB0d6oa2TK6LLJ952_frR6Vn2uZ8crXDWv5bKZAsAPp7paluqYbzctFN0xHr8ulj1hewBKbsyhy0aVAQGJn-w25ySLwZuIN08iB4BqFSfCrwVY6UYQwfb7zj5oEBiQM6Ox5Rc51qqFl6il8RotxeiMzBNDuOqU_ebBo2lFXvRTsWmkQvaRK_jUhsAEaOA1OB3u1jzGfnjgnB842ve3ZN5zu0yyB1p4_qR1WwhqQnZm3YGi9xXWO3efEVJr2MlzEgAUBucTJn9Z65WwQfJw_sJoCcY5IiyPVmlAZZm2_hHRdNNBlwZ49iBz_TikBULl27F2rlEC4BRuBUyZ9e6o0NerRL-ztIWQTtAqZ0nKXrmbSfK_61ZXQcED1xdGogjLiSvOFCfPQtgWb4HUF_zu2oO6ACRGaTdeE8M7xQUWYsYYHXPU1N3RgHHPxsS_eN-xGE1Ihi-QzIL5_JUGrCSsv5ZR65JF5v33Tpde-ug4O6rSi3OY0qPs6bOS9_SvO0MWpvxXt9ESK8suHy9py9t3XP5_9kFdyUtZRznbkx8DLzXTiBDiTN5hn-054SdrXjl2wHdADiou_NbDRP3JomNqIoVs2Nt-r92_GbZFs1MEs4XtowapfvGN-26_o3HvWiXFw7CcZKTdvLZmxueYPY7ng5PKo0tViXat2FM4BnWR23J94MdrZkkmj-lMyyyGFv6dkIcmU5xcxw-nSjVcWM6FLM91_Dn0rvPWdAHkh06P4XAiXHrLtpEeQ29XpgwCqQc6fniiW3TD_aboBLcxt_Fdiy68Vj_9gjtJMThYXSMfkW_JqzWoCeok4bfCfaH0P0jMeRyMVcrA4IWEvBFFGkncVNYq_Tv4anKctss2Yva-6Pvr5Wdd7Au3nYtBSCxi5mP-FKFhx4boso4j9sire-goeaJAk2OuYjnVxgcsEvKuO3RstJiVFm2bNYm19zmlAPgpxyJ42RinJxyGJBvoGlMTKg

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503180101&jk=2779968489831959&bg=!gYKlgs3NAAaCZO-FomQ7ADQBe5WfOAiJdCArK6nO5sJLzIf8FkkvzFw8dHuCfnMSvVBz4Jx2RJtTf5jfU3pbIyp_2h9vAgAAAHZSAAAACGgBB34ANeuVteA_TzH_m_69zY08AfkInWskGXGsXjzZsMuRkloA0zzcuiO7liP3aE7z83aMZ2UNVNKYCgBsdvTVEzhXJ3tdehgkrdf8f11L22KUCj-wHrMaYG49ntvDcZT0J0Ou1YmMw7Sxj5Mc0RNzn3CR-n81tg8So7O90p6oaJ7Ra8J8e8HiIbGUJkhG6SinIKj1IqMtsRqa79j6xpCfoayg4iM8mCaBmQK_TGFcEZMnbddcZ9fQqlFEE8un66l1yOx8GNPaUdnjAPA2AeICAHjWEHlsYMoSIElJenu2jecdMtS8VFDndsOKadM9GEPw5uTr-LxpgwAVqQ6jHbo6x4zBPHHtULEKwDq8TcIa0_r1BZ9EgC-Ii7IUb3wGJHr7QOfVI24NhYvPPtDb_5Z_6GRdmo1Hbk3DgmA7t_M7oaGwW1HhZxG3ER28fhlwBTZy6UCwSyAhGYLBeHW5w4pb-AHeg7dTY_OodQcmTqS5VG49n5IMKlnY_5IxCFHSk4L9dRV88mnI91rA1JhV6IAlGAL-lFHSNrNs9dmRAuft4kTOSdQlbJOkC1NU-x9Xa7_Jt88FCK6M3ag3gua5cuj_96O_tnQy0dgC9zQoWLui9sd7QrZaCN_2RoKz88qMbZCMRcw85wm8iDmNhs0VTMn8aSVFCkQ5b3HlClLIwttY8fNKMk5_jjToArrnM2s99owKtOtqEgn_isaBqMpq9LaBv1kZL9fKQCgqeR6FsDVGg6ZhR-_EUS0ngzKeR5BKt4yd7-j4zjiOHRvWKZiBSh15E0ngZvbJgJAs0x01T89Iy-VxFgB-si8A2zun1277f1QTASo0ps5hl4v69ohpNs1Gx8YcDe19e_8xrZfvzB618ljXnalMe1YgSmdcuaBpZ004TL1EzeUCd1T93Jteu-Wl_yppf5blukGjIp1J79_6oif75rU6Vlmv5iLbqJFTUoLG-ZbtlVNWTcCH7K7jW9hSYkhPd-na3qUlu3W1t4UewbsO0Agf0FY44zhT7br_RPQmxw90sOkP0ilkRJb4-jkRWJoFlQsK8q9rOav7btp3d_ZRQJT7J2c0d9adL5xrdMHFk-Z83t8LMJTV3cMtHh2emrWgJARfQdPhckRuD1I24OAPGZAzTNlBx5d6jrlzMtLf_lJahir3x9ZaQA

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503180101&jk=1526968813130016&bg=!cXKlcj3NAAaCZO-FomQ7ADQBe5WfOEg5N3LMT4lZQVkTUGp7RTH4hmtawE8li-TYSxhMlHEGi3Wu61jbEUAPfuuLGW6jAgAAAEtSAAAAEGgBB34ANRh2SSDACaIITbfQpVK9BQVm13UKRBOmRytGOMUuTyZTMOVcZicyGK3fUQfsVog7dWfl8TKVmQMAA0NjRWV1EKCQbt4IQdbGERccUhXLpkKGrLbHYcxTcfEEISIsZ21RLr_qJtNeYeW83OhsrnURybTh3LIoGSLirJgJV686STRgJJrjskEfqaepa-FQ_RW4S1r10InC7dphSnzdfptvtujfJKz8QvrZ8UiEEa65E-RNUzvtp3vYZIv1OiEl3LFiyt3Cbdb6bvI1JzciBLaLnZ4AnvTYtDSdTNje4sPJO-oJ7J3lzKcAQotvJNgfOvWjvGolru0qLt88In_OkRN1MjCp9HqZVabpJOoyZqd0qmykT23R2kc7sI-yBxOHTO6ChjyCeXm7QV__QBmZGyEy8oQn7fJ6NOzcVW_YrYPK8r7_s-P68P9f6m-rl8oVD-zPNbqxL4Zt4MdXZpQhWkTCvJiOKjpY5tmCspQdSVpCaZe6FGQuoDNjXGLFQ7GVGvaWJGNzqKpysT_WMYvCzoT6yxE3IRLzhPkyMfgh1FCtjF7YXmW1JiavzTaXbCWgoSG-9kq7A73NhnUkMqBKVMJ5FESZsS9ScMNcgPOMEJNudwt7gpmiVrfrIIiXwTrv1vJcye9TiJQj0VO8W3Mn0ehqO5qXO7h-SlOPrVp1r_CdhCdbEC2VyZlxfgEkPQK3vl7MLBtAPjdQBxrXt4qVobj2q6sqQVb8m6q8nfcbSQ7KqHGC6DRpB1mJHNmpYiYaBn9yysergLqrl98TDidFk9RzugzzgfcScz_i470YRwEinF4vz7aZrzoVXvwwvH3XRStxCXRkXBQvoohvfvwq95ZBsLPZPefRrXvMzcQN9q4gZn7wHfqsqleUzyqqeGzp1BRMXn4kpbykacyk6iJ_Z7DOcwH6CelL0kuoHSQIu2v--lR1UlRTvQbELpcavVVmr7WcngAF8OMnOlY0eYh-Z9dwNJ3obMhwByhHUyfjAUtYqXVKUk33ruOwY8lnLq_tW1cmn-gHnJmgCHkiDnkxIQg5jtTK-j0WGcqbecDPZ2v4DMtUdaK4rHt3YMFfe_EW6T4-GEp2HFp6FjwE

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503180101&jk=2560791326938257&bg=!DwylDEPNAAaCZO-FomQ7ADQBe5WfOClyNwiyzC0sVivEXl5VKrSDYhZSmGFZomkQPGUiNDzpQ_6A6i2QdvdfKuMc3HXDAgAAAFxSAAAABWgBB34ANYN8FAJZO6HAI1Yzmyx6gMshfIp4ntxRcTlWK2QjI1S52O0HlNoeg7eUBkdejot75ZBhjRwNmQMu2OiB4STSRf2lKNhCrmawc_DgRB5hQOaaTSWYxic3uczwv_VlZqXYZCOFMMP7J6rESQyvpCyYstFR23izVBbLvOK9BUuF-nsTPZtZPPK65ygX_tyVns-XZp5RXeMDTCAs8Plg8ur5_c-HFqd7R4RjIJmG4xAuBaCf61pdRWeegar4OE1kGhKoaCSKlJnUK3z7D6cyyWi9BYMklysxh1WGauCG-TcA-uVBMewq7Q0xAIumMcG0btkYmpLd1nr6uKQbfrZIMe8WftQolUCjgYZjb7-rhZVfp0alAIPOrSJf7pArS2bLhYtVnVkPohBPdiBYD2G1nCqDn9Un3M35TetWz1ZSQxf3Fb9J4cIK9gTAtIJLR3GT5iM6MdRI9LzHC3_mtQjJ1GIZrzlv_LymlPkUE0tmL7wXWweOCKAQ57pYrqG_MEzqiRP978KAoqlxONxsLIhQnPWz-L4EavjpoHaQ7reuOyJfVTFN60I0SZ6XR0aL-7hVB-HR19OkVbwJyjn2oamwnozu3vLd66gx8tzzITzCRaL4OJjDyYWJoEjCfk99VowrcLt6HWsX73t5DwjNeEFYiONSsx7B1vOpuxrbec0tXLGUQDceb39xqwTef_nfbE12kWbdaBjmg_bN_FDrpQqqz4--7Gm0v0JP5M1tsbHY1waYzJgd9msgRMWqjmhAsO4IEeSSAXjQKkyxIWKaRPMiXZRaXidFk4Ajk4vQVXPOCElLEZFN_LbtVoIruOvDFsPssE-hdX9EblpWlUfg2zT4aIzvk7sZqoG7IzVZf3v0HTG2xyRrkpHLZoAcDdrEeYoavtGiD4WbpblA_nCA-hnA8GpvFag5A8_JPYHTA968aasw6_erCOT8-FE2KRA4A2y_ywxfX4eKXv4Obc6zETgZyXaXm8hndT3lntsh-UuvB7kGbI2CP1Whz4SZgOV8Kus3oAn_G_uJE53k46TkfrjJUtSw1ndVppP7jcyNbATLqdOZtYpt_fmBUnzI4sfIRYxcAkxyAHC8Zr9YCuQhsFkqPPjVNeQArE09VCGZ3BI-RpxKwqbhIGob4H2K1TjfhRfj-215su1EP2e67Q

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503180101&jk=1673063210722150&bg=!FRalFlnNAAaCZO-FomQ7ADQBe5WfOB2FAKaUAiMYUlwLoZ8IZVbYYPxyjsJYTOrqtjh8_X-56m0x7Wg-xnKRjFde1l53AgAAAEhSAAAACWgBB34ANW8TEA-k026ZjNAOKf6Nykojgij0qa7TQoJjS7PXhrj6dXM-8J9nCbZd42xuV5w3pzES-CiHmQNd_A1hDGhZWo1ZwCoXSHB-ZAIycjLzEVUZ3EWoY_BAD2ilzk3n3IeztVqFPpz-MNU5PY0ACIxhCWPTnTec9mGaSMJP5lj6K3ejGxl_dA5YYuz-uy-1osW2FVdW1se_7JPu0kUt2sTMe51E06X3ALl-WMMOkboqkHfWai20f4Y5bEtr-nejhc2HBusQ7E4uGfEaEuLmST_eSm2JhbDvS61MlQvOr1QqdBpfofKnZDo6PBJ67e4lVTOziM85AjpSk6SlkRcZUZ_RbWkwT0Ron0o6we8H6Y0G9QVtK8ytue8WgJjBDZWQtlpvlxlLcfiW6OxEf1DyBpMPX8NvLx61lqr58UTmOayJVToGN39u_Rw6QlDdJFa2uDq38RbE2EawnU9ighg9REA_nqjPXIPdn0_vao2GqYylDy_XObgI4ZwfZ4IZi-1RISBJORLOnF5OXXT2GtMkGJO_owgdZoKnQpkdhf0Y8uWLFHidzqnv8oF_JQTDlGfhqr9fCtHPphx1cHB9UK5PpLLZa2AP8eHEj4yaPSQ50Nf-vDMoV-5ucHcRpNR6A3wwonOoYW0IMLHitWaM2sgjkcO9vz_UB_yyGQpqN8Yy_tSPlLcDegtyTn6dhCE8r5Ahnof2wodkNfKMAmAPaCPqR-xTMQj93jRBY1vnG13WlPR88-ic11gR7206QRrTbcF4CGIdSephRILAA78OfEJY92WpmBGm8pQDHR0rkuWgVYVQjSEnlH0rMLjYKBRdHR6WbRB1MsceBT-1AU5Pd1og90hv3SckDi74HyfQesNa8Q7AXh9XHZdOa70_nwZO1QdcrIWbSCCWRIt6jvBO-N9Kg1n-IscPT7_HMqIDhcPdn2OX_SXlvPOW_xHbzTJNnbea3W4QrIN2Deidb8y-HUK_oKv14qhCdLdQOdVO-ELZ7ZtCjInbJo7ZLRG9Jv4s-fZw93rM5f12QQeIA5aOt8seUhgDw1CySYBeHV7utHg8vdydLwo6CpN96u3wbRR4toRw87mATy0MNdC0GHcInteLOy1vj2ANAWQOGkkV2RkicGWMJ6MzoOoXZjdChLSLFNMNtKq76tJmO5nZEc_BBpKjiAxSdxhzI6aNw2CDvJB2aiPkqRZ0mHzkAie_axWcpcLAuqWxza4BDaPb

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=614&o=1&fc=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&d=1&b=2&ts=1&ii=2&FPCK=6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99&fp_uuid=6426-d59facf88ddbe5376a55ebd7fae7809b&initver=230627P

Domain: prebid-asia.creativecdn.com
URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids

Domain: prebid.scupio.com
URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.9250012094007007

Domain: ad2.apx.appier.net
URL: https://ad2.apx.appier.net/v1/prebid/bid

Domain: ad2.apx.appier.net
URL: https://ad2.apx.appier.net/v1/prebid/bid

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstnu2KVQVILB-GhtclMz-z3kD9SO9PVjWn5Os3MCOo4f2S3U2YwVzmT_7xQXPkVL2m_YO6K-BYFEv-HpdGiv1emdMpkQpyi6mUe9ynkZf9u1acELOMfA54-1iboPkipQA05hqlFzOuqPRIkkTlliAMiboE6W58DD07Wj5pgb0gGtwU&sig=Cg0ArKJSzPwa-fYc_wl0EAE&id=lidar2&mcvt=1001&p=108,650,358,950&tm=1651.3999996185303&tu=650.6000003814697&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20250319&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3360245792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3877522500&rst=1742842425336&rpt=689&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Verdicts & Comments Add Verdict or Comment

100 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

46 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.reurl.cc/	1970-01-21 04:08:48	Name: _gid Value: GA1.2.2042357341.1742842418
.reurl.cc/	1970-01-21 04:07:22	Name: _gat Value: 1
.reurl.cc/	1970-01-21 06:16:58	Name: _fbp Value: fb.1.1742842418129.133581164277613316
.reurl.cc/	1970-01-21 13:43:22	Name: _ga Value: GA1.1.1802819371.1742842418
.reurl.cc/	1970-01-21 13:43:22	Name: _ga_N394QBRGC0 Value: GS1.1.1742842418.1.0.1742842418.60.0.0
.reurl.cc/	1970-01-21 13:43:22	Name: _ga_ZDFZCDVDK1 Value: GS1.1.1742842418.1.0.1742842418.0.0.0
.criteo.com/	1970-01-21 13:28:58	Name: uid Value: 1531a478-31b1-484a-b088-152a80627632
.doubleclick.net/	1970-01-21 13:43:22	Name: IDE Value: AHWqTUkYVxxgfOk1BCsZFt9VmCPPfgOWygvAG1OwWi90EiwWrESdT9osBt0750c2l8w
.reurl.cc/	1970-01-21 13:28:58	Name: __gads Value: ID=24006709dfda166e:T=1742842418:RT=1742842418:S=ALNI_MaB05_fBNfjXGNWfzaMFF3G2CW7SA
.reurl.cc/	1970-01-21 13:28:58	Name: __gpi Value: UID=00000f177bda34b1:T=1742842418:RT=1742842418:S=ALNI_MbPemXylBkJEC2Hngb5zO2px-nm5g
.reurl.cc/	1970-01-21 08:26:34	Name: __eoi Value: ID=be60748eefae2607:T=1742842418:RT=1742842418:S=AA-AfjbUCrwU3AH4rbq_zcs8wUQB
.holmesmind.com/	1970-01-21 13:43:22	Name: P Value: 933860-OM4y2SfYQONzIB6j2zWaF6JgCShunZeC
.holmesmind.com/	1970-01-21 04:28:29	Name: Vision Value: 20250325-23:59,20250325-05,20250325-05,20250325-23:59
.holmesmind.com/	1970-01-21 04:28:29	Name: C Value: null
.holmesmind.com/	1970-01-21 06:32:20	Name: RK Value: null
.reurl.cc/	1970-01-21 12:52:58	Name: FCNEC Value: %5B%5B%22AKsRol9TbMFj3vOoHQciMLVSQtCjj-MkPa1oWc6pqhCRO3uIvFBrXLms1Qwa3blYjrYTyggbIKRDyJzUN8bjh5mFkO84QMDk36AiumZqQq8tpgd45Csa7rc2zKmtN8zN4_Jd7gwktl2ZA_BJjM7Bij2cEZFc_K1sWQ%3D%3D%22%5D%5D
.reurl.cc/	1970-01-21 12:52:58	Name: _ss_pp_id Value: de8fe32331a4d603d731742878419835
.reurl.cc/	1970-01-21 04:50:34	Name: ISMD5VERSION Value: 1
.holmesmind.com/	1970-01-21 04:08:48	Name: fcm Value: 1
.reurl.cc/	1970-01-21 04:07:22	Name: _tg_csi Value: 1
.reurl.cc/	1970-01-21 04:50:34	Name: CFFPCKUUID Value: 7408-vcOJHoyqUHVwieBpmCbFcOIaocUMYGSR
.reurl.cc/	1970-01-21 04:50:34	Name: CFFPCKUUIDMAIN Value: 6426-ZqM3lS9trAd1djP4pOZ1Jqmig20eQI99
.reurl.cc/	1970-01-21 04:50:34	Name: FPUUID Value: 6426-d59facf88ddbe5376a55ebd7fae7809b
.hinet.net/	1970-01-21 13:43:22	Name: uuid Value: 3c9e96b0-c72a-461c-98d7-c7c3700bb867
.reurl.cc/	1970-01-21 13:43:22	Name: _td Value: 2ef1133a-07a5-4801-8041-7170c5f6cb4b
track.91app.io/	1970-01-21 13:43:22	Name: deviceid Value: 68b9f48e-f18d-47c8-b1e9-f5ef04ea7635
.prnasia.com/	1970-01-21 04:07:24	Name: __cf_bm Value: eUlz1UJaOSYm6e6KJU3IFF_wPPGP.8358FYS.bYBe2E-1742842420-1.0.1.1-CUlRuP6GDseEi6eTicemHosao5mVPifXSCJF.IZNpeJ2vNWz.FGiV6J2zqw4foIxG9_qSm3QXMkFE9FAKeuyLNsWdiL73VXQQEG5cMKNW.A
onead.onevision.com.tw/	1970-01-21 12:52:58	Name: onevision_guid Value: 4d1bba66-08e1-11f0-9211-0242ac120002
onead.onevision.com.tw/	1970-01-21 12:52:58	Name: oid Value: 4d1bba58-08e1-11f0-9211-0242ac120002
reurl.cc/	1970-01-21 12:52:58	Name: oid Value: %257B%2522oid%2522%253A%25224d1bba66-08e1-11f0-9211-0242ac120002%2522%252C%2522ts%2522%253A-62135596800%252C%2522v%2522%253A%252220201117%2522%257D
.lndata.com/	1970-01-21 12:53:27	Name: admckid Value: 2503250253401991945
.popin.cc/	1970-01-21 12:52:58	Name: uid Value: de8fe32331a4d603d731742878419835
.reurl.cc/	1970-01-21 12:52:58	Name: __htid Value: 3c9e96b0-c72a-461c-98d7-c7c3700bb867
.reurl.cc/	1970-01-21 04:07:26	Name: _ht_em Value: 1
.adsrvr.org/	1970-01-21 12:52:58	Name: TDID Value: b490a08a-66a6-4aa2-8dff-0184c0717707
.adsrvr.org/	1970-01-21 12:52:58	Name: TDCPM Value: CAEYBSABKAIyCwjGqMPK_cP1PRAFOAE.
.eyeota.net/	1970-01-21 12:52:58	Name: mako_uid Value: 195c980ddec-41000000010a4271
.eyeota.net/	1970-01-21 04:07:23	Name: SERVERID Value: 17009~DM
.crwdcntrl.net/	1970-01-21 10:36:07	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 10:36:07	Name: _cc_id Value: 1dfd8ff382419ff6ace06f240b39cf69
.yahoo.com/	1970-01-21 12:53:20	Name: A3 Value: d=AQABBDSq4WcCEK9GjqaTt8xkwgYWpz1Z8DMFEgEBAQH74mfrZ9xH0iMA_eMAAA&S=AQAAAiqAErh8eVMvym5um7TH4u0
.analytics.yahoo.com/	1970-01-21 12:52:58	Name: IDSYNC Value: 19d3~2o8i
.reurl.cc/	1970-01-21 04:08:48	Name: _ht_50ef57 Value: 1
.holmesmind.com/	1970-01-21 04:28:29	Name: R Value: null
.holmesmind.com/	1970-01-21 06:32:20	Name: G Value: we3u7ZGJymKY5J47cKd8kQ==
.reurl.cc/	1970-01-21 04:08:48	Name: _ht_hi Value: 1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://reurl.cc/XqAx30(Line 76) Message: [GroupMarkerNotSet(crbug.com/242999)!:A04080067C3D0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://blog.alphaloan.co/wp-content/uploads/2021/04/%E6%A8%82%E5%A4%A9%E8%B2%B8-%E4%BF%A1%E7%94%A8%E7%AE%A1%E7%90%86%E6%8C%87%E5%8D%97-1.jpg Message: Failed to load resource: net::ERR_CONNECTION_REFUSED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

280a8aab22bc04a677066a47b1924ae7.safeframe.googlesyndication.com
3c9e96b0-c72a-461c-98d7-c7c3700bb867.t.ssp.hinet.net
4be028d0a3bce52d61ec275ff0d2ade0.safeframe.googlesyndication.com
78f7cd0fdb93516167ee3c08e97fd0ac.safeframe.googlesyndication.com
7a4784ef0ce39265869b45251d17a180.safeframe.googlesyndication.com
ad-specs.guoshipartners.com
ad.holmesmind.com
ad.tagtoo.co
ad2.apx.appier.net
adx.holmesmind.com
aed6678fc581a2434151e97a807addd1.safeframe.googlesyndication.com
analytics.google.com
api.popin.cc
b3950cbdc037fba3a3da0b38edfe69f5.safeframe.googlesyndication.com
bcp.crwdcntrl.net
bidder.criteo.com
blog.alphaloan.co
cdn-ima.33across.com
cdn.holmesmind.com
cdn.jsdelivr.net
cms.analytics.yahoo.com
connect.facebook.net
cpt.geniee.jp
creditcards.com.tw
ecs.tagtoo.co
eebbd97b8352184ae398a5e40538feac.safeframe.googlesyndication.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
fundingchoicesmessages.google.com
gocm.c.appier.net
googleads.g.doubleclick.net
gum.criteo.com
img.gbyhn.com.tw
img.racingcharger.tw
invstatic101.creativecdn.com
log.popin.cc
match.adsrvr.org
mma.prnasia.com
oa.openxcdn.net
onead.onevision.com.tw
pagead2.googlesyndication.com
prebid-asia.creativecdn.com
prebid.scupio.com
ps.eyeota.net
r.popin.cc
re-news.tw
reurl.cc
s.w.org
securepubads.g.doubleclick.net
static.criteo.net
static.wixstatic.com
stats.g.doubleclick.net
storage.reurl.cc
t.ssp.hinet.net
td.doubleclick.net
trc.taboola.com
tw.popin.cc
uec.tagtoo.co
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
yads.c.yimg.jp
ad.holmesmind.com
ad2.apx.appier.net
blog.alphaloan.co
ep1.adtrafficquality.google
pagead2.googlesyndication.com
prebid-asia.creativecdn.com
prebid.scupio.com
103.1.220.9
103.132.192.30
104.18.29.101
107.178.241.176
119.63.193.220
119.63.198.143
119.63.198.188
119.63.198.189
168.95.246.2
172.104.70.67
18.207.77.150
182.22.28.252
192.0.77.48
192.0.78.25
2001:4998:60:807::1
203.137.133.152
203.75.214.136
210.59.219.34
23.21.95.27
2600:9000:250a:4200:0:e06c:e940:93a1
2600:9000:250a:d000:0:e06c:e940:93a1
2600:9000:250b:ba00:1e:5c56:d400:93a1
2606:4700:3034::6815:6009
2606:4700::6812:5fe1
2607:f8b0:4004:c06::9b
2607:f8b0:4004:c07::61
2607:f8b0:4004:c07::84
2607:f8b0:4004:c07::9b
2607:f8b0:4004:c07::9c
2607:f8b0:4004:c09::64
2607:f8b0:4004:c09::84
2607:f8b0:4004:c0b::84
2607:f8b0:4004:c17::84
2607:f8b0:4004:c17::9a
2607:f8b0:4004:c17::9d
2607:f8b0:4004:c1d::65
2607:f8b0:4004:c1d::68
2607:f8b0:4004:c1f::84
2607:f8b0:4004:c1f::9c
2607:f8b0:4004:c23::66
2620:100:a00b::12
2620:100:a00b::30
2620:100:a00b::5
2a03:2880:f003:100:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
2a04:4e42:400::300
2a04:4e42::485
34.102.146.192
34.102.218.41
34.107.150.21
34.111.12.34
34.149.98.30
34.160.26.175
34.96.70.87
35.185.130.121
35.190.36.98
35.71.131.137
54.64.195.61
039e147a3d5e4b0857c0230686525f58ab3b688ea092c8d963be13ac1ae0bc19
0614ad45d47a5da6d9880c2e175c88526cd223c16d2121e48bab3a9e1121f55d
0998d6382acb0f6e138b52627326cf92925e5ad7ffa4fdf1e9671fb9b000d1f0
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bfbf9c7b3d1a2d375e53ae92784a94bf72d26ebea6a9da9959534c25d735edb
0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2
154756d9ef9ccda08301e80b17ea39290072b0fc20a78c42a53a0a5ba69fb44e
16cf673198b29bb08e83f5d8f74182d97d9c6dfa729c60f90f6195e739de9d20
1bf41ca1364230ce3a9cbbac1110ff4d7d287a9f978fa74297aa30117c4da9c0
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
22743d9dc93a38d7096ec7c9a02146da7a721ada15192d87e81d78ff53cb2f2a
24c55f7fd45388e8a6c4fb7fc8bdae53992181227bb8f77f1d4dc04be9f15556
2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840
2b278a587d7e8f768a5ef65c2c68d1582d0973bfc0bba7b00bb6e79c91bedf33
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
2f909dd342aef5ab96540e18355cd9b2def60e3a7c1a07bafb80ee5d68706dc7
3050a5556edc5876cd83e63f15e56fe19cb428129345a58d1f57687414504698
3108e15dfc911f1a730106ee1e44c941639e0b7add838d095680425e86d086c3
31a5f757ff8d7554aeb08a7d3d6eb2b53105d17a65edd83ea2069c2fbd7078d1
31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30
3402df1af7b8665c51ac7e2d4fed5dc6cac147d61966672d9cf32a34acafedfe
356e1291f3462c7ddfe39513724f1c43cabf924d12f2f0b519507bbd3f2a81e7
365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60
395afb1491e62cb0666325882b2d9ffd6258f76bc2da4f8c163e0b484d82927e
41adb3d78536e2e60085bf89e09aaec01a8ce5d471c8464215bea5bbec834091
41b6df60b231652947d4a4da0453deb794071493603286fb01c14db9b1d7340e
41f1e998e52a0d2246aafeebc3e4de5954376a9ce825bec7dec508f4735e967d
43a71fb6e8f61126f7dfb3fe8a1a01eba8cfbff5cd7d681bba0e62f64ad924c7
466b4a6c2c47478a104f80a757d2c06af42c6adfec939b18e7990bc1f6fa5460
46e977bd2e693545c10424af0ca8ae2061ce096d8e5658d997fa9ca60471e26d
4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
53ac2c4022ed265cc386becd9a35906eda0605ec279afd17aa504b623589304d
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
59401c1a8084a5decb6f46cf4f61e8fe03757bc0a12b2f3fdf74d16c167e464d
5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd
5b5acd745767a417e4bc397709b7e224ffcbe056b2e84f52eaac884edd02eab7
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e
667e34f03f50b1c07d822ad2f55165c960d0804feedd94c3fc3ead74d94a5896
6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484
683d63e065c7f1f8d25da805bf920d2878570d165cd4f242aef222a2cd052b38
698fe0a6500f771d98d1ca713a5445d523fac649207572b69123699702854c0b
6c5c52c209ca459d0c60b26683a53040eafbb96d0fa5c429564af83c430e928a
71afc14e1829932d2c76ba5813ef3a39f64c39ed1edf23f119b62ebfcb2a9042
72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3
724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd
73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c
749079c4e18ad34ac381e98d3fa23e070937ae17b73e27bb066eae5350ed667d
76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517
80279f6baf172b794e35da391ac30711c57a3276abda4280d170920df9cca9b1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624
8aad7f034c2e39ee145189b327d6b1df64240486e08c7eba41d399e7e72797a6
8af9b1ee62f973942149a71cabed6fd4c0ece937718e342101e64e36d36e4248
8cc946459be42c672452945bcf67119bd6318112ba16b1c205db76e8fe7e2bd1
8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e
8fae9fe9566bc3457a4ac2b0e84907bdabbb890bb99c377ff49048ace7772151
92f9f001e9f335dc3ba11338e516af016b641679e9195f7aeb9a753b05ee750a
93148e62c4898c0d782a7ea80f16e62774f7c58d81436f9c1cf40defd44dd6cc
93155c81b70401839a5573d0374b8a2fa72bf0f9796249368674301b787f3782
94c63f262e0481bf1f206e6ed8ec68a8c1726032a819cb7f2b445b95c56de82d
95634eb651772e9ecc489c8a2e12cccb71cd06089ae3f03f8dab3654ce669c8c
9cf1114324a6653750f0f8af7783a744e45adadca47c48844e4ee0f11df269bf
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab2487bc853dc41b472be1d0b2695310c8945fd79bc0c6da93fea72f3c4a9573
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b442b0c5b3649c17a9e7e8e616bb0b976fb6467f6d864360b6ca8427af348896
b4602462940e2fd6d0b728b0b5153eba2e87fff5925bde6e7f2932fefd0d66e5
b5f6e07c77e56473c5efd8938f520c776b82ea12baead9671524cd8e44836b13
b6c5af2d5c532a14b5aa51656c9d5e8be329b1424ec1df2947ad2de309622448
b8536556ee8cc8c7415f96bd98e7a1b6454c7c3351ab498bde21c555ffefce05
b9192ddddddb3faebed59feae18e58144be0bf5307ef9d4eceaf6cc5e3e4027a
b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5
ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22
bc73ed340ef20534b613afea9bd95f199a55b77beab7c472e92ad92b4e39a1aa
c280d38004a82811e8659f68bbd6dc8dde7f7c6a95d3172d7ddec4acf8c96d6f
c428b740924097b3a2ea1f0e7eb0c6aeb3bb4bd0f590894a5e87919c8f4ab7a0
c6702331c81284a2109563f8711b4da9c155e68ae086edd8e0168f534616a435
c8e9318c3c4d4267ff19a29ff8e36700e7e2b9de1dc992191a6e7157c4b97924
cd0db2d68f6fb00e1197e823f47e1f53aa2aa2ae85228a5e5d04a4a863629cc1
cd795f959cb737bc280b0558d6e0c798e465a3c56e5bdc28051ef8e523d8f86d
cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda
d4474b8452874cfdb506a736b898a56dc90b1ec3aee9cbe81fb6f429307beb4f
d62affff3951f9723bbf1827f6576b6819a392d96f246708d8fd58e8240a4503
ddd9d29beabaeecc9c76408242dfc2b76305ec52511992d3cfbc81a500ee0670
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e2c5c24736cd092e4c6eccfe2fbf4d481efbd14132097abc0cfd26d68addd347
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7bc8cee2dc81120401d7efd046ca7de29edce565de2cf16fbc44ee53d0f5e23
e7e4fb9b3b1239835abc60fd16d2e64da36bfa919b8e81f11eea442c2bbf05f2
e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990
eb646ba72130ce91f6f7de7af02891539e2f1ea5da8816d56fc3c96772ad46a1
ed1353670cbe52a301571e6717fab543726f43f7bed2edd0ffca2e74f6a1d8bf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2653c01792aabd651248a7c0e00af87bcc8802bbded85da906a14e11bb197fc
f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b
f4d7d42dbc39cc7838b8ac43f9c9baf89f49202667512fa1e3ed29024a91c501
f657e73f3a6891ab1c889b8c2aaf6c1b3242902d0f7d47b9e846ab1e33d95d71
f7865980e9f454d04131ef3fa51798d6cc10444ba66e98ee167fb21350374de4
f7ca876c0cb02210c50ef29c5047b4cc3f10f1273b3ea317362df7fb55559391
f984bf1d0a76c530de4d80f2c0fb361c90e3bc2aee68d6ea0b2f26f9a2341c97
fa26861b2c0ce3230e2337b5dd41c5801c9683ba0c1cd13c60fa1f9509648146
fd491a1edce925c3fdb8647416511e31d6d4f72213eb144f5ead2d6b2654d638
fdcb21ac3668fc76876634684b5d8eb7caf582058b60e452575201bb1b8e88f1
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99
ff5eb6b0e75f6c88f7a5f11ea8006315132f8b2fc2310bd3dd8ac0c03578dbaa

reurl.cc Open in urlscan Pro 35.185.130.121 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

360 Requests

93 %HTTPS

50 %IPv6

38 Domains

64 Subdomains

55 IPs

5 Countries

3084 kBTransfer

13900 kBSize

46 Cookies

20 Outgoing links

Redirected requests

360 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

reurl.cc Open in urlscan Pro
35.185.130.121 Public Scan

Screenshot
Live screenshot

Full Image

360
Requests

93 %
HTTPS

50 %
IPv6

38
Domains

64
Subdomains

55
IPs

5
Countries

3084 kB
Transfer

13900 kB
Size

46
Cookies

360 HTTP transactions
9 data transactions