reurl.cc Open in urlscan Pro
35.185.130.121 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://reurl.cc/XqAx30
Submission: On March 25 via api (March 25th 2025, 1:14:11 am UTC) from JP — Scanned from US

Summary HTTP 281 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 59 IPs in 5 countries across 39 domains to perform 281 HTTP transactions. The main IP is 35.185.130.121, located in Taipei, Taiwan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is reurl.cc. The Cisco Umbrella rank of the primary domain is 200657.
TLS certificate: Issued by R11 on March 14th 2025. Valid for: 3 months.

This is the only time reurl.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	35.185.130.121 35.185.130.121	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a04:4e42:400... 2a04:4e42:400::485	54113 (FASTLY) (FASTLY)
5	34.149.98.30 34.149.98.30	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2607:f8b0:400... 2607:f8b0:4004:c19::61	15169 (GOOGLE) (GOOGLE)
5	2607:f8b0:400... 2607:f8b0:4004:c1d::9d	15169 (GOOGLE) (GOOGLE)
3	203.137.133.156 203.137.133.156	4694 (IDCF IDC ...) (IDCF IDC Frontier Inc.)
2	168.95.245.4 168.95.245.4	131660 (CHTCDN Da...) (CHTCDN Data Communication Business Group)
5	107.178.241.176 107.178.241.176	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	31.13.66.35 31.13.66.35	32934 (FACEBOOK) (FACEBOOK)
2	31.13.66.19 31.13.66.19	32934 (FACEBOOK) (FACEBOOK)
3	2607:f8b0:400... 2607:f8b0:4004:c21::8a	15169 (GOOGLE) (GOOGLE)
2	34.160.26.175 34.160.26.175	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	182.22.16.251 182.22.16.251	23816 (YAHOO Yah...) (YAHOO Yahoo Japan Corporation)
25	142.251.167.154 142.251.167.154	15169 (GOOGLE) (GOOGLE)
3 3	2001:4998:14:... 2001:4998:14:800::1000	14777 (YAHOO) (YAHOO)
2 2	100.28.140.230 100.28.140.230	14618 (AMAZON-AES) (AMAZON-AES)
2 2	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 2	52.3.138.212 52.3.138.212	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42::300 2a04:4e42::300	54113 (FASTLY) (FASTLY)
2	172.253.115.139 172.253.115.139	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:5fe1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.67.150.31 172.67.150.31	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	103.1.220.9 103.1.220.9	131149 (YUANJHEN-...) (YUANJHEN-AS-TW Yuan-Jhen Info.)
1	192.0.77.48 192.0.77.48	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2600:9000:250... 2600:9000:250b:c200:1e:5c56:d400:93a1	16509 (AMAZON-02) (AMAZON-02)
4	2607:f8b0:400... 2607:f8b0:4004:c08::71	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c06::9c	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1f::9c	15169 (GOOGLE) (GOOGLE)
5	142.251.167.155 142.251.167.155	15169 (GOOGLE) (GOOGLE)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
13	2620:100:a00b... 2620:100:a00b::30	19750 (AS-CRITEO) (AS-CRITEO)
1	104.18.29.101 104.18.29.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.31.132 142.250.31.132	15169 (GOOGLE) (GOOGLE)
1	2620:100:a00b... 2620:100:a00b::12	19750 (AS-CRITEO) (AS-CRITEO)
3	119.63.193.220 119.63.193.220	38627 (BAIDUJP B...) (BAIDUJP Baidu)
28	142.251.111.155 142.251.111.155	15169 (GOOGLE) (GOOGLE)
39	2600:9000:250... 2600:9000:250a:7c00:0:e06c:e940:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:250... 2600:9000:250a:b800:0:e06c:e940:93a1	16509 (AMAZON-02) (AMAZON-02)
7	172.253.122.101 172.253.122.101	15169 (GOOGLE) (GOOGLE)
9	54.64.195.61 54.64.195.61	16509 (AMAZON-02) (AMAZON-02)
1	119.63.198.189 119.63.198.189	38627 (BAIDUJP B...) (BAIDUJP Baidu)
1	34.111.12.34 34.111.12.34	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	34.107.150.21 34.107.150.21	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
17	203.75.214.136 203.75.214.136	3462 (HINET Dat...) (HINET Data Communication Business Group)
3	119.63.198.143 119.63.198.143	38627 (BAIDUJP B...) (BAIDUJP Baidu)
1	34.102.218.41 34.102.218.41	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	210.59.219.34 210.59.219.34	3462 (HINET Dat...) (HINET Data Communication Business Group)
3	103.132.192.30 103.132.192.30	138552 (RTBHOUSE-...) (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD.)
5 10	35.190.36.98 35.190.36.98	15169 (GOOGLE) (GOOGLE)
5 5	172.105.213.147 172.105.213.147	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1	192.96.203.13 192.96.203.13	30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
8	2620:100:a00b::5 2620:100:a00b::5	19750 (AS-CRITEO) (AS-CRITEO)
1	119.63.198.188 119.63.198.188	38627 (BAIDUJP B...) (BAIDUJP Baidu)
5	172.253.115.156 172.253.115.156	15169 (GOOGLE) (GOOGLE)
1	172.253.115.132 172.253.115.132	15169 (GOOGLE) (GOOGLE)
1	64.233.180.132 64.233.180.132	15169 (GOOGLE) (GOOGLE)
1	172.253.122.132 172.253.122.132	15169 (GOOGLE) (GOOGLE)
10	2607:f8b0:400... 2607:f8b0:4004:c1d::84	15169 (GOOGLE) (GOOGLE)
5	172.253.62.105 172.253.62.105	15169 (GOOGLE) (GOOGLE)
1	172.253.63.154 172.253.63.154	15169 (GOOGLE) (GOOGLE)
1	142.251.163.132 142.251.163.132	15169 (GOOGLE) (GOOGLE)
281	59

1 35.185.130.121 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 121.130.185.35.bc.googleusercontent.com

reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:400::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.149.98.30 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 30.98.149.34.bc.googleusercontent.com

storage.reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c19::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4004:c1d::9d (Washington, United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 203.137.133.156 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)

cpt.geniee.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 168.95.245.4 (Palo Alto, United States)

ASN131660 (CHTCDN Data Communication Business Group, TW)
PTR: 168-95-245-4.hinet-ip.hinet.net

ad-specs.guoshipartners.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 107.178.241.176 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 176.241.178.107.bc.googleusercontent.com

onead.onevision.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 31.13.66.35 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-iad3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.66.19 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4004:c21::8a (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.160.26.175 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 175.26.160.34.bc.googleusercontent.com

re-news.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 182.22.16.251 (Japan)

ASN23816 (YAHOO Yahoo Japan Corporation, JP)

yads.c.yimg.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 142.251.167.154 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f154.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4998:14:800::1000 (United States) 3 redirects

ASN14777 (YAHOO, US)

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 100.28.140.230 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-28-140-230.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.33.220.150 (Seattle, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.3.138.212 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-138-212.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.253.115.139 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f139.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:5fe1 (United States)

ASN13335 (CLOUDFLARENET, US)

mma.prnasia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.150.31 (United States)

ASN13335 (CLOUDFLARENET, US)

img.gbyhn.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.1.220.9 (Taiwan)

ASN131149 (YUANJHEN-AS-TW Yuan-Jhen Info., Co., Ltd, TW)
PTR: ph2.g-dns.com

img.racingcharger.tw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org

s.w.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:250b:c200:1e:5c56:d400:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.wixstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2607:f8b0:4004:c08::71 (Washington, United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c06::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1f::9c (Washington, United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.251.167.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: ww-in-f155.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2620:100:a00b::30 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.29.101 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn-ima.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.31.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bj-in-f132.1e100.net

fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:100:a00b::12 (United States)

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 119.63.193.220 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

api.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 142.251.111.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f155.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 2600:9000:250a:7c00:0:e06c:e940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:250a:b800:0:e06c:e940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.253.122.101 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f101.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 54.64.195.61 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com

ad.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.63.198.189 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

tw.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.12.34 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 34.12.111.34.bc.googleusercontent.com

ad.tagtoo.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.150.21 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 21.150.107.34.bc.googleusercontent.com

uec.tagtoo.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 203.75.214.136 (Taipei, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 203-75-214-136.hinet-ip.hinet.net

t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 119.63.198.143 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

log.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.218.41 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 41.218.102.34.bc.googleusercontent.com

ecs.tagtoo.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 210.59.219.34 (Taichung City, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 210-59-219-34.hinet-ip.hinet.net

prebid.scupio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 103.132.192.30 (Singapore)

ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG)
PTR: ip-103-132-192-30.rtbhouse.net

prebid-asia.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 35.190.36.98 (Kansas City, United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: 98.36.190.35.bc.googleusercontent.com

ad2.apx.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.105.213.147 (Tokyo, Japan) 5 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1867-147.members.linode.com

gocm.c.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.96.203.13 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)

hb.aralego.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2620:100:a00b::5 (United States)

ASN19750 (AS-CRITEO, US)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 119.63.198.188 (Japan)

ASN38627 (BAIDUJP Baidu, Inc., JP)

r.popin.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.253.115.156 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f156.1e100.net

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.115.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f132.1e100.net

f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.180.132 (United States)

ASN15169 (GOOGLE, US)
PTR: pe-in-f132.1e100.net

557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.122.132 (United States)

ASN15169 (GOOGLE, US)
PTR: bh-in-f132.1e100.net

6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4004:c1d::84 (Washington, United States)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 172.253.62.105 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f105.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.154 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f154.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.163.132 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f132.1e100.net

294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
53	holmesmind.com cdn.holmesmind.com — Cisco Umbrella Rank: 144812 ad.holmesmind.com — Cisco Umbrella Rank: 113263 adx.holmesmind.com Failed	96 KB
38	doubleclick.net securepubads.g.doubleclick.net — Cisco Umbrella Rank: 289 stats.g.doubleclick.net — Cisco Umbrella Rank: 284 td.doubleclick.net — Cisco Umbrella Rank: 327 googleads.g.doubleclick.net — Cisco Umbrella Rank: 70	261 KB
33	googlesyndication.com fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 157 f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com 557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com 6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com 294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com	657 KB
17	hinet.net t.ssp.hinet.net — Cisco Umbrella Rank: 92735 bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net Failed	6 KB
16	google.com analytics.google.com — Cisco Umbrella Rank: 253 fundingchoicesmessages.google.com — Cisco Umbrella Rank: 649 www.google.com — Cisco Umbrella Rank: 10	72 KB
15	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 512 ep2.adtrafficquality.google — Cisco Umbrella Rank: 514	70 KB
15	appier.net 10 redirects ad2.apx.appier.net — Cisco Umbrella Rank: 115896 gocm.c.appier.net — Cisco Umbrella Rank: 5598	4 KB
13	criteo.net static.criteo.net — Cisco Umbrella Rank: 1135	56 KB
9	criteo.com gum.criteo.com — Cisco Umbrella Rank: 610 bidder.criteo.com — Cisco Umbrella Rank: 1746	1 KB
8	popin.cc api.popin.cc — Cisco Umbrella Rank: 22807 tw.popin.cc — Cisco Umbrella Rank: 125846 log.popin.cc — Cisco Umbrella Rank: 93722 r.popin.cc — Cisco Umbrella Rank: 102226	97 KB
6	reurl.cc reurl.cc — Cisco Umbrella Rank: 200657 storage.reurl.cc — Cisco Umbrella Rank: 279374	7 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 116	22 KB
5	onevision.com.tw onead.onevision.com.tw — Cisco Umbrella Rank: 153929	2 KB
4	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 3260 prebid-asia.creativecdn.com — Cisco Umbrella Rank: 20685	3 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 129	228 B
3	scupio.com prebid.scupio.com — Cisco Umbrella Rank: 143006	504 B
3	tagtoo.co ad.tagtoo.co — Cisco Umbrella Rank: 167837 uec.tagtoo.co — Cisco Umbrella Rank: 130520 ecs.tagtoo.co — Cisco Umbrella Rank: 121351	62 KB
3	yahoo.com 3 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 3132 ups.analytics.yahoo.com — Cisco Umbrella Rank: 830	935 B
3	geniee.jp cpt.geniee.jp — Cisco Umbrella Rank: 35259	70 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 107	404 KB
2	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1557	2 KB
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 564	1 KB
2	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 1587	728 B
2	re-news.tw re-news.tw	31 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 255	80 KB
2	guoshipartners.com ad-specs.guoshipartners.com — Cisco Umbrella Rank: 181880	24 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 427	58 KB
1	aralego.com hb.aralego.com — Cisco Umbrella Rank: 63595	130 B
1	33across.com cdn-ima.33across.com — Cisco Umbrella Rank: 1907	7 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 3358	8 KB
1	wixstatic.com static.wixstatic.com — Cisco Umbrella Rank: 8835	1011 KB
1	w.org s.w.org — Cisco Umbrella Rank: 7227	730 B
1	racingcharger.tw img.racingcharger.tw	152 KB
1	gbyhn.com.tw img.gbyhn.com.tw	67 KB
1	prnasia.com mma.prnasia.com	12 KB
1	taboola.com trc.taboola.com — Cisco Umbrella Rank: 1016	200 B
1	yimg.jp yads.c.yimg.jp — Cisco Umbrella Rank: 31472	58 KB
0	alphaloan.co Failed blog.alphaloan.co Failed
0	creditcards.com.tw Failed creditcards.com.tw Failed
281	39

	Domain	Requested by
44	cdn.holmesmind.com	securepubads.g.doubleclick.net cdn.holmesmind.com ad.holmesmind.com
35	securepubads.g.doubleclick.net	reurl.cc securepubads.g.doubleclick.net pagead2.googlesyndication.com
28	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com
16	t.ssp.hinet.net	api.popin.cc cdn.holmesmind.com t.ssp.hinet.net
13	static.criteo.net	securepubads.g.doubleclick.net cdn.holmesmind.com reurl.cc static.criteo.net
10	ep2.adtrafficquality.google	securepubads.g.doubleclick.net ep2.adtrafficquality.google pagead2.googlesyndication.com
10	ad2.apx.appier.net	5 redirects reurl.cc cdn.holmesmind.com
10	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
9	ad.holmesmind.com	cdn.holmesmind.com
8	bidder.criteo.com	static.criteo.net
5	www.google.com	ep2.adtrafficquality.google
5	ep1.adtrafficquality.google	securepubads.g.doubleclick.net pagead2.googlesyndication.com
5	gocm.c.appier.net	5 redirects
5	www.google-analytics.com	storage.reurl.cc www.google-analytics.com reurl.cc www.googletagmanager.com
5	onead.onevision.com.tw	ad-specs.guoshipartners.com reurl.cc
5	storage.reurl.cc	reurl.cc
4	www.facebook.com	reurl.cc
3	prebid-asia.creativecdn.com	cdn.holmesmind.com
3	prebid.scupio.com	cdn.holmesmind.com
3	log.popin.cc	reurl.cc
3	api.popin.cc	reurl.cc api.popin.cc
3	cpt.geniee.jp	reurl.cc cpt.geniee.jp
3	www.googletagmanager.com	reurl.cc www.googletagmanager.com
2	ps.eyeota.net	1 redirects reurl.cc
2	match.adsrvr.org	2 redirects
2	bcp.crwdcntrl.net	2 redirects
2	ups.analytics.yahoo.com	2 redirects
2	re-news.tw	storage.reurl.cc reurl.cc
2	connect.facebook.net	storage.reurl.cc connect.facebook.net
2	ad-specs.guoshipartners.com	reurl.cc
2	cdn.jsdelivr.net	reurl.cc
1	294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	googleads.g.doubleclick.net	pagead2.googlesyndication.com
1	bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net	reurl.cc t.ssp.hinet.net
1	6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	r.popin.cc	reurl.cc
1	hb.aralego.com	cdn.holmesmind.com
1	ecs.tagtoo.co	ad.tagtoo.co
1	uec.tagtoo.co	api.popin.cc
1	ad.tagtoo.co	api.popin.cc
1	tw.popin.cc	api.popin.cc
1	gum.criteo.com	static.criteo.net
1	fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	cdn-ima.33across.com	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	td.doubleclick.net	www.googletagmanager.com
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	static.wixstatic.com	reurl.cc
1	s.w.org	reurl.cc
1	img.racingcharger.tw	reurl.cc
1	img.gbyhn.com.tw	reurl.cc
1	mma.prnasia.com	reurl.cc
1	trc.taboola.com	reurl.cc
1	cms.analytics.yahoo.com	1 redirects
1	yads.c.yimg.jp	cpt.geniee.jp
1	reurl.cc
0	adx.holmesmind.com Failed	pagead2.googlesyndication.com
0	blog.alphaloan.co Failed	reurl.cc
0	creditcards.com.tw Failed	reurl.cc
281	63

This site contains links to these domains. Also see Links.

Domain
re-news.tw
youtils.cc
www.comptw.com
stockinfo.tw

Subject Issuer	Validity	Valid
reurl.cc R11	`2025-03-14` - `2025-06-12`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
storage.reurl.cc WR3	`2025-03-14` - `2025-06-12`	3 months	crt.sh
*.google-analytics.com WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
*.g.doubleclick.net WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
*.geniee.jp GeoTrust TLS RSA CA G1	`2024-07-30` - `2025-08-30`	a year	crt.sh
ad-specs.guoshipartners.com Go Daddy Secure Certificate Authority - G2	`2025-01-08` - `2026-01-21`	a year	crt.sh
onead.onevision.com.tw R10	`2025-02-03` - `2025-05-04`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2025-01-02` - `2025-04-02`	3 months	crt.sh
wp.re-news.tw WR3	`2025-03-04` - `2025-06-02`	3 months	crt.sh
edge01.yahoo.co.jp Cybertrust Japan SureServer CA G4	`2025-02-07` - `2026-03-06`	a year	crt.sh
*.taboola.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-12-01` - `2025-12-31`	a year	crt.sh
*.prnasia.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-10-23` - `2025-11-23`	a year	crt.sh
gbyhn.com.tw WE1	`2025-03-06` - `2025-06-04`	3 months	crt.sh
img.racingcharger.tw R11	`2025-02-15` - `2025-05-16`	3 months	crt.sh
s.w.org E6	`2025-02-28` - `2025-05-29`	3 months	crt.sh
*.wixstatic.com R11	`2025-01-23` - `2025-04-23`	3 months	crt.sh
*.google.com WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
*.doubleclick.net WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh
oa.openxcdn.net WR3	`2025-03-12` - `2025-06-10`	3 months	crt.sh
invstatic101.creativecdn.com WR3	`2025-02-12` - `2025-05-13`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-03` - `2025-05-03`	3 months	crt.sh
*.33across.com Sectigo RSA Domain Validation Secure Server CA	`2024-09-05` - `2025-09-30`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-09` - `2025-05-10`	3 months	crt.sh
*.popin.cc Secure Site Pro CA G2	`2024-09-23` - `2025-10-24`	a year	crt.sh
*.holmesmind.com Go Daddy Secure Certificate Authority - G2	`2025-03-06` - `2026-04-07`	a year	crt.sh
ad.tagtoo.co WR3	`2025-02-20` - `2025-05-21`	3 months	crt.sh
uec.tagtoo.co WR3	`2025-02-23` - `2025-05-24`	3 months	crt.sh
*.t.ssp.hinet.net HiPKI OV TLS CA - G1	`2025-02-12` - `2026-02-12`	a year	crt.sh
ecs.tagtoo.co WR3	`2025-03-22` - `2025-06-20`	3 months	crt.sh
*.scupio.com Sectigo RSA Organization Validation Secure Server CA	`2024-09-27` - `2025-10-28`	a year	crt.sh
*.creativecdn.com RapidSSL TLS RSA CA G1	`2024-04-05` - `2025-04-30`	a year	crt.sh
*.aralego.com Sectigo RSA Domain Validation Secure Server CA	`2024-12-02` - `2026-01-02`	a year	crt.sh
adtrafficquality.google WR2	`2025-03-10` - `2025-06-02`	3 months	crt.sh

This page contains 47 frames:

Primary Page: https://reurl.cc/XqAx30
Frame ID: C841A214D96B65D069F75AA560617475
Requests: 63 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Frame ID: FE6841DFBA2CB3BA4CA66DCD0CFC32F7
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-N394QBRGC0&gacid=2131144943.1742865243&gtm=45je53l1v897965293za200zb9181474282&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102482433~102788824~102803279~102813109&z=613206757
Frame ID: 1CBE714E386F456856708BF0F98C26FB
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: F5ECD9A58C861508A69F2C9512B43291
Requests: 1 HTTP requests in this frame

Frame: https://fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: 70FE1F537EEB65C1F868D8C668EE0668
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=
Frame ID: F7D2779566BEEA2665CF07B8FC19DFDA
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssDKTkfYaHZfNlALb1hfFWQ08fMMP_vEu0GHXPPNyKO802cnuR-Yfkt3kkSXLvE8SO8AEK2CygxqNAO7sN6qwIxAeoKf4QmbSZEVyUnY2B6iACIUqIcIDGfJ71yi68RfZoM9pXdARuAJ2FTp6cnY91w5XTZ3KcCpOMuR-wrtvCG-kLpA86mldTfAMXyRZ6zFV0FYXWS49jjFibfkeGKjwnxwrpvyKZqswaoKvRt-2YjkMg9S6CyetQzybV-zBLKpWaofmVRPJHDLRrH4cM2z37Zp4_dET9VAGnOiW5L9rspPF09g-x13Er9alPTYTRAyJRO7TDVYKx5JrUwIRkUMzwAwBUXvMflez2YBU_tx2JogZhIzif_uP6y2b0XFlVa6FD4ToFOsVGnZC2x-gXcnfzTd-jqzg3uYYE-3QQmzcO1LwrOhpWCQfVCqg&sai=AMfl-YRSAH_pYaSGzWky1X_ZCbqkOvnRag_K1jwrKrA7GBXtszdh1alMYGuF5XupS5bsy97vFciQoyKcKEArTi2gYFybwKmKC3ivf5SQA5YF568zL2Z3MXQT7ynKMqPU&sig=Cg0ArKJSzPom8jaTfc6hEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 2C1B38E86DB2AF8952BB6BEEE71E4B85
Requests: 24 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstURQi4qU9APlUPIcA4Rjf_wRjIOxxWvN3S9hVaxuP0n57TzOFLMbCNeZQMytvGbQiUGpBumZMUgncDBotNjmLAwJVNPydo2Z14KiHxRJovqKMy0kJMRJZYMQJIrcxePJ77NhT6FS0MtPRqrHWGMyn6yODvaknlXUrG7sSYMaZqAUw6fu4S0gV0dBL_STl6q9m4r4hTXhyh4xwuXbKPvI6k4RwYZctV27vvTP40Xj6ZKSNjq2DcfROwPPptS-x97HcoNIDSnRZzwgulN8bEk-xBJQDzBJA8XHhm3S90ESeQ0nV_vsNyoxuApRdEN-oy6HYRp-M0MXnY8eDkEcGd8C1XLXprb9u7GJAJpRFREmV6k2x9wvz22Xur4xX_hNe1v8zHlY-gPoaoFDWCVrLPso6x2FIcBOG-2BjYIqZTEgJ1ib7NpO4lbIwiAw&sai=AMfl-YQtFggAdO2qOHyGeTRnv1tKEDqYKVt2xsAs0qfVcmkHT0Iu9BBGjvs_WfE11IR8wZMXc6_tHN5SaoVVSD1i6duSjGlKyHwhJgBynkO9seOmPTLYDNX90FtH4svG&sig=Cg0ArKJSzCOszfDxr3meEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 2D25DB63743B963FEE7344DD8621D1E4
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu2GV-Q5chC0qJb1vfTJIUE0jr-ysafGrEePxDC7tI01Q0Wfy6w2iR0Sk8SJH_dGq8_78aiK00Lp0RT-g3tUJawI9uoxpQqxmrHt5Um8u9qiT6mmjm1Va6bJhaod_L88M5v1FpQke01w3ro94nPw5OzQitesnm0At34yHDqDwdDqvT8kCVfDA7yQ_yI9GbSGMicUvVLrzRCDmqwjDm-0xvfs8gs7cbzAf3ES0QvhjDBX-6yKd_8El__osGlyKYPakIbjXQgHY-ddO92x7oMZFoeL3cU0uidS3HV3SDkfIaNuiZQqWxlMiiR0Utt12XhQwdRKX9JlSnTDvBYMMqJqWVA1nl8huKWcKhcQeom2GcFSyQqT_6wYc7theR0awbYdy-f2DypSg2VZiQkN-DpPlPECVy28EscIJqdD8Vp7MYLAn7sOtAS3BJF0MNEx-sDM_o&sai=AMfl-YRQugdwqpPkCJ61C4cimRTt8DZ7_AEBBfpqigrmyZfaVyqYncKbSf4V3MuBPUusD7YqaJvMh4fOBuM0OnvAE2jr1GTzG-kQtM5rUYaEIf6Pp3NWSw45xxQny3uU&sig=Cg0ArKJSzNAeO7nuftVBEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 7018D7249BECCE4F39A9FC1EA2DD9AD0
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuE8cLX2pJOqUzXw3Epr8XF4bilRYuntB_RP5N4q3RJ1bkKuFyIfZ4sBTeK2AiSWuQHZIYjD891bJENElKOMZOGQ3mi340kJvNL8ZqDjJ-64rmvGNgV9GloK6GJ6fEnYxNC77_3JrlCKxI78-_MGCqqBpQj6bxiWjrDY950YUxgjv4vXcAhjG2JqJXEkHMyfEgtIHfCaGDkkH6rX6hzkBtTGXdoZRfLjPdi59DObGujQ3ArbB7hcVcKjiCiG1oyUpy5HL9bEqH_PWQlPeqthMEQC6SSXaztwSx9wjF81M1n_cxU_L6Gpn73Cn4R8LtOoLbfUen4UMT2bzpNOuJJS6DOdowlCRV0NHu7RWvzJOpk_sbYyTAfNbaXPO8ZOAgsTh6Hx2PadHNpEmKsBdg_UQoT480dMhN5caG6L8gXCiktX8WOR6NMbA2JUDA-ntk05Rw&sai=AMfl-YRSnFVFyULEIKVombXPuPHvMcRUWZgZ3ZusiUltIQArmELd7pndWyWxuCrgso1Hv4eCJrn81VhusA0zULppW1UalDsGReWJlI6QY_ZzUbcpORYU_5bE5mqPOlTw&sig=Cg0ArKJSzPdLorkuv5FgEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 5D24F12A10E08F1DAE4CF2BFE2F866AA
Requests: 6 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 1DAA2CDB3D764CCD145198092606761E
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: FB5A28F7C1E9F5693D328B19EC0B02AE
Requests: 23 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 7B27902CC5EAB896842F3F953F6B4125
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 6F8FED2559B7A211E20DEFED91DBE4A4
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 49C9A65402A0940A30DFBF5A2EA47D23
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: D68ABD84B7D95C632C8C421691DB632F
Requests: 23 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 02246317D2D87201EA5092530B296C03
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: CE42407D7CDE5F02CFD1145FD4A97385
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: F6BB9BFC6D0D2EBC2E8CAC8A8DACB47E
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 1F7CF3F4CFFB30E8614F7349A6445275
Requests: 1 HTTP requests in this frame

Frame: https://f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3
Frame ID: 283C8D671C40E4E30EAB31096DC5A58F
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 8630AF06C54144ADB509207A52730580
Requests: 1 HTTP requests in this frame

Frame: https://557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3
Frame ID: 252BC090C5CDC2EC0CC04E5CF3FE0498
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: B905D35DB58D041E0FFB03D99027D8C4
Requests: 1 HTTP requests in this frame

Frame: https://6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3
Frame ID: 73DCF5011D3E31F9FC7F80D7CB9B1F01
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst1BLLOYSuVaZ9vA2owlEDWrD8WcppBRzupoZaf4jnsbnVgpnmlzMv8VQnGjLrp40LiI_xBjN2CSbGHvhTicS7wK1I3dMZU8KOsturPUk1LNDIzZfM8C0vLjWT3RaTiVo2KpckKvs6AaBM2hQeUNSU3oCgezxZ4MmnBsjvRzW7KNEKSwgxgsXBCTF5ug7TqMnIwkWTCyBPHomkU5R4YHCC62jsPw-Psm-Fbtx6ts2IJefT2yGlcfN0zFVfXfZwKGoVvxjd0OlrkmrbuyDWo7B8NiOBHLGHcX0WMSfb4MjXSOgdjx7aldFWcj8GRkBl8ov0MH6O4hRuimrQNyqi-WOlDD_m-HD-PpgeYFirUa4qmMS8xHGYmAAlmBX8XHyIkVJdJhNqN8hl3G3Stv3P381iXVzeE_QHgyNDo4-JSL9ryy9YRc7EBr3cUSTUhNtf7eJe3NGjWcT4peQ&sai=AMfl-YQd_tLvhC1gPblenNDDHc3Dsvy6IxQBQb6puNReiQnMStpLZhdL79ZXQCDKH8dmkIrDhfyOnNgPHRb0pEMbf3gKjJXotrVsNnartLdc4-LDmXi2vq7Vva6zRxFo&sig=Cg0ArKJSzLBPHoGLnRY6EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: E51DA6E68745970662579E6DAE4E6FB6
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7kCuWF8eEL9HTTcGeDKUMfpbANziRunySPJKRIx2mlWpMcatZGEI_Qp-E8A01TQW1hJy0fEvVb9kFgA0Y1HIDqUBcsunx6zGcT8-NYWZe6hWACBEOiXalGlyb1aKSEDZ9yqhzToJjimNbcpfx1T_wncz9qnjxR_RRIQvaB4TY4-EC4wfu4lV3-rOOPVfQxhLjJE5OMYpozh1IMna6qVShTpwoEkh6SjcCLPAFwvdrAxLRPy5by6Ff5emEZ5bT9wigLHWyAlnW5jTE8Aub9zyP8zlEex9AzTDWNbEcIru0Jy3GnJtgbpJXQXDQUpbqExy9GeqgaO3yivvwVoFhm-rXh_iVjBW0FFBmKzEqhyeyaP3IsyVxw6x-W0s8ZsAsFJg1MRU7_q-h0-NCRyPgMM6RmvfEjCujQQsSuOMURYDzX1s7m6NgVQ44tB9e&sai=AMfl-YSggDUGosWKphhG4t5Ye_p37PdZ-j29jbJ-0w5zR0jgHP6gQ-r4HlKcqxJcpKpHsHtYylJu7FODg8XyY4Cvy8BIDJzhKTZEJ8FFBH70jCwX3mw2scFXU8pbR_rN&sig=Cg0ArKJSzCAShNPZIncYEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 37C982721A613D9FB08BBB7D807A278A
Requests: 13 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52
Frame ID: 9B2C73B28692B49C343094FE6E2167FB
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 72DD50CC065CF5EA8E5DA1B5A47BC343
Requests: 22 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: DFE9DB2044107EBA349DE9F941989854
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 52DFC9F8034CD8F793BA5BF1476768D0
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 7C0150865FD1D1D82957F70A9035251A
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 774257DA5F64044D1A669809727D5508
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: E5370D48AC6C028440FD853035C28F4F
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 679B7176F53B953ACAB0026EE6F0DFF5
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250320/r20190131/zrt_lookup.html
Frame ID: 2B23C54EA01A834C8B18951A46CCA5ED
Requests: 1 HTTP requests in this frame

Frame: https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html
Frame ID: 802BE93C9759048C648AA5668D71FB87
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 666F74A2BF61A474A5C9AD6203B6E249
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 57FA799B71838D78FB63316EAB1FD4B8
Requests: 1 HTTP requests in this frame

Frame: https://294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=6
Frame ID: 1ACD41D3D9C8FB55BC4D8C1A11FFFD9B
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 109D23EF87290218BB7EA93A1F9BB835
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D9C73C97ABFB2C4EEC342DACE429C4CA
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 880860BA3AE745D80940EA3205BA63C1
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: AF5DC12DD16D04CD22257323A6644120
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsujLIbYKclY_uqqznpZkB2xCnpi1EmsEuG_UICASVyHuncsJfosp-zrXNRsJWml5HPh1gpBGI51btZWZJF4foDQU5IptCYqz1WBLTZM3fpJQxGjA7Q3wQc9cGdzIi4QcLHa0gYs7xRemWzvlWONS0qI73pNZX52abK088h_sctWo_IQrI8rWr9jN3yOYX-GkWrNMg_gsNpCqeROPHS8OoEHuQGC43wO9bIu9AticrBrNWdUD2eiiGIsad7plfXzvuvxaCSkilBn54PqxPgpTVdWx7sBoYZFONMepIWUZtN6C7W26oHmXq8NvAErdCHVDH_7M_9pSOzUoA8ckfkUHEtEPyH1xMWVX1CKVMlYEnHOkqAuR4fCD-M41jl5A8srnUgGVHxm6eaxBpBo4_2uY0HYmp_XSNyn-CZahLQeLVzS5vC62megrhSQ_v0iCzVhBbT0ZutqPbDJCw&sai=AMfl-YSt8Q3yxXj1XNcR0lcXokVfUKOsSJrRl1vF6aLKcbplubpmUYDiMnH3dkCPsuO0sdGNu1emKjcvC7gofzvn71a-3crvlVeIzefIzApGVDcEVeCAHRp3HjIGP4K1&sig=Cg0ArKJSzOVSPtLjvVsUEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: EFADDCC102DEADBCF5C0F632D7BEE5FF
Requests: 6 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52
Frame ID: 4B7979B2C41584A1C397989DB84832CE
Requests: 1 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: D0B5579F5939FE55513A4C15F9405EF5
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Dynamics 365 Customer Voice

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/vue(?:\.min)?\.js

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

281
Requests

90 %
HTTPS

27 %
IPv6

39
Domains

63
Subdomains

59
IPs

5
Countries

3398 kB
Transfer

11714 kB
Size

48
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://re-news.tw/
Title: Exit

Search URL Search Domain Scan URL

URL: https://re-news.tw/renews/168

Search URL Search Domain Scan URL

URL: https://re-news.tw/prnasia/4647990_XG47990_2

Search URL Search Domain Scan URL

URL: https://re-news.tw/creditcard/233069

Search URL Search Domain Scan URL

URL: https://re-news.tw/gbyhn/61537

Search URL Search Domain Scan URL

URL: https://re-news.tw/racingcharger/54444

Search URL Search Domain Scan URL

URL: https://re-news.tw/golike/22753

Search URL Search Domain Scan URL

URL: https://re-news.tw/zocha/664f06a4333c44b7de8afda5

Search URL Search Domain Scan URL

URL: https://re-news.tw/alphaloan/20451

Search URL Search Domain Scan URL

URL: https://youtils.cc/emoji
Title: Emoji

Search URL Search Domain Scan URL

URL: https://youtils.cc/geoip
Title: Geo IP

Search URL Search Domain Scan URL

URL: https://youtils.cc/big5gb
Title: Big5/GB Converter

Search URL Search Domain Scan URL

URL: https://youtils.cc/qrcode
Title: QR Code

Search URL Search Domain Scan URL

URL: https://youtils.cc/length
Title: Length Converter

Search URL Search Domain Scan URL

URL: https://www.comptw.com/
Title: Taiwan Company

Search URL Search Domain Scan URL

URL: https://stockinfo.tw/
Title: Taiwan Stock

Search URL Search Domain Scan URL

URL: https://youtils.cc/wordcounter/zh-Hants
Title: Word Counter

Search URL Search Domain Scan URL

URL: https://youtils.cc/dateCalculator
Title: Date Calculator

Search URL Search Domain Scan URL

URL: https://youtils.cc/lunarCalendar
Title: Lunar Calendar

Search URL Search Domain Scan URL

URL: https://youtils.cc/utm
Title: UTM tool

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 28

https://cms.analytics.yahoo.com/cms?partner_id=OneDATA HTTP 302
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA HTTP 302
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA&verify=true HTTP 302
https://onead.onevision.com.tw/v2/pixel/vzn?id=y-9VXytENE2p_YeaXxFkWJRCxLCI0p0ymdkCqZlQ--~A

Request Chain 29

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://onead.onevision.com.tw/v2/pixel/ltm?id=1bfa004520841c8f14b0254fe0bee53

Request Chain 30

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://onead.onevision.com.tw/v2/pixel/ttd?id=1d62d286-ee63-4f84-8c7e-8a56fb103151

Request Chain 31

https://ps.eyeota.net/pixel?pid=3m51m51&uid=70596e6d-0916-11f0-9211-0242ac120002&t=ajs HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=70596e6d-0916-11f0-9211-0242ac120002&t=ajs

Request Chain 130

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=oG6Z6T2PCYqeB5XdXwPiZw

Request Chain 131

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=V4n8vFYhAp6iSxsMXwPiZw

Request Chain 132

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=6cx5LxdNCeaaDBatXwPiZw

Request Chain 218

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=IaUdNmubAOCpen2BYAPiZw

Request Chain 219

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=J7xwrm4mB0mC_g9-YAPiZw

Request Chain 236

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4485239425924787&output=html&h=250&slotname=2784%2F13803&adk=2220942683&adf=2119137496&pi=t.ma~as.2784%2F13803&w=300&lmt=1742865248&url=https%3A%2F%2Freurl.cc%2FXqAx30&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1742865247759&bpp=224&bdt=154&idt=780&shv=r20250320&mjsv=m202503200101&ptt=5&saldr=sd&cookie=ID%3Dd1f9df27f391c472%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MZ2WatZsfNjt7Zk7OEyF8XrbvJppA&gpic=UID%3D00001000f88aa859%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MapQsygeP2ZhifPNiHeFHvd_VRIBA&eo_id_str=ID%3Dfe71415567f1985f%3AT%3D1742865244%3ART%3D1742865244%3AS%3DAA-AfjaD4P_npBVN9Eh8wmd8zVM7&correlator=4857741548237&frm=23&ife=4&pv=2&nhd=4&u_tz=-600&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=270&ady=108&biw=1600&bih=1200&isw=300&ish=250&ifk=3244914014&scr_x=0&scr_y=0&eid=95332585%2C95356498%2C95356506%2C95355301&oid=2&pvsid=643302925392309&tmod=1075257123&uas=0&nvt=1&fc=640&brdim=230%2C230%2C230%2C230%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=4&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=1.eyidlw86ufit&fsb=1&dtd=837 HTTP 302
https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html

281 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request XqAx30 Show response
reurl.cc/ 15 KB
4 KB 594ms
199ms Document
text/html 35.185.130.121
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.130.121 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 121.130.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 25aa1db2c5fff13f9b15a2709cdcd1f55c7c56c621cc7553dbfe0063279c3a78

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 25 Mar 2025 01:14:01 GMT
referrer-policy: no-referrer-when-downgrade
server: nginx/1.18.0 (Ubuntu)
target: https://ecv.microsoft.com/dDTk9Vwh4y
vary: Accept-Encoding Origin
x-request-id: 695ddde2-7586-48df-a886-b9f598b589ff

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/ 152 KB
26 KB 650ms
209ms Stylesheet
text/css 2a04:4e42:400::485
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/bootstrap.min.css

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"2606e-bhA1SChFSJj9qA9V897LNH/Z7SE"
age: 3436748
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230028-FRA, cache-mad2200127-MAD
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25648
x-jsd-version: 4.3.1

GET
H2 200 style.css
storage.reurl.cc/stylesheets/rwd/ 2 KB
1018 B 323ms
189ms Stylesheet
text/css 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/stylesheets/rwd/style.css?v=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 749079c4e18ad34ac381e98d3fa23e070937ae17b73e27bb066eae5350ed667d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 9ca9dce0-ee0b-493c-841f-37a941eff253
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
age: 23840
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:36:41 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=28800
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 904

GET
H2 200 pixel.js Show response
storage.reurl.cc/javascripts/ 429 B
530 B 64ms
61ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/pixel.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 3050a5556edc5876cd83e63f15e56fe19cb428129345a58d1f57687414504698

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 20a439ea-8290-446d-baf1-a2036b561b2d
access-control-expose-headers: *, Authorization, X-Authorization
cache-control: public,max-age=28800
age: 12210
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 429
date: Mon, 24 Mar 2025 21:50:32 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/javascript; charset=utf-8
vary: Origin

GET
H2 200 ga2.js Show response
storage.reurl.cc/javascripts/ 536 B
444 B 64ms
60ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/ga2.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 16cf673198b29bb08e83f5d8f74182d97d9c6dfa729c60f90f6195e739de9d20

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 3cd12768-90ce-4d85-a765-f4a6cf3ead6e
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
age: 19907
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 19:42:15 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=28800
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 348

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 361 KB
121 KB 391ms
141ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e824217e74a487b3080dc6cbaf36989c37cd6061c6dd07888f79c41fbceb4c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
content-length: 123129
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 438 KB
142 KB 560ms
311ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

af1ae8f58c1dc0a3193b9ae82ea975d2567f5c272bc3045484b52a1e4940ac10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
content-length: 144759
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 106 KB
33 KB 418ms
138ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

688f229a7cac61e53d32a21d50ff29e962c48c9e65d65f9da34553c017003a15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 582 / 20172 / m202503190101 / config-hash: 9754453387445197641
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33605
x-xss-protection: 0
server: cafe

GET
H2 200 wrapper.min.js Show response
cpt.geniee.jp/hb/v1/219632/1441/ 12 KB
4 KB 503ms
158ms Script
application/javascript 203.137.133.156
IDCF IDC Frontier...

General

Check archive.org

Download Go to

Full URL: https://cpt.geniee.jp/hb/v1/219632/1441/wrapper.min.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.137.133.156 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 0614ad45d47a5da6d9880c2e175c88526cd223c16d2121e48bab3a9e1121f55d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=3600, private
content-encoding: gzip
etag: W/"67e15db0-2f10"
cross-origin-resource-policy: cross-origin
expires: Tue, 25 Mar 2025 02:14:02 GMT
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript
last-modified: Mon, 24 Mar 2025 13:27:12 GMT
server: nginx

GET
H2 200 ad-serv.min.js Show response
ad-specs.guoshipartners.com/static/js/ 50 KB
16 KB 487ms
137ms Script
application/javascript 168.95.245.4
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 168.95.245.4 Palo Alto, United States, ASN131660 (CHTCDN Data Communication Business Group, TW),
Reverse DNS: 168-95-245-4.hinet-ip.hinet.net
Software: HiNetCDN / OneAD
Resource Hash: 8aad7f034c2e39ee145189b327d6b1df64240486e08c7eba41d399e7e72797a6

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: W/"67dbbf75-c7b9"
age: 0
x-varnish: 79110905
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 20 Mar 2025 07:10:45 GMT
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 onead-lib.min.js Show response
ad-specs.guoshipartners.com/static/js/ 24 KB
7 KB 501ms
152ms Script
application/javascript 168.95.245.4
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL: https://ad-specs.guoshipartners.com/static/js/onead-lib.min.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 168.95.245.4 Palo Alto, United States, ASN131660 (CHTCDN Data Communication Business Group, TW),
Reverse DNS: 168-95-245-4.hinet-ip.hinet.net
Software: HiNetCDN / OneAD
Resource Hash: 1bf41ca1364230ce3a9cbbac1110ff4d7d287a9f978fa74297aa30117c4da9c0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: W/"67b5a55f-6100"
age: 0
x-varnish: 107515587
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 19 Feb 2025 09:33:19 GMT
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 vue.min.js Show response
cdn.jsdelivr.net/npm/vue@2.5.16/dist/ 84 KB
33 KB 711ms
273ms Script
application/javascript 2a04:4e42:400::485
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.5.16/dist/vue.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"151b4-KLsckeN7U/TrtIzkgtzLJAAD4Hg"
age: 1602344
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230020-FRA, cache-mad2200127-MAD
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33184
x-jsd-version: 2.5.16

GET
H2 200 renews.js Show response
storage.reurl.cc/javascripts/ 404 B
632 B 192ms
61ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/renews.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 22743d9dc93a38d7096ec7c9a02146da7a721ada15192d87e81d78ff53cb2f2a

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 23da054e-1ed0-4699-83a8-54eb16cdee0a
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
age: 24770
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:21:11 GMT
last-modified: Tue, 09 Jul 2024 09:45:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=28800
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 282

GET
H2 200 loading.js Show response
storage.reurl.cc/javascripts/ 134 B
254 B 193ms
61ms Script
text/javascript 34.149.98.30
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://storage.reurl.cc/javascripts/loading.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.98.30 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 30.98.149.34.bc.googleusercontent.com
Software: /
Resource Hash: ddd9d29beabaeecc9c76408242dfc2b76305ec52511992d3cfbc81a500ee0670

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-request-id: 8f8fa477-030b-4698-8e04-948522f646f7
access-control-expose-headers: *, Authorization, X-Authorization
content-encoding: gzip
age: 25704
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 18:05:37 GMT
last-modified: Thu, 29 Sep 2022 09:52:31 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public,max-age=28800
access-control-allow-credentials: true
referrer-policy: no-referrer-when-downgrade
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 134

GET
H2 200 oid Show response
onead.onevision.com.tw/v2/et/ 373 B
980 B 403ms
198ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://onead.onevision.com.tw/v2/et/oid?cb=window.text_etag_callback_39jwm
Requested by: Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: f48f76bd3c251f292803b3446a96c1f24b1c5486f0442e50f213acb30e715275

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
etag: 70596e5c-0916-11f0-9211-0242ac120002
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 396888503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript
last-modified: Tue, 25 Mar 2025 01:14:02 GMT
cache-control: max-age=600
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 373
x-onead-backend: onead-http-event-d11z-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 page.php
www.facebook.com/plugins/ Frame FE68 0
0 622ms
495ms Document
text/html 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-HOsqpO3z' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-HOsqpO3z' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:02 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7485549216398796096&cpp=C3&cv=1021207741&st=1742865242648"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7485549216398796096&cpp=C3&cv=1021207741&st=1742865242648", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=116, rtx=0, c=26, mss=1232, tbw=8535, tp=17, tpl=0, uplat=377, ullat=0
x-fb-debug: vZdKab6j45NkLRzcd+U/4WBsdIEVlOAHI5xfDGpUME+3ljW/c8KN8AFtL5KECYRfKVd1BW1uIxVclfRMB8BG2g==
x-xss-protection: 0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 252 KB
63 KB 252ms
121ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: storage.reurl.cc
URL: https://storage.reurl.cc/javascripts/pixel.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

13b3fea42a999bd1edc7815ad83b8529ad25262807607a54101486b76d2a39a0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-L7NcwKEo' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-L7NcwKEo' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=117, rtx=0, c=24, mss=1232, tbw=8352, tp=13, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: 8aPhlFQECvkJxCvG7XqlnWpnW2N+JJ31PzzL3VPZymd5Y95ix6xbID60bEUdgR1R7SNDEybtRmiXoVEoqFKlig==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 64608
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 373ms
119ms Script
text/javascript 2607:f8b0:4004:c21::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: storage.reurl.cc
URL: https://storage.reurl.cc/javascripts/ga2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
age: 623
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 03:03:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:03:39 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

GET
H2 200 feeds Show response
re-news.tw/ 6 KB
7 KB 725ms
60ms XHR
text/html 34.160.26.175
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://re-news.tw/feeds
Requested by: Host: storage.reurl.cc
URL: https://storage.reurl.cc/javascripts/renews.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.26.175 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 175.26.160.34.bc.googleusercontent.com
Software: / Express
Resource Hash: c280d38004a82811e8659f68bbd6dc8dde7f7c6a95d3172d7ddec4acf8c96d6f

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: public,max-age=3600
etag: W/"19c2-9Jo9tz+a9s2SjM8/XubeyhnT+f4"
age: 1268
via: 1.1 google
access-control-allow-origin: https://reurl.cc
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6594
date: Tue, 25 Mar 2025 00:52:55 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
vary: Origin

GET
H3 200 1675200226052423 Show response
connect.facebook.net/signals/config/ 74 KB
17 KB 121ms
120ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1675200226052423?v=2.9.190&r=stable&domain=reurl.cc&hme=c1f2cecb0bd2e60711f2156ceae0254b57f69ec526dbc6c13633615b2168eda4&ex_m=71%2C124%2C109%2C113%2C62%2C4%2C102%2C70%2C16%2C98%2C90%2C51%2C55%2C178%2C181%2C193%2C189%2C190%2C192%2C29%2C103%2C53%2C78%2C191%2C173%2C176%2C186%2C187%2C194%2C135%2C41%2C199%2C196%2C197%2C34%2C148%2C15%2C50%2C203%2C202%2C137%2C18%2C40%2C1%2C43%2C66%2C67%2C68%2C72%2C94%2C17%2C14%2C97%2C93%2C92%2C110%2C52%2C112%2C39%2C111%2C30%2C95%2C26%2C174%2C177%2C145%2C87%2C57%2C85%2C33%2C74%2C0%2C96%2C32%2C28%2C83%2C84%2C89%2C47%2C46%2C88%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C58%2C63%2C65%2C76%2C54%2C104%2C27%2C77%2C9%2C8%2C81%2C48%2C21%2C106%2C105%2C107%2C99%2C10%2C20%2C3%2C38%2C75%2C19%2C5%2C91%2C82%2C44%2C35%2C86%2C244%2C171%2C122%2C160%2C153%2C2%2C36%2C64%2C42%2C108%2C45%2C80%2C69%2C114%2C61%2C60%2C31%2C100%2C59%2C56%2C49%2C79%2C73%2C24%2C101%2C115

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

0c310205ab2dbf30ae9b8a24ee1359f493e1bf5c982c124e42af22b759ac07ce

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-YQhNJWwl' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-YQhNJWwl' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=118, rtx=0, c=82, mss=1232, tbw=77060, tp=74, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: QWnGyXNH+GCqJMo8VNoMYUZNi9MS5JtDztGxYku1WBnLSlpcOvMiuD4oHsSNw9Kkj1RwjxVuMo7LVkoTnT1JAw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer: 0
document-policy: force-load-at-top
content-length: 16786
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 adsrv Show response
onead.onevision.com.tw/v2/ 177 B
461 B 202ms
199ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://onead.onevision.com.tw/v2/adsrv?version=20240208&uid=1000480&category=-1&cookie=true&ip=&guid=70596e6d-0916-11f0-9211-0242ac120002&channel=0&volume=0.5&r=&adid=&response_freq_multiple=native-drive.0&web_location=https%3A%2F%2Freurl.cc%2FXqAx30&title=Dynamics%20365%20Customer%20Voice&fp=04c6d3e15a52f9e0d5fe2d47f4a29cde&_t=1742865242864&cb=ONEAD_text_response_39jwm&pb=0&spid=&bgid=0
Requested by: Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: b83e5a367880e8ad89b16ca3ba6695ceb8806e3727c746265ffd5c9b0c6b6023

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 48010052
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-onead-guid: 70596e6d-0916-11f0-9211-0242ac120002
access-control-allow-credentials: true
x-onead-message: browser_incompatible
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 177
x-onead-backend: onead-http-query-1d76-gohttp
server: gws
x-powered-by: OneAD

GET
H2 200 yads-async.js Show response
yads.c.yimg.jp/js/ 210 KB
58 KB 1580ms
335ms Script
text/javascript 182.22.16.251
YAHOO Yahoo Japan...

General

Check archive.org

Download Go to

Full URL

https://yads.c.yimg.jp/js/yads-async.js

Requested by

Host: cpt.geniee.jp
URL: https://cpt.geniee.jp/hb/v1/219632/1441/wrapper.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.22.16.251 , Japan, ASN23816 (YAHOO Yahoo Japan Corporation, JP),

Reverse DNS

Software

Resource Hash

e7e4fb9b3b1239835abc60fd16d2e64da36bfa919b8e81f11eea442c2bbf05f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "fad34f610280b86070657d734b70d7bc"
age: 405
x-content-type-options: nosniff
date: Tue, 25 Mar 2025 01:07:19 GMT
content-type: text/javascript
last-modified: Tue, 18 Mar 2025 07:38:44 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: public, max-age=600, stale-while-revalidate=1200
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch
ats-carp-promotion: 1
x-amz-request-id: f04ccdc9-44ca-4485-8dfe-b92d22aeb5f8
permissions-policy: ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform-version=*, ch-ua-arch=*
accept-ranges: bytes
content-length: 58654
x-xss-protection: 1; mode=block
x-amz-server-side-encryption: AES256

GET
H2 200 gnshbrequest-v4.23.3.js Show response
cpt.geniee.jp/hb/v1/lib/ 181 KB
66 KB 319ms
319ms Script
application/javascript 203.137.133.156
IDCF IDC Frontier...

General

Check archive.org

Download Go to

Full URL: https://cpt.geniee.jp/hb/v1/lib/gnshbrequest-v4.23.3.js
Requested by: Host: cpt.geniee.jp
URL: https://cpt.geniee.jp/hb/v1/219632/1441/wrapper.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.137.133.156 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: bc73ed340ef20534b613afea9bd95f199a55b77beab7c472e92ad92b4e39a1aa

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, private
content-encoding: gzip
etag: W/"67d140eb-2d3d7"
cross-origin-resource-policy: cross-origin
expires: Wed, 26 Mar 2025 01:14:02 GMT
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: application/javascript
last-modified: Wed, 12 Mar 2025 08:08:11 GMT
server: nginx

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/ 526 KB
165 KB 123ms
122ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

3b07482a7e55296a20e35304c8d3a30bc4805d350a933c634713001d467eb6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 7854641952111388716
age: 44028
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 13:00:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:00:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169032
x-xss-protection: 0
server: cafe

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
385 B 133ms
131ms XHR
text/plain 2607:f8b0:4004:c21::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1243718416&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2FXqAx30&ul=en-us&de=UTF-8&dt=Dynamics%20365%20Customer%20Voice&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=940891531&gjid=1171946607&cid=2131144943.1742865243&tid=UA-102456694-1&_gid=1031192962.1742865243&_r=1&_slc=1&z=443186158

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:03 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 3
server: Golfe2

GET
H2 200 collect
www.google-analytics.com/ 35 B
438 B 120ms
119ms Image
image/gif 2607:f8b0:4004:c21::8a
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1243718416&t=event&_s=2&dl=https%3A%2F%2Freurl.cc%2FXqAx30&ul=en-us&de=UTF-8&dt=Dynamics%20365%20Customer%20Voice&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=pause&ea=3&el=MTYyLjI0NS4yMDYuMjQ0&ev=1&_u=IEBAAEABAAAAACAAI~&jid=&gjid=&cid=2131144943.1742865243&tid=UA-102456694-1&_gid=1031192962.1742865243&z=1753617333

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

age: 61276
report-to: {"group":"ascnsrsgac:163:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],}
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 24 Mar 2025 08:12:47 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:163:0
content-length: 35
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ 63 KB
23 KB 125ms
124ms Other
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 47531
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 12:01:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 12:01:52 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 241ms
118ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc&rl=&if=false&ts=1742865243024&sw=1600&sh=1200&v=2.9.190&r=stable&ec=0&o=4252&fbp=fb.1.1742865243016.15418984167960242&cs_est=true&pm=1&hrl=d962bb&ler=empty&cdl=API_unavailable&it=1742865242855&coo=false&cs_cc=1&exp=k0&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=117, rtx=0, c=24, mss=1232, tbw=8350, tp=13, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
193 B 309ms
187ms Image
image/png 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc&rl=&if=false&ts=1742865243024&sw=1600&sh=1200&v=2.9.190&r=stable&ec=0&o=4252&fbp=fb.1.1742865243016.15418984167960242&cs_est=true&pm=1&hrl=d962bb&ler=empty&cdl=API_unavailable&it=1742865242855&coo=false&cs_cc=1&exp=k0&rqm=FGET

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-DOmyqBrh' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7485549222111938483&cpp=C3&cv=1021207741&st=1742865243227"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: a+csFlA/q2ExCTc9GaAmNkvIc8M8HZUgK/nwsabZZ2yecvglyEVbJb6CjB359Dp4cDK7fbGyEr/mlypGpwN2Sw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7485549222111938483&cpp=C3&cv=1021207741&st=1742865243227", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-DOmyqBrh' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=117, rtx=0, c=24, mss=1232, tbw=8702, tp=15, tpl=0, uplat=68, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3

200

vzn
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=OneDATA
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA
https://ups.analytics.yahoo.com/ups/58791/cms?partner_id=OneDATA&verify=true
https://onead.onevision.com.tw/v2/pixel/vzn?id=y-9VXytENE2p_YeaXxFkWJRCxLCI0p0ymdkCqZlQ--~A

170 B
200 B

189ms
188ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://onead.onevision.com.tw/v2/pixel/vzn?id=y-9VXytENE2p_YeaXxFkWJRCxLCI0p0ymdkCqZlQ--~A
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
x-vendor: vzn
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 89229592
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: y-9VXytENE2p_YeaXxFkWJRCxLCI0p0ymdkCqZlQ--~A
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-s859-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

strict-transport-security: max-age=31536000
location: https://onead.onevision.com.tw/v2/pixel/vzn?id=y-9VXytENE2p_YeaXxFkWJRCxLCI0p0ymdkCqZlQ--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: text/html
server: ATS

GET
H3

200

ltm
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://onead.onevision.com.tw/v2/pixel/ltm?id=1bfa004520841c8f14b0254fe0bee53

170 B
200 B

188ms
187ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://onead.onevision.com.tw/v2/pixel/ltm?id=1bfa004520841c8f14b0254fe0bee53
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
x-vendor: ltm
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 654483322
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 1bfa004520841c8f14b0254fe0bee53
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-csbv-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

expires: 0
cache-control: no-cache
location: https://onead.onevision.com.tw/v2/pixel/ltm?id=1bfa004520841c8f14b0254fe0bee53
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Tue, 25 Mar 2025 01:14:03 GMT
pragma: no-cache

GET
H3

200

ttd
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://onead.onevision.com.tw/v2/pixel/ttd?id=1d62d286-ee63-4f84-8c7e-8a56fb103151

170 B
200 B

203ms
202ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://onead.onevision.com.tw/v2/pixel/ttd?id=1d62d286-ee63-4f84-8c7e-8a56fb103151
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 107.178.241.176 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 176.241.178.107.bc.googleusercontent.com
Software: gws / OneAD
Resource Hash: 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-onead-version: 61c8a0f6
x-vendor: ttd
age: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 112722831
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 1d62d286-ee63-4f84-8c7e-8a56fb103151
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-s859-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

location: https://onead.onevision.com.tw/v2/pixel/ttd?id=1d62d286-ee63-4f84-8c7e-8a56fb103151
content-length: 197
date: Tue, 25 Mar 2025 01:14:03 GMT
server: Kestrel

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=3m51m51&uid=70596e6d-0916-11f0-9211-0242ac120002&t=ajs
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=70596e6d-0916-11f0-9211-0242ac120002&t=ajs

1 KB
1 KB

127ms
125ms

Image
application/javascript

52.3.138.212
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=70596e6d-0916-11f0-9211-0242ac120002&t=ajs
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: HTTP/1.1
Server: 52.3.138.212 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-3-138-212.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Content-Length: 1228
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 25 Mar 2025 01:14:03 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=3m51m51&uid=70596e6d-0916-11f0-9211-0242ac120002&t=ajs
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Tue, 25 Mar 2025 01:14:03 GMT

GET
H2 200 cm
trc.taboola.com/sg/onedata/1/ 0
200 B 948ms
521ms Image
text/plain 2a04:4e42::300
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://trc.taboola.com/sg/onedata/1/cm
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-fastly-to-nlb-rtt: 155171
x-timer: S1742865244.608424,VS0,VE313
x-vcl-time-ms: 313
via: 1.1 varnish
accept-ranges: bytes
x-cache: MISS
content-length: 0
date: Tue, 25 Mar 2025 01:14:03 GMT
x-service-version: v1
server: nginx
x-cache-hits: 0
x-served-by: cache-toj-leto2350037-TOJ

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 131ms
131ms Fetch
text/plain 172.253.115.139
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je53l1v9181474282za200&_p=1742865242346&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109&cid=2131144943.1742865243&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1742865243&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2224
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.115.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f139.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:87:0
report-to: {"group":"ascnsrsggc:87:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:87:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:87:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 438 KB
142 KB 145ms
144ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0&l=dataLayer&cx=c&gtm=45je53l1v9181474282za200&tag_exp=102482433~102788824~102803279~102813109

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1e9c9db89bca855106476450b890fa3cfcfb276fcd698dc3602404ba26d1dead

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
expires: Tue, 25 Mar 2025 01:14:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
content-length: 144763
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 renews-title1.png
re-news.tw/images/ 24 KB
24 KB 123ms
59ms Image
image/png 34.160.26.175
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://re-news.tw/images/renews-title1.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.160.26.175 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 175.26.160.34.bc.googleusercontent.com
Software: / Express
Resource Hash: e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: public,max-age=3600
etag: W/"5fad-191b5b37a20"
age: 2134
via: 1.1 google
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24493
date: Tue, 25 Mar 2025 00:38:29 GMT
last-modified: Tue, 03 Sep 2024 02:25:24 GMT
x-powered-by: Express
content-type: image/png

GET
H2 200 Microip_Inc_Logo.jpg
mma.prnasia.com/media2/2428123/ 12 KB
12 KB 249ms
82ms Image
image/jpeg 2606:4700::6812:5fe1
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://mma.prnasia.com/media2/2428123/Microip_Inc_Logo.jpg?p=medium600
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2606:4700::6812:5fe1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 039e147a3d5e4b0857c0230686525f58ab3b688ea092c8d963be13ac1ae0bc19

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 42151
access-control-allow-methods: GET, POST, OPTIONS
expires: Mon, 24 Mar 2025 13:31:33 GMT
server-timing: intid;desc=2bb2b00bfd570674
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/jpeg
last-modified: Mon, 24 Mar 2025 13:31:32 GMT
vary: *, Accept-Encoding
access-control-allow-headers: Content-Type
cache-control: public, max-age=1
cf-ray: 925a8c9bdb927c41-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 12105
x-powered-by: ASP.NET
server: cloudflare

GET %E5%8F%B0%E7%81%A3-Pay-%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1%E6%8E%A8%E8%96%A6%E8%88%87%E6%8C%87%E5%AE%9A%E9%80%9A%E8%B7%AF%E5%84%AA%E6%83%A0%E5%BD%99%E6%95%B4-1080x630.jpg
creditcards.com.tw/wp-content/uploads/2020/10/ 0
0

GET
H3 200 1742800023-1384b5e7572f24a117a0ac78b2d642f2-840x525.jpg
img.gbyhn.com.tw/2025/03/ 66 KB
67 KB 447ms
111ms Image
image/jpeg 172.67.150.31
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://img.gbyhn.com.tw/2025/03/1742800023-1384b5e7572f24a117a0ac78b2d642f2-840x525.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.150.31 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 395afb1491e62cb0666325882b2d9ffd6258f76bc2da4f8c163e0b484d82927e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cf-cache-status: HIT
age: 65039
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ul4YA7b26qBx1IADuEt7Pk1dG%2FYC0IzVESfZMkIZAeTgcqyD1v%2BimHtTHPzArRyro1i8A4nsn%2BWK6p2QbZyHW1u8SbuJM%2F%2FPKabdtMvLMOhGIQ6HBrKm5TW620ZezcVpDxSQ"}],"group":"cf-nel","max_age":604800}
expires: Mon, 31 Mar 2025 07:08:29 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=94753&min_rtt=93914&rtt_var=35817&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4136&recv_bytes=4390&delivery_rate=33202&cwnd=12000&unsent_bytes=0&cid=5e66d97d8242af13&ts=134&x=1", cfExtPri, cfHdrFlush;dur=0
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/jpeg
last-modified: Mon, 24 Mar 2025 07:07:03 GMT
vary: Accept-Encoding
priority: u=1,i
cache-control: public, max-age=604800
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 925a8c9d0ea04782-DFW
accept-ranges: bytes
content-length: 67916
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 200 2025032402565924.jpg
img.racingcharger.tw/wp-content/uploads/ 152 KB
152 KB 925ms
392ms Image
image/jpeg 103.1.220.9
YUANJHEN-AS-TW Yu...

General

Check archive.org

Download Go to Show image

Full URL: https://img.racingcharger.tw/wp-content/uploads/2025032402565924.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.1.220.9 , Taiwan, ASN131149 (YUANJHEN-AS-TW Yuan-Jhen Info., Co., Ltd, TW),
Reverse DNS: ph2.g-dns.com
Software: Apache /
Resource Hash: 95634eb651772e9ecc489c8a2e12cccb71cd06089ae3f03f8dab3654ce669c8c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

accept-ranges: bytes
content-length: 155748
date: Tue, 25 Mar 2025 01:14:03 GMT
last-modified: Mon, 24 Mar 2025 02:57:04 GMT
content-type: image/jpeg
server: Apache

GET
H2 200 1f449.png
s.w.org/images/core/emoji/15.0.3/72x72/ 423 B
730 B 187ms
58ms Image
image/png 192.0.77.48
AUTOMATTIC

General

Check archive.org

Download Go to Show image

Full URL

https://s.w.org/images/core/emoji/15.0.3/72x72/1f449.png

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

s.w.org

Software

nginx /

Resource Hash

9cf1114324a6653750f0f8af7783a744e45adadca47c48844e4ee0f11df269bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=315360000
x-nc: HIT bur 1
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 423
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: image/png
last-modified: Tue, 30 Jan 2024 01:21:05 GMT
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 file.png
static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/ 1010 KB
1011 KB 421ms
126ms Image
image/png 2600:9000:250b:c200:1e:5c56:d400:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250b:c200:1e:5c56:d400:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.27.1.1 /
Resource Hash: 76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-cf-id: H6x5ZRyzA1BglR38flTHusM1Vfz7wPFYcbqG69wBtQ9DiBO0wdT8bw==
cache-control: public, max-age=15552000, immutable
timing-allow-origin: *
age: 3712623
via: 1.1 google, 1.1 4d8384431ad0b8e60c79585b2d139316.cloudfront.net (CloudFront)
x-wixmp-trace: projects/wix-media-infrastructure/traces/2spVhEK7hN7G4oknE9KNdNWC2Cu
access-control-allow-origin: *
x-seen-by: image-manipulator-79c6fd85fd-jw8kv
content-length: 1033732
alt-svc: h3=":443"; ma=86400
date: Mon, 10 Feb 2025 01:57:00 GMT
content-type: image/png
x-cache: Hit from cloudfront
server: openresty/1.27.1.1
x-amz-cf-pop: IAD12-P4

GET %E6%A8%82%E5%A4%A9%E8%B2%B8-%E4%BF%A1%E7%94%A8%E7%AE%A1%E7%90%86%E6%8C%87%E5%8D%97-1.jpg
blog.alphaloan.co/wp-content/uploads/2021/04/ 0
0

POST
H2 204 collect
analytics.google.com/g/ 0
0 380ms
127ms Fetch
text/plain 2607:f8b0:4004:c08::71
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je53l1v897965293za200zb9181474282&_p=1742865242346&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109&cid=2131144943.1742865243&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1742865243&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2305
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::71 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:137:0
report-to: {"group":"ascnsrsggc:137:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:137:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:137:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
552 B 383ms
129ms Ping
text/plain 2607:f8b0:4004:c06::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-N394QBRGC0&cid=2131144943.1742865243&gtm=45je53l1v897965293za200zb9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=102482433~102788824~102803279~102813109
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c06::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:112:0
report-to: {"group":"ascnsrsggc:112:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:112:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:112:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 1CBE 0
0 375ms
128ms Document
text/html 2607:f8b0:4004:c1f::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-N394QBRGC0&gacid=2131144943.1742865243&gtm=45je53l1v897965293za200zb9181474282&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102482433~102788824~102803279~102813109&z=613206757

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:03 GMT
expires: Tue, 25 Mar 2025 01:14:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 128002626 Show response
fundingchoicesmessages.google.com/i/ 196 KB
64 KB 515ms
150ms Script
application/javascript 2607:f8b0:4004:c08::71
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/128002626?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f9f2b646145f92ff6b5b2bbd5cdc6099254a19047fc708b7acc872e6c499f04a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-BlV_iyibxurbf2_zLPszZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjctDikmLw0ZBiOHHrNtMFIG69eY51KhAbrT3P6gTEhgqXWB2B-P66S6zPgfhD_WXWH0BcJHGFtQmIhXg4brd17GcTePDw8WxmJY2k_ML45Py8kqLMpNKS_KK05LTU4tSistSieCMDI1MDYyNjPQOz-AJDAEdBMSw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-BlV_iyibxurbf2_zLPszZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 policy-check Show response
cpt.geniee.jp/hb/v1/ 12 B
162 B 479ms
160ms XHR
application/json 203.137.133.156
IDCF IDC Frontier...

General

Check archive.org

Download Go to

Full URL: https://cpt.geniee.jp/hb/v1/policy-check?loc=https%3A%2F%2Freurl.cc%2FXqAx30&list_id=mid-219632&gam_id=gam-424536528%2Cgam-0
Requested by: Host: cpt.geniee.jp
URL: https://cpt.geniee.jp/hb/v1/lib/gnshbrequest-v4.23.3.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 203.137.133.156 , Japan, ASN4694 (IDCF IDC Frontier Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 3108e15dfc911f1a730106ee1e44c941639e0b7add838d095680425e86d086c3

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: *
cache-control: max-age=10800, private
content-length: 12
date: Tue, 25 Mar 2025 01:14:03 GMT
content-type: application/json
server: nginx
cross-origin-resource-policy: cross-origin

GET
H2 200 AGSKWxUR5BKCa8NHfY9JoK2mv1zYZJnCYyU7n117ZT05PQMJiMAQFdDMC1rkyad80dNBLwii5SNM0xzg6hWWxiRCLfghP8Sz6QWLGZfZdRg6Pxccw5Vuah9ULlIAYcFaRsq_PMVy_HXGag== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 145ms
143ms Script
application/javascript 2607:f8b0:4004:c08::71
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUR5BKCa8NHfY9JoK2mv1zYZJnCYyU7n117ZT05PQMJiMAQFdDMC1rkyad80dNBLwii5SNM0xzg6hWWxiRCLfghP8Sz6QWLGZfZdRg6Pxccw5Vuah9ULlIAYcFaRsq_PMVy_HXGag==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODY1MjQ0LDIwODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLG51bGwsW1s4LCJkYUh6ekRVd0hHUSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.daHzzDUwHGQ.es5.O/d=1/rs=AJlcJMw0U3pAz_cITaWp4fDBnRc9ZevyHQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9b06724bad0c4a751d64a777260664f9b2fa627b4536f5c8b143ee3d0234d3e8

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5u4UCcbCPxKyEoQd39w7jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:04 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmLw1JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYiFeDjutHXsZxNY8fVDF6OSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGxkbGegVl8gSEADlMr8g"
content-security-policy: script-src 'report-sample' 'nonce-5u4UCcbCPxKyEoQd39w7jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame F5EC 0
0 362ms
120ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28858
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:47:20 GMT
expires: Tue, 25 Mar 2025 01:37:20 GMT
last-modified: Mon, 24 Mar 2025 19:44:53 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 270ms
60ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 562475
x-goog-stored-content-encoding: gzip
expires: Wed, 18 Mar 2026 12:59:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 18 Mar 2025 12:59:29 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AKDAyIvuhycBiZV9JeORnaJQHZmOjiL0vuW97VD_EUR507Gfo-1WAjwPJLIgsSbqvowsnZT2CV3ySGx02hF6
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 369ms
225ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Tue, 25 Mar 2025 01:14:04 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 37a0f024a1a6cc032a37a1f32b1e6082

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 389ms
143ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b6c5af2d5c532a14b5aa51656c9d5e8be329b1424ec1df2947ad2de309622448

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-a641"
cross-origin-resource-policy: cross-origin
expires: Wed, 26 Mar 2025 01:14:04 GMT
access-control-allow-origin: *
date: Tue, 25 Mar 2025 01:14:04 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 217ms
80ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 196091
cf-ray: 925a8ca189137c24-LAX
expires: Fri, 28 Mar 2025 01:14:04 GMT
date: Tue, 25 Mar 2025 01:14:04 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 219 KB
16 KB 459ms
459ms Fetch
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=551751161037882&correlator=3296974323445774&eid=31090917%2C31091041%2C31091199%2C83321073&output=ldjh&gdfp_req=1&vrg=202503190101&ptt=17&impl=fifs&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C13848%2C18535%2C13856%2C13860%2C14209%2C14210&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5%2C%2F0%2F1%2F6%2C%2F0%2F1%2F7&prev_iu_szs=300x250%2C1x1%7C320x480%2C300x250%2C300x250%2C1x1%7C320x50%7C300x100%7C320x100%2C300x250&ifi=1&didk=3663017418~954026992~3220679602~2335188262~1073006158~4279657583&dids=div-gpt-ad-1692339097859-0~div-gpt-ad-1706005027566-0~div-gpt-ad-1682415009667-0~div-gpt-ad-1682415043506-0~div-gpt-ad-1683598631228-0~div-gpt-ad-1683598657711-0&adfs=1641170635~~3999208325~~4276429512~3230137061&sfv=1-0-41&sc=1&cookie_enabled=1&abxe=1&dt=1742865244233&lmt=1742865244&adxs=1005%2C-9%2C245%2C-9%2C245%2C625&adys=108%2C-9%2C108%2C-9%2C455%2C108&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C-1%7C0%7C-1%7C0%7C0&ucis=1%7C2%7C3%7C4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=380x250%7C0x-1%7C380x250%7C0x-1%7C1140x50%7C380x250&msz=350x250%7C0x-1%7C350x250%7C0x-1%7C1110x50%7C350x250&fws=0%2C2%2C0%2C2%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0%2C0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742865241624&idt=1748&adks=1451399479%2C4066066610%2C827794272%2C3475397127%2C3271617715%2C3242553145&frm=20&eoidce=1&td=1&egid=1496&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

8f083b07f3b2aa8c2b404e006849983bb50eb4bdb0aec2fa91d22de540c10b21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6424070779,6405456366,6297987529,6690069789,6499557592,6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2,-2,-2,-2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:04 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138456634296,138452341869,138432380646,138468304473,138462658624,138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 15962
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 70FE 0
0 379ms
122ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:04 GMT
expires: Tue, 25 Mar 2025 01:14:04 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 AGSKWxXV_pVObVRhL_8DTgiO00ETFacaovt5GwqufxmAfqPNoIV5quLz6ownP9rXFlo7aaCaiJM4n1Akf4V4_Tw-VUdVBL08ZFSRfYQVCVpgEJYQ_nqw-92a9yosqP7b07thgTITjqVdWA== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 146ms
145ms Script
application/javascript 2607:f8b0:4004:c08::71
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXV_pVObVRhL_8DTgiO00ETFacaovt5GwqufxmAfqPNoIV5quLz6ownP9rXFlo7aaCaiJM4n1Akf4V4_Tw-VUdVBL08ZFSRfYQVCVpgEJYQ_nqw-92a9yosqP7b07thgTITjqVdWA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODY1MjQ0LDM1OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcmV1cmwuY2MvWHFBeDMwIixudWxsLFtbOCwiZGFIenpEVXdIR1EiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::71 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0d5f72fa17406cb784088b7c7f36763a1a2057fa33961feb227c88f8643c09f3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-IiOpXuGz6otWzjnrkEc0mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:04 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmJw0ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYiFeDjutHXsZxPYseDrJUYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwNjI2M9A7P4AkMADSIr9Q"
content-security-policy: script-src 'report-sample' 'nonce-IiOpXuGz6otWzjnrkEc0mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 syncframe
gum.criteo.com/ Frame F7D2 0
0 353ms
116ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:04 GMT
server: Kestrel
server-processing-duration-in-ticks: 251512
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2C1B 0
0 134ms
133ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssDKTkfYaHZfNlALb1hfFWQ08fMMP_vEu0GHXPPNyKO802cnuR-Yfkt3kkSXLvE8SO8AEK2CygxqNAO7sN6qwIxAeoKf4QmbSZEVyUnY2B6iACIUqIcIDGfJ71yi68RfZoM9pXdARuAJ2FTp6cnY91w5XTZ3KcCpOMuR-wrtvCG-kLpA86mldTfAMXyRZ6zFV0FYXWS49jjFibfkeGKjwnxwrpvyKZqswaoKvRt-2YjkMg9S6CyetQzybV-zBLKpWaofmVRPJHDLRrH4cM2z37Zp4_dET9VAGnOiW5L9rspPF09g-x13Er9alPTYTRAyJRO7TDVYKx5JrUwIRkUMzwAwBUXvMflez2YBU_tx2JogZhIzif_uP6y2b0XFlVa6FD4ToFOsVGnZC2x-gXcnfzTd-jqzg3uYYE-3QQmzcO1LwrOhpWCQfVCqg&sai=AMfl-YRSAH_pYaSGzWky1X_ZCbqkOvnRag_K1jwrKrA7GBXtszdh1alMYGuF5XupS5bsy97vFciQoyKcKEArTi2gYFybwKmKC3ivf5SQA5YF568zL2Z3MXQT7ynKMqPU&sig=Cg0ArKJSzPom8jaTfc6hEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200
OK cf_reurl_tw_gam.js Show response
api.popin.cc/searchbox/ Frame 2C1B 129 KB
37 KB 748ms
354ms Script
text/javascript 119.63.193.220
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.193.220 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: cd0db2d68f6fb00e1197e823f47e1f53aa2aa2ae85228a5e5d04a4a863629cc1

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Content-Encoding: gzip
ETag: W/"84c303c8957ac66aa38f2a88e2291b99"
x-amz-version-id: u2A0lYWFB7No0ZP_ZBKUcX5kfrhgSMHf
Expires: Tue, 25 Mar 2025 02:14:05 GMT
Date: Tue, 25 Mar 2025 01:14:05 GMT
Last-Modified: Wed, 19 Mar 2025 07:07:58 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
Transfer-Encoding: chunked
X-Cache-Status: HIT from 10.252.55.44
x-amz-replication-status: COMPLETED
Cache-Control: max-age=3600
Timing-Allow-Origin: *
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Server: nginx
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2C1B 219 KB
67 KB 367ms
121ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2D25 0
0 134ms
133ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstURQi4qU9APlUPIcA4Rjf_wRjIOxxWvN3S9hVaxuP0n57TzOFLMbCNeZQMytvGbQiUGpBumZMUgncDBotNjmLAwJVNPydo2Z14KiHxRJovqKMy0kJMRJZYMQJIrcxePJ77NhT6FS0MtPRqrHWGMyn6yODvaknlXUrG7sSYMaZqAUw6fu4S0gV0dBL_STl6q9m4r4hTXhyh4xwuXbKPvI6k4RwYZctV27vvTP40Xj6ZKSNjq2DcfROwPPptS-x97HcoNIDSnRZzwgulN8bEk-xBJQDzBJA8XHhm3S90ESeQ0nV_vsNyoxuApRdEN-oy6HYRp-M0MXnY8eDkEcGd8C1XLXprb9u7GJAJpRFREmV6k2x9wvz22Xur4xX_hNe1v8zHlY-gPoaoFDWCVrLPso6x2FIcBOG-2BjYIqZTEgJ1ib7NpO4lbIwiAw&sai=AMfl-YQtFggAdO2qOHyGeTRnv1tKEDqYKVt2xsAs0qfVcmkHT0Iu9BBGjvs_WfE11IR8wZMXc6_tHN5SaoVVSD1i6duSjGlKyHwhJgBynkO9seOmPTLYDNX90FtH4svG&sig=Cg0ArKJSzCOszfDxr3meEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame 2D25 9 KB
10 KB 413ms
129ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 58
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: 7LeEwjIyQg_3JTtII3W8Y07jrnCogz4K_sAgcpFLF0vHG5rzgcO4Dg==
date: Tue, 25 Mar 2025 01:13:10 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2D25 219 KB
0 356ms
356ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7018 0
0 134ms
133ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu2GV-Q5chC0qJb1vfTJIUE0jr-ysafGrEePxDC7tI01Q0Wfy6w2iR0Sk8SJH_dGq8_78aiK00Lp0RT-g3tUJawI9uoxpQqxmrHt5Um8u9qiT6mmjm1Va6bJhaod_L88M5v1FpQke01w3ro94nPw5OzQitesnm0At34yHDqDwdDqvT8kCVfDA7yQ_yI9GbSGMicUvVLrzRCDmqwjDm-0xvfs8gs7cbzAf3ES0QvhjDBX-6yKd_8El__osGlyKYPakIbjXQgHY-ddO92x7oMZFoeL3cU0uidS3HV3SDkfIaNuiZQqWxlMiiR0Utt12XhQwdRKX9JlSnTDvBYMMqJqWVA1nl8huKWcKhcQeom2GcFSyQqT_6wYc7theR0awbYdy-f2DypSg2VZiQkN-DpPlPECVy28EscIJqdD8Vp7MYLAn7sOtAS3BJF0MNEx-sDM_o&sai=AMfl-YRQugdwqpPkCJ61C4cimRTt8DZ7_AEBBfpqigrmyZfaVyqYncKbSf4V3MuBPUusD7YqaJvMh4fOBuM0OnvAE2jr1GTzG-kQtM5rUYaEIf6Pp3NWSw45xxQny3uU&sig=Cg0ArKJSzNAeO7nuftVBEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame 7018 9 KB
0 405ms
405ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 58
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: 7LeEwjIyQg_3JTtII3W8Y07jrnCogz4K_sAgcpFLF0vHG5rzgcO4Dg==
date: Tue, 25 Mar 2025 01:13:10 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 7018 219 KB
0 349ms
349ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 5D24 0
0 132ms
131ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuE8cLX2pJOqUzXw3Epr8XF4bilRYuntB_RP5N4q3RJ1bkKuFyIfZ4sBTeK2AiSWuQHZIYjD891bJENElKOMZOGQ3mi340kJvNL8ZqDjJ-64rmvGNgV9GloK6GJ6fEnYxNC77_3JrlCKxI78-_MGCqqBpQj6bxiWjrDY950YUxgjv4vXcAhjG2JqJXEkHMyfEgtIHfCaGDkkH6rX6hzkBtTGXdoZRfLjPdi59DObGujQ3ArbB7hcVcKjiCiG1oyUpy5HL9bEqH_PWQlPeqthMEQC6SSXaztwSx9wjF81M1n_cxU_L6Gpn73Cn4R8LtOoLbfUen4UMT2bzpNOuJJS6DOdowlCRV0NHu7RWvzJOpk_sbYyTAfNbaXPO8ZOAgsTh6Hx2PadHNpEmKsBdg_UQoT480dMhN5caG6L8gXCiktX8WOR6NMbA2JUDA-ntk05Rw&sai=AMfl-YRSnFVFyULEIKVombXPuPHvMcRUWZgZ3ZusiUltIQArmELd7pndWyWxuCrgso1Hv4eCJrn81VhusA0zULppW1UalDsGReWJlI6QY_ZzUbcpORYU_5bE5mqPOlTw&sig=Cg0ArKJSzPdLorkuv5FgEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:04 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame 5D24 9 KB
0 397ms
397ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 58
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: 7LeEwjIyQg_3JTtII3W8Y07jrnCogz4K_sAgcpFLF0vHG5rzgcO4Dg==
date: Tue, 25 Mar 2025 01:13:10 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 5D24 219 KB
0 341ms
341ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 1DAA 0
0 364ms
132ms Document
text/html 2600:9000:250a:b800:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:b800:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 37
content-length: 12184
content-type: text/html
date: Tue, 25 Mar 2025 01:13:29 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-amz-cf-id: OdOHHc-gqjCh-4AbNWFkc5m1nZH2uUATy7Nb4rvgnS-OBzvzEeSaGg==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame FB5A 11 KB
11 KB 130ms
130ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: RFhOCFKgBec9G1XY4C_qiYcDxTuShviNQMsQOL1BEPc0SJlCfvuL3Q==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 7B27 0
0 352ms
352ms Document
text/html 2600:9000:250a:b800:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:b800:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 37
content-length: 12184
content-type: text/html
date: Tue, 25 Mar 2025 01:13:29 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-amz-cf-id: OdOHHc-gqjCh-4AbNWFkc5m1nZH2uUATy7Nb4rvgnS-OBzvzEeSaGg==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 6F8F 11 KB
0 119ms
119ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: RFhOCFKgBec9G1XY4C_qiYcDxTuShviNQMsQOL1BEPc0SJlCfvuL3Q==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 adyard. Show response
fundingchoicesmessages.google.com/f/AGSKWxXC26ujx3SUmnWpydWGfUoJt1wHSnGY1Wc2yTmTGz6YHTtet-NIsXs06Ods0udAR0ievpOPEoQx5XcLBubomxeytkq8yvFjZ93-UyhFBqob4LCjr6ileR1_BpMurr5OTgCJoRBoK6iiPd4a7vbptTOSllECz... 54 B
109 B 139ms
139ms Script
application/javascript 172.253.122.101
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXC26ujx3SUmnWpydWGfUoJt1wHSnGY1Wc2yTmTGz6YHTtet-NIsXs06Ods0udAR0ievpOPEoQx5XcLBubomxeytkq8yvFjZ93-UyhFBqob4LCjr6ileR1_BpMurr5OTgCJoRBoK6iiPd4a7vbptTOSllECzuErUNvyJj1fqEk2_CX--6zWpsHPcL3G/_/ad_tag./eshopoffer._ad/section_=half-page-ad&/adyard.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.daHzzDUwHGQ.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMw0U3pAz_cITaWp4fDBnRc9ZevyHQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

64e21603d2e1540c0da767e0135df5f36748a4dac09ae5d6648b0f8b32ee5e15

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-UPsI9MbW6ctZy_JeGfj8uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmLw0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYiFeDjutnXsZxN4cf1jG6OSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGxkbGegVl8gSEAFpUsGQ"
content-security-policy: script-src 'report-sample' 'nonce-UPsI9MbW6ctZy_JeGfj8uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 40 KB
15 KB 123ms
122ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.daHzzDUwHGQ.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMw0U3pAz_cITaWp4fDBnRc9ZevyHQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

6d03166137610370c00d5af20236e916aee1b3d4e2f8b5ed1293b5ed0f050c87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 15701659039819268536
age: 2815
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:27:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:27:10 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 14994
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUp8yr6wOmW0GOvwhODqySTUqe3QHIQ_m9uhNHqv8KNh3O8PqRpPfaOzt5v3gr7WGV5UQQl8PHvAqPuxaRp2AfD7QmngafuiJJrVqmnAyvskoFHu7FgH66YULvOgYwM6XefXzUX0A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 255ms
132ms XHR
text/html 172.253.122.101
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUp8yr6wOmW0GOvwhODqySTUqe3QHIQ_m9uhNHqv8KNh3O8PqRpPfaOzt5v3gr7WGV5UQQl8PHvAqPuxaRp2AfD7QmngafuiJJrVqmnAyvskoFHu7FgH66YULvOgYwM6XefXzUX0A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6ucthV21kAZ0X0UtQ5KCRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw0ZBi-FB_mfUHEAvxcNxt69jPJrDi68V9jEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDYyFjPwDy-wAAAd90kvg"
content-security-policy: script-src 'report-sample' 'nonce-6ucthV21kAZ0X0UtQ5KCRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 49C9 0
0 339ms
339ms Document
text/html 2600:9000:250a:b800:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:b800:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 37
content-length: 12184
content-type: text/html
date: Tue, 25 Mar 2025 01:13:29 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-amz-cf-id: OdOHHc-gqjCh-4AbNWFkc5m1nZH2uUATy7Nb4rvgnS-OBzvzEeSaGg==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame D68A 11 KB
0 106ms
106ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: RFhOCFKgBec9G1XY4C_qiYcDxTuShviNQMsQOL1BEPc0SJlCfvuL3Q==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C1B 0
0 225ms
223ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 2C1B 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ffae84e0dcecb5c3c608654ce28dbb6d26cef061b6f6e663087a23b77f782f22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7018 0
0 310ms
129ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5D24 0
0 423ms
129ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2D25 0
0 533ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C1B 0
0 130ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7018 0
0 257ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 2D25 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c5b2c8132270b4b66ffbf437781cfb6157470b0fcc4ee64dbc84de2bf34344ea

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 7018 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af57f9310ddf77f7f86c7409e2879a408aa2089be22ea85e2004a93a0a0a33ff

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 5D24 211 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 913947f0aeb73626c855bfd3f715ae0a27a5aee727b53a0281cd324ea3e0565c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5D24 0
0 383ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2D25 0
0 511ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame FB5A 2 KB
741 B 564ms
172ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13856
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 7f73422fabf3e3c0bdc38c55c68464b112b15537766ca9dc7292316032d25cfb

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame FB5A 30 KB
30 KB 135ms
134ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: Ys8GcljcdwFvSc5uxAtcRsoe6zzJrvP_CLwyN67zmJLoCcB1CM4COg==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame D68A 2 KB
795 B 559ms
170ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame D68A 30 KB
0 134ms
134ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: Ys8GcljcdwFvSc5uxAtcRsoe6zzJrvP_CLwyN67zmJLoCcB1CM4COg==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 6F8F 7 KB
1 KB 562ms
173ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14209
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 43a71fb6e8f61126f7dfb3fe8a1a01eba8cfbff5cd7d681bba0e62f64ad924c7

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 6F8F 30 KB
0 134ms
134ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: Ys8GcljcdwFvSc5uxAtcRsoe6zzJrvP_CLwyN67zmJLoCcB1CM4COg==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUp8yr6wOmW0GOvwhODqySTUqe3QHIQ_m9uhNHqv8KNh3O8PqRpPfaOzt5v3gr7WGV5UQQl8PHvAqPuxaRp2AfD7QmngafuiJJrVqmnAyvskoFHu7FgH66YULvOgYwM6XefXzUX0A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-z3048cc5_yTFi1KNVmP7Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmJw15Bi-FB_mfUHEAvxcNxt69jPJnBh8sm_jEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDYyFjPwDy-wAAAdNEktg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-z3048cc5_yTFi1KNVmP7Gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUp8yr6wOmW0GOvwhODqySTUqe3QHIQ_m9uhNHqv8KNh3O8PqRpPfaOzt5v3gr7WGV5UQQl8PHvAqPuxaRp2AfD7QmngafuiJJrVqmnAyvskoFHu7FgH66YULvOgYwM6XefXzUX0A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-LcK8QxITtIf4QYD_ShVCOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII0pBi-FB_mfUHEAvxcNxt69jPJnDhx7l_jEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDYyFjPwDy-wAAAl9glLA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-LcK8QxITtIf4QYD_ShVCOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUp8yr6wOmW0GOvwhODqySTUqe3QHIQ_m9uhNHqv8KNh3O8PqRpPfaOzt5v3gr7WGV5UQQl8PHvAqPuxaRp2AfD7QmngafuiJJrVqmnAyvskoFHu7FgH66YULvOgYwM6XefXzUX0A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-7AMlgEDLkTvlVgYFPZsLWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmLw15Bi-FB_mfUHEAvxcNxt69jPJnDg--3_jEouSfmF8cn5eSWpeSW6iSnFuiB2UWZSaUl-EQo7tQykIic_PT0zLz3eyMDI1MDYyFjPwDy-wAAAlbslJg"
content-security-policy: script-src 'report-sample' 'nonce-7AMlgEDLkTvlVgYFPZsLWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxW0k8WF4hv51SMxbu-7YVnnOtuEexslh5pHk1l6U7Zg5fUVGT9UVCkohA5HBJiffgvw--qb__0mXP8XzBhF1BNp85SgY68Es-KKyXnS7AmsTAxfJ4SYw-AxmkHqzi4dBmHqmCfW7g== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 146ms
146ms Script
application/javascript 172.253.122.101
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW0k8WF4hv51SMxbu-7YVnnOtuEexslh5pHk1l6U7Zg5fUVGT9UVCkohA5HBJiffgvw--qb__0mXP8XzBhF1BNp85SgY68Es-KKyXnS7AmsTAxfJ4SYw-AxmkHqzi4dBmHqmCfW7g==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQyODY1MjQ1LDQ2NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLG51bGwsW1s4LCJkYUh6ekRVd0hHUSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

0176b20c4879444a159d23fe232a7dfd0dcf12c68d6969f814b15cbdc22a8937

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-452i8G3l_GWtSDkfCC0lUg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjstDikmJw15BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYiFeDjutnXsZxO4sX5iM5OSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGxkbGegVl8gSEA-sErfg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-452i8G3l_GWtSDkfCC0lUg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUNgSXt_vyBaByKN8U3mVP6skfhm8SkM-LPemqqMBbET3fCsLpuASkCI6cgcITTHmZrxSvL-zanTGrUzw2OYXcliJQhvyu7_Qz7y-3vKWmtp4vdydmVKfBB4qGz4IXKqY312jbbpQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 136ms
134ms XHR
text/html 172.253.122.101
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUNgSXt_vyBaByKN8U3mVP6skfhm8SkM-LPemqqMBbET3fCsLpuASkCI6cgcITTHmZrxSvL-zanTGrUzw2OYXcliJQhvyu7_Qz7y-3vKWmtp4vdydmVKfBB4qGz4IXKqY312jbbpQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.101 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f101.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5Cmdru9lDTSa5O-VL4R4lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjEtDikmII0pBi-FB_mfUHEAvxcNxt69jPJjDhYs9JJiWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamBsZKxnYB5fYAAAWF8kTw"
content-security-policy: script-src 'report-sample' 'nonce-5Cmdru9lDTSa5O-VL4R4lg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK td_js_sdk_171.js Show response
api.popin.cc/ Frame 2C1B 68 KB
16 KB 353ms
353ms Script
application/javascript 119.63.193.220
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://api.popin.cc/td_js_sdk_171.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.193.220 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 3402df1af7b8665c51ac7e2d4fed5dc6cac147d61966672d9cf32a34acafedfe

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Transfer-Encoding: chunked
X-Cache-Status: HIT from 10.252.55.44
Cache-Control: max-age=3600
Timing-Allow-Origin: *
Content-Encoding: gzip
ETag: W/"d7d7ebc58d77dc27a2c068acdf41021d"
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Expires: Tue, 25 Mar 2025 02:14:05 GMT
Date: Tue, 25 Mar 2025 01:14:05 GMT
Last-Modified: Tue, 28 May 2024 09:22:02 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Server: nginx
x-amz-server-side-encryption: AES256

GET
H2 200 recommend Show response
tw.popin.cc/popin_discovery/ Frame 2C1B 691 B
894 B 751ms
353ms Script
application/javascript 119.63.198.189
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://tw.popin.cc/popin_discovery/recommend?mode=new&url=https%3A%2F%2Freurl.cc%2FXqAx30&&device=pc&media=reurl.cc&extra=windows&agency=popinag&topn=50&ad=10&r_category=all&country=tw&redirect=true&uid=6b1a71782bfe76802531742901245856&info=eyJ1c2VyX3RkX29zIjoiV2luZG93cyIsInVzZXJfdGRfb3NfdmVyc2lvbiI6IjEwLjAuMCIsInVzZXJfdGRfYnJvd3NlciI6IkNocm9tZSIsInVzZXJfdGRfYnJvd3Nlcl92ZXJzaW9uIjoiODguMC40MzI0IiwidXNlcl90ZF9zY3JlZW4iOiIxNjAweDEyMDAiLCJ1c2VyX3RkX3ZpZXdwb3J0IjoiMzAweDI1MCIsInVzZXJfdGRfdXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIEhlYWRsZXNzQ2hyb21lLzg4LjAuNDMyNC4xOTAgU2FmYXJpLzUzNy4zNiIsInVzZXJfdGRfcmVmZXJyZXIiOiJodHRwczovL3JldXJsLmNjL1hxQXgzMCIsInVzZXJfdGRfcGF0aCI6Ii9YcUF4MzAiLCJ1c2VyX3RkX2NoYXJzZXQiOiJ1dGYtOCIsInVzZXJfdGRfbGFuZ3VhZ2UiOiJlbi11cyIsInVzZXJfdGRfY29sb3IiOiIyNC1iaXQiLCJ1c2VyX3RkX3RpdGxlIjoiIiwidXNlcl90ZF91cmwiOiJodHRwczovL3JldXJsLmNjL1hxQXgzMCIsInVzZXJfdGRfcGxhdGZvcm0iOiJMaW51eCB4ODZfNjQiLCJ1c2VyX3RkX2hvc3QiOiJyZXVybC5jYyIsInVzZXJfZGV2aWNlIjoicGMiLCJ1c2VyX3RpbWUiOjE3NDI4NjUyNDU4NTcsImZydWl0X2JveF9wb3NpdGlvbiI6IiIsImZydWl0X3N0eWxlIjoiIn0=&alg=ltr&uis=%7B%22ss_fl_pp%22%3Anull%2C%22ss_yh_tag%22%3Anull%2C%22ss_pub_pp%22%3Anull%2C%22ss_im_pp%22%3Anull%2C%22ss_im_id%22%3Anull%2C%22ss_gn_pp%22%3Anull%7D&callback=_p6_9e833e63197d
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.189 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: a04f34704979641276f23e67418c306096c72e46cfbf111165eed8ca46acf794

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-length: 691
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: application/javascript;charset=UTF-8
server: nginx/1.13.5
cross-origin-resource-policy: cross-origin

GET
H2 200 track.js Show response
ad.tagtoo.co/media/ad/ Frame 2C1B 7 KB
2 KB 189ms
60ms Script
text/javascript 34.111.12.34
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad.tagtoo.co/media/ad/track.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.12.34 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 34.12.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 80279f6baf172b794e35da391ac30711c57a3276abda4280d170920df9cca9b1

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type,Access-Control-Allow-Origin
content-encoding: gzip
x-goog-hash: crc32c=wTuGGA==, md5=5ROst+pHZlGo3jXf0Ga7EA==
etag: "e513acb7ea476651a8de35dfd066bb10"
age: 1225
x-goog-stored-content-encoding: gzip
expires: Wed, 09 Apr 2025 00:53:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 1810
date: Tue, 25 Mar 2025 00:53:41 GMT
last-modified: Thu, 20 Mar 2025 09:18:49 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIu7VX7dLjWZD-JhTad1upR4KnbA8sQC93Q5C0MqIkLZUlqOCHfq0eljYJKNePvPoK8m
cache-control: public, max-age=1296000
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1742462329152868
content-length: 1810
server: UploadServer

GET
H2 200 tuec.js Show response
uec.tagtoo.co/ Frame 2C1B 10 KB
4 KB 194ms
60ms Script
application/javascript 34.107.150.21
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://uec.tagtoo.co/tuec.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.150.21 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 21.150.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 698fe0a6500f771d98d1ca713a5445d523fac649207572b69123699702854c0b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=IxwxIw==, md5=L6Ez21DNgdh7j/uHKaarNQ==
etag: "2fa133db50cd81d87b8ffb8729a6ab35"
age: 2536
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 3770
date: Tue, 25 Mar 2025 00:31:50 GMT
last-modified: Tue, 12 Dec 2023 09:08:46 GMT
content-type: application/javascript
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvi6g2XvnFf-Fu-D8cF0l8tRo1sWdTbrm33uAfmUJqtylK89DGVZCmSS9kl_ActXf3bTtEcVC8
cache-control: public,max-age=3600
x-goog-storage-class: STANDARD
accept-ranges: bytes
x-goog-generation: 1702372126688115
content-length: 3770
server: UploadServer

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 2C1B 5 KB
3 KB 1390ms
411ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Tue, 25 Mar 2025 01:24:07 GMT
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H/1.1 200
OK popin_discovery5-min.js Show response
api.popin.cc/ Frame 2C1B 156 KB
43 KB 687ms
354ms Script
application/javascript 119.63.193.220
BAIDUJP Baidu

General

Check archive.org

Download Go to

Full URL: https://api.popin.cc/popin_discovery5-min.js
Requested by: Host: api.popin.cc
URL: https://api.popin.cc/searchbox/cf_reurl_tw_gam.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.193.220 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 46e977bd2e693545c10424af0ca8ae2061ce096d8e5658d997fa9ca60471e26d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Content-Encoding: gzip
ETag: W/"51910bb1cd9873a17caea8588a900e56"
x-amz-version-id: MCe3oXQalSYt2eLBNz01lVj92TQAzYxl
Expires: Tue, 25 Mar 2025 02:14:06 GMT
Date: Tue, 25 Mar 2025 01:14:06 GMT
Last-Modified: Mon, 24 Mar 2025 06:26:46 GMT
Content-Type: application/javascript
Vary: Accept-Encoding
Transfer-Encoding: chunked
X-Cache-Status: HIT from 10.252.55.44
x-amz-replication-status: PENDING
Cache-Control: max-age=3600
Timing-Allow-Origin: *
Connection: keep-alive
Cross-Origin-Resource-Policy: cross-origin
Server: nginx
x-amz-server-side-encryption: AES256

GET
H2 200 discoverylogs
log.popin.cc/log/popin_media/ Frame 2C1B 66 B
223 B 558ms
171ms Image
image/jpeg 119.63.198.143
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://log.popin.cc/log/popin_media/discoverylogs?data=eyJ0eXBlIjoxNCwidWEiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBIZWFkbGVzc0Nocm9tZS84OC4wLjQzMjQuMTkwIFNhZmFyaS81MzcuMzYiLCJhcGlfaG9zdCI6InR3LnBvcGluLmNjIiwiZGV2aWNlIjoicGMiLCJtZWRpYSI6InJldXJsLmNjIiwidXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJsb2MiOiJodHRwczovL3JldXJsLmNjL1hxQXgzMCIsInRkX29zIjoiV2luZG93cyIsInRkX3VzZXJfYWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBIZWFkbGVzc0Nocm9tZS84OC4wLjQzMjQuMTkwIFNhZmFyaS81MzcuMzYiLCJ0ZF9vc192ZXJzaW9uIjoiMTAuMC4wIiwidGRfYnJvd3NlciI6IkNocm9tZSIsInRkX2Jyb3dzZXJfdmVyc2lvbiI6Ijg4LjAuNDMyNCJ9&t=1742865245861
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.143 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: 654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5c332058-42"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 66
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/jpeg
last-modified: Mon, 07 Jan 2019 09:48:08 GMT
server: nginx/1.13.5

GET
H2 200 discoverylogs
log.popin.cc/log/popin_media/ Frame 2C1B 66 B
223 B 416ms
171ms Image
image/jpeg 119.63.198.143
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://log.popin.cc/log/popin_media/discoverylogs?data=eyJ0eXBlIjoxNSwicGFyYW0xIjowLCJhcGlfaG9zdCI6InR3LnBvcGluLmNjIiwiZGV2aWNlIjoicGMiLCJtZWRpYSI6InJldXJsLmNjIiwidXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ1aWQiOiI2YjFhNzE3ODJiZmU3NjgwMjUzMTc0MjkwMTI0NTg1NiIsInRkX3RpdGxlIjoiIiwiZXh0cmEiOiIiLCJpbnRlcmFjdGlvbl9udW1iZXIiOjAsInBvcGluX3ZlcnNpb24iOjYsInRkX29zIjoiV2luZG93cyIsInRkX29zX3ZlcnNpb24iOiIxMC4wLjAiLCJ0ZF9icm93c2VyIjoiQ2hyb21lIiwidGRfYnJvd3Nlcl92ZXJzaW9uIjoiODguMC40MzI0IiwidGRfdXNlcl9hZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIEhlYWRsZXNzQ2hyb21lLzg4LjAuNDMyNC4xOTAgU2FmYXJpLzUzNy4zNiJ9&t=1742865245866
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.143 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: 654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5c332058-42"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 66
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/jpeg
last-modified: Mon, 07 Jan 2019 09:48:08 GMT
server: nginx/1.13.5

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame D68A 2 KB
1 KB 186ms
183ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=379&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 35368042e7985f15e1e471961e2e6e1d822b6c1b5c2b282bf2fc97f7926eec2f

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame D68A 3 KB
3 KB 134ms
131ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 37
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: MNx8ycoZmyt3NjQOBIgur5TTgFmW7b5kwXxWQGb9BiH-_IlWCRZ1nQ==
date: Tue, 25 Mar 2025 01:13:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame D68A 130 KB
42 KB 167ms
164ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Wed, 26 Mar 2025 01:14:06 GMT
access-control-allow-origin: *
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame D68A 3 KB
4 KB 126ms
124ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 60
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: kV1BkFvIyAFb5DIVsM0K09AV2UUQnwdVZX8kr9NirS4fAuZoW51SZw==
date: Tue, 25 Mar 2025 01:13:11 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame D68A 3 KB
4 KB 133ms
131ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: pNHYebawxr-kNsjTJAoUzl2QLe5NyUPiwze6-WZPqoBZzp-KRWiNEA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame D68A 3 KB
4 KB 134ms
132ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 21
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: YRDQ8u3sCvnl6t_or0oX0w6NtrRKPmzsSnzRlnAPqxbh_RQb4AJSIQ==
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame D68A 5 KB
6 KB 133ms
131ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: p6Z2VA_II5zM_FebLXG_aQicfI5HxEBXO9n4iykxTps0r6YtPWUwyA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame FB5A 2 KB
1 KB 187ms
185ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13856&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=706&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 70f23f6f47025f395dfa58f84bd86d1463448fa6b1275a5c872f26a4526fdc8a

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame FB5A 3 KB
0 131ms
131ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 37
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: MNx8ycoZmyt3NjQOBIgur5TTgFmW7b5kwXxWQGb9BiH-_IlWCRZ1nQ==
date: Tue, 25 Mar 2025 01:13:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame FB5A 130 KB
0 163ms
163ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Wed, 26 Mar 2025 01:14:06 GMT
access-control-allow-origin: *
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame FB5A 3 KB
0 122ms
122ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 60
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: kV1BkFvIyAFb5DIVsM0K09AV2UUQnwdVZX8kr9NirS4fAuZoW51SZw==
date: Tue, 25 Mar 2025 01:13:11 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame FB5A 3 KB
0 129ms
129ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: pNHYebawxr-kNsjTJAoUzl2QLe5NyUPiwze6-WZPqoBZzp-KRWiNEA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame FB5A 5 KB
0 130ms
130ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: p6Z2VA_II5zM_FebLXG_aQicfI5HxEBXO9n4iykxTps0r6YtPWUwyA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ucfunnel.js Show response
cdn.holmesmind.com/js/ Frame FB5A 2 KB
3 KB 149ms
149ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/ucfunnel.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7FnOHKe__pwg0dVwIyTfAcdImUIZ6pwv
etag: "8ebabc4e0b1d40fe52514166c7db7048"
age: 2
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2166
x-amz-cf-id: xobmehkqJpMcGnzze127tKIvq0rzn2RYZN7LXnpZpK9QxoiONSU2vw==
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: application/javascript
last-modified: Fri, 21 Jul 2023 03:54:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 6F8F 2 KB
1 KB 189ms
189ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14209&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=842&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 17f447eff8935175783a7ef7353923f6040500b012ca22d2dad6249901cd227d

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 0.js Show response
ecs.tagtoo.co/js/ Frame 2C1B 201 KB
56 KB 264ms
61ms Script
text/javascript 34.102.218.41
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ecs.tagtoo.co/js/0.js
Requested by: Host: ad.tagtoo.co
URL: https://ad.tagtoo.co/media/ad/track.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.218.41 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 41.218.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: ed1353670cbe52a301571e6717fab543726f43f7bed2edd0ffca2e74f6a1d8bf

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type, Access-Control-Allow-Origin
content-encoding: gzip
x-goog-hash: crc32c=2mAcSQ==, md5=ijKbxOP20q6Aq4WlmoGeCA==
etag: "8a329bc4e3f6d2ae80ab85a59a819e08"
age: 5130
x-goog-stored-content-encoding: gzip
expires: Tue, 25 Mar 2025 01:18:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 56322
date: Mon, 24 Mar 2025 23:48:36 GMT
last-modified: Fri, 14 Feb 2025 14:16:26 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIu0lrruvX260knW9M1dMGwFrMOJEr5ur8qy1VGWN9XAllmbKYQwvuLB2VmD80cbBmhnGeIPXx4
cache-control: public, max-age=5400
x-goog-storage-class: STANDARD
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1739542586669957
content-length: 56322
server: UploadServer

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame D68A 0
168 B 1230ms
403ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.06129116434207993
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Tue, 25 Mar 2025 01:14:06 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame FB5A 0
168 B 1234ms
406ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.6360227863689529
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Tue, 25 Mar 2025 01:14:06 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame D68A 0
170 B 1115ms
367ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame FB5A 0
171 B 1114ms
366ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H2

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame D68A
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=oG6Z6T2PCYqeB5XdXwPiZw

2 B
160 B

189ms
185ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=oG6Z6T2PCYqeB5XdXwPiZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=oG6Z6T2PCYqeB5XdXwPiZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Tue, 25 Mar 2025 01:14:07 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame FB5A
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=V4n8vFYhAp6iSxsMXwPiZw

2 B
20 B

188ms
187ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=V4n8vFYhAp6iSxsMXwPiZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=V4n8vFYhAp6iSxsMXwPiZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Tue, 25 Mar 2025 01:14:07 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame D68A
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=6cx5LxdNCeaaDBatXwPiZw

2 B
20 B

189ms
188ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=6cx5LxdNCeaaDBatXwPiZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=6cx5LxdNCeaaDBatXwPiZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Tue, 25 Mar 2025 01:14:07 GMT
Server: nginx

GET
H2 204 header Show response
hb.aralego.com/ Frame FB5A 0
130 B 595ms
334ms XHR
text/plain 192.96.203.13
LEASEWEB-USA-WDC

General

Check archive.org

Download Go to

Full URL: https://hb.aralego.com/header?ver=ADGENT_PREBID-2018011501&ifr=0&bl=zh-TW&je=1&dnt=0&adid=ad-E2B6A4DA7838884AF9E83E64D69E36D&u=https%3A%2F%2Freurl.cc%2FXqAx30&host=reurl.cc&w=300&h=250
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/ucfunnel.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.96.203.13 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

date: Tue, 25 Mar 2025 01:14:06 GMT
access-control-allow-origin: https://reurl.cc
access-control-allow-credentials: true

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame D68A 13 KB
13 KB 135ms
133ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=379&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 12
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: EaIfmWdoUzyctHu2VEJvVVAQh4cMCxn4zIYxHO5CnTLFv70G66Fk5w==
date: Tue, 25 Mar 2025 01:13:55 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame D68A 5 KB
0 1031ms
1031ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Tue, 25 Mar 2025 01:24:07 GMT
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame FB5A 13 KB
0 122ms
122ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13856&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=706&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 12
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: EaIfmWdoUzyctHu2VEJvVVAQh4cMCxn4zIYxHO5CnTLFv70G66Fk5w==
date: Tue, 25 Mar 2025 01:13:55 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame FB5A 5 KB
0 1029ms
1029ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Tue, 25 Mar 2025 01:24:07 GMT
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 6F8F 13 KB
0 119ms
119ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14209&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=842&o=1&fc=undefined&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 12
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: EaIfmWdoUzyctHu2VEJvVVAQh4cMCxn4zIYxHO5CnTLFv70G66Fk5w==
date: Tue, 25 Mar 2025 01:13:55 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 6F8F 5 KB
0 1019ms
1019ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Tue, 25 Mar 2025 01:24:07 GMT
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame D68A 0
187 B 412ms
120ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=30144119855

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:06 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame FB5A 0
186 B 431ms
139ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=42465671018

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:05 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H3 200 /
www.facebook.com/tr/ Frame 2C1B 0
16 B 120ms
119ms Image
text/plain 31.13.66.35
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?eid=1742865246444&id=404012299753340&ev=PageView&dl=https%3A%2F%2Freurl.cc%2FXqAx30&rl=https%3A%2F%2Freurl.cc%2FXqAx30&if=true&ts=1742865246443&sw=1600&sh=1200&v=2.9.44&r=stable&fbp=fb.1.1742865243016.15418984167960242&it=1742865246428&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.35 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-iad3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=116, rtx=0, c=30, mss=1232, tbw=13403, tp=27, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H2 200 discoverylogs
log.popin.cc/log/popin_media/ Frame 2C1B 66 B
223 B 172ms
172ms Image
image/jpeg 119.63.198.143
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://log.popin.cc/log/popin_media/discoverylogs?data=eyJ0eXBlIjoxNSwicGFyYW0xIjoyLCJhcGlfaG9zdCI6InR3LnBvcGluLmNjIiwiZGV2aWNlIjoicGMiLCJtZWRpYSI6InJldXJsLmNjIiwidXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ1aWQiOiI2YjFhNzE3ODJiZmU3NjgwMjUzMTc0MjkwMTI0NTg1NiIsInRkX3ZlcnNpb24iOiIxLjcuMSIsInRkX2NsaWVudF9pZCI6ImI0NDAzYjg5LTEwMjItNGU0OS1hNDJlLTg5YWY1NjNhNTk5ZCIsInRkX2NoYXJzZXQiOiJ1dGYtOCIsInRkX2xhbmd1YWdlIjoiZW4tdXMiLCJ0ZF9jb2xvciI6IjI0LWJpdCIsInRkX3NjcmVlbiI6IjE2MDB4MTIwMCIsInRkX3ZpZXdwb3J0IjoiMzAweDI1MCIsInRkX3RpdGxlIjoiIiwidGRfdXJsIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ0ZF91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgSGVhZGxlc3NDaHJvbWUvODguMC40MzI0LjE5MCBTYWZhcmkvNTM3LjM2IiwidGRfcGxhdGZvcm0iOiJMaW51eCB4ODZfNjQiLCJ0ZF9ob3N0IjoicmV1cmwuY2MiLCJ0ZF9wYXRoIjoiL1hxQXgzMCIsInRkX3JlZmVycmVyIjoiaHR0cHM6Ly9yZXVybC5jYy9YcUF4MzAiLCJ0ZF9icm93c2VyIjoiQ2hyb21lIiwidGRfYnJvd3Nlcl92ZXJzaW9uIjoiODguMC40MzI0IiwidGRfb3MiOiJXaW5kb3dzIiwidGRfb3NfdmVyc2lvbiI6IjEwLjAuMCIsImNsaWVudF9pZCI6ImI0NDAzYjg5LTEwMjItNGU0OS1hNDJlLTg5YWY1NjNhNTk5ZCIsImV4dHJhIjoiIiwiaW50ZXJhY3Rpb25fbnVtYmVyIjowLCJwb3Bpbl92ZXJzaW9uIjo2fQ==&t=1742865246618
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.143 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx/1.13.5 /
Resource Hash: 654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5c332058-42"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 66
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/jpeg
last-modified: Mon, 07 Jan 2019 09:48:08 GMT
server: nginx/1.13.5

GET
H2 200 log.gif
r.popin.cc/ Frame 2C1B 35 B
186 B 554ms
175ms Image
image/gif 119.63.198.188
BAIDUJP Baidu

General

Check archive.org

Download Go to Show image

Full URL: https://r.popin.cc/log.gif?type=related-tw&uid=6b1a71782bfe76802531742901245856&url=https%3A%2F%2Freurl.cc%2FXqAx30&t=1742865246621
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 119.63.198.188 , Japan, ASN38627 (BAIDUJP Baidu, Inc., JP),
Reverse DNS
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: "5d6f3cde-23"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 35
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: image/gif
last-modified: Wed, 04 Sep 2019 04:26:06 GMT
server: nginx

POST
H2 204 events
bidder.criteo.com/csm/ Frame D68A 0
186 B 122ms
120ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:05 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame D68A 43 B
365 B 119ms
118ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://static.criteo.net/images/pixel.gif?ch=1

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame D68A 43 B
365 B 120ms
120ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://static.criteo.net/images/pixel.gif?ch=2

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame FB5A 43 B
0 102ms
102ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame FB5A 43 B
0 104ms
104ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

POST
H2 204 events
bidder.criteo.com/csm/ Frame FB5A 0
186 B 119ms
118ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:06 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 0224 106 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

688f229a7cac61e53d32a21d50ff29e962c48c9e65d65f9da34553c017003a15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 582 / 20172 / m202503190101 / config-hash: 9754453387445197641
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33605
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame CE42 106 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

688f229a7cac61e53d32a21d50ff29e962c48c9e65d65f9da34553c017003a15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 582 / 20172 / m202503190101 / config-hash: 9754453387445197641
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33605
x-xss-protection: 0
server: cafe

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame F6BB 106 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

688f229a7cac61e53d32a21d50ff29e962c48c9e65d65f9da34553c017003a15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 582 / 20172 / m202503190101 / config-hash: 9754453387445197641
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33605
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/ Frame 0224 526 KB
0 1ms
0ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

3b07482a7e55296a20e35304c8d3a30bc4805d350a933c634713001d467eb6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 7854641952111388716
age: 44028
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 13:00:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:00:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169032
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/ Frame CE42 526 KB
0 5ms
5ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

3b07482a7e55296a20e35304c8d3a30bc4805d350a933c634713001d467eb6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 7854641952111388716
age: 44028
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 13:00:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:00:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169032
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/ Frame F6BB 526 KB
0 6ms
6ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

3b07482a7e55296a20e35304c8d3a30bc4805d350a933c634713001d467eb6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 7854641952111388716
age: 44028
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 13:00:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:00:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169032
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame 0224 63 KB
0 4ms
4ms Other
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 47531
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 12:01:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 12:01:52 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame CE42 63 KB
0 10ms
10ms Other
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 47531
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 12:01:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 12:01:52 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame F6BB 63 KB
0 9ms
9ms Other
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 47531
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 12:01:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 12:01:52 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 1F7C 0
0 0ms
0ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28858
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:47:20 GMT
expires: Tue, 25 Mar 2025 01:37:20 GMT
last-modified: Mon, 24 Mar 2025 19:44:53 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 0224 17 KB
13 KB 269ms
136ms XHR
application/json 172.253.115.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503190101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

151c7004167a473bcd41f61ff34a35968325627f1af40d664eb6a15a5c8fd0df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13042
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 0224 36 KB
8 KB 404ms
404ms Fetch
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=339799573503629&correlator=1634720614039432&eid=31091185%2C83321073&output=ldjh&gdfp_req=1&vrg=202503190101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=3758817454&sfv=1-0-41&sc=1&cookie=ID%3Dd1f9df27f391c472%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MZ2WatZsfNjt7Zk7OEyF8XrbvJppA&gpic=UID%3D00001000f88aa859%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MapQsygeP2ZhifPNiHeFHvd_VRIBA&abxe=1&dt=1742865247139&lmt=1742865247&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=p5klb57lui57&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=3&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742865246956&idt=90&adks=3360245792&frm=23&eo_id_str=ID%3Dfe71415567f1985f%3AT%3D1742865244%3ART%3D1742865244%3AS%3DAA-AfjaD4P_npBVN9Eh8wmd8zVM7&td=1&egid=28629&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

991422674ba67764e4352fd0c8c393362e558130c27f0d48f1d886d09aeff247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7959
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 283C 0
0 369ms
120ms Document
text/html 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:07 GMT
expires: Tue, 25 Mar 2025 01:14:07 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 8630 0
0 0ms
0ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28858
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:47:20 GMT
expires: Tue, 25 Mar 2025 01:37:20 GMT
last-modified: Mon, 24 Mar 2025 19:44:53 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame CE42 17 KB
13 KB 390ms
142ms XHR
application/json 172.253.115.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503190101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

c17314e7d6e1c20fb0a0aec00c3fac548d515945ab3985f7a25eb437a639d2b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13009
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame CE42 519 B
295 B 343ms
343ms Fetch
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1420590574473844&correlator=2535357126329678&eid=31090594%2C31091040%2C31091184%2C31091200%2C83321253&output=ldjh&gdfp_req=1&vrg=202503190101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14209-2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C320x100%7C300x100&ifi=1&didk=607409652&dids=gpt-passback&adfs=3758817455&sfv=1-0-41&sc=1&cookie=ID%3Dd1f9df27f391c472%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MZ2WatZsfNjt7Zk7OEyF8XrbvJppA&gpic=UID%3D00001000f88aa859%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MapQsygeP2ZhifPNiHeFHvd_VRIBA&abxe=1&dt=1742865247160&lmt=1742865247&adxs=640&adys=455&biw=1600&bih=1200&isw=320&ish=100&scr_x=0&scr_y=0&btvi=0&ucis=pliacz4hiqde&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=3&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=320x100&msz=320x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742865246970&idt=134&adks=1212019568&frm=23&eo_id_str=ID%3Dfe71415567f1985f%3AT%3D1742865244%3ART%3D1742865244%3AS%3DAA-AfjaD4P_npBVN9Eh8wmd8zVM7&td=1&egid=28629&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

7c838752fe34c3313db25a266edcfb196f1fd93037a68e6cead7cbaebe110e86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: -2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 265
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 252B 0
0 371ms
121ms Document
text/html 64.233.180.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

64.233.180.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

pe-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:07 GMT
expires: Tue, 25 Mar 2025 01:14:07 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame B905 0
0 0ms
0ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28858
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:47:20 GMT
expires: Tue, 25 Mar 2025 01:37:20 GMT
last-modified: Mon, 24 Mar 2025 19:44:53 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame F6BB 17 KB
13 KB 513ms
138ms XHR
application/json 172.253.115.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503190101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

bc3f28594940a835936309f57d05dbcd46b002c1fcf528a3b0062ddfef218261

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12967
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame F6BB 36 KB
8 KB 395ms
394ms Fetch
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3410417764173861&correlator=513656532589081&eid=83321072&output=ldjh&gdfp_req=1&vrg=202503190101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C13856-2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=3758817452&sfv=1-0-41&sc=1&cookie=ID%3Dd1f9df27f391c472%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MZ2WatZsfNjt7Zk7OEyF8XrbvJppA&gpic=UID%3D00001000f88aa859%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MapQsygeP2ZhifPNiHeFHvd_VRIBA&abxe=1&dt=1742865247177&lmt=1742865247&adxs=270&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=p4vtyfj7uxyb&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=3&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742865246978&idt=143&adks=451274506&frm=23&eo_id_str=ID%3Dfe71415567f1985f%3AT%3D1742865244%3ART%3D1742865244%3AS%3DAA-AfjaD4P_npBVN9Eh8wmd8zVM7&td=1&egid=28629&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

210c5274f50739be0024e5357d0f80e65d9df065e7ddc47b5ac0ad883afd2d75

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6690069789
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138468304473
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7968
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 73DC 0
0 374ms
121ms Document
text/html 172.253.122.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:07 GMT
expires: Tue, 25 Mar 2025 01:14:07 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 2C1B 37 B
402 B 415ms
414ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

0f8d68a259760ba4655ea0e2cbbbab09fd4f45e2f94a8dd44dea4ed8b27fa0ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2C1B 0
0 132ms
132ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstEsvm5UDuEGAOzQLKNzsvqUMRAjipA1vR5j_4mq6oY2oeOEdp1OfyVhu-InQd6QiZBKQpQmTc46K8NRYfyx4K25lpJgMVbkXhcahCSql-PyjvbQ3HbIAFUbNh39rlpCazKncEXID6EaeOawbXrGN3t66IRLlp13DOCk61sJ3k1a0uEpG7RgpSBxftehwDMu3PkxWKssvyvFqw319lpIIVOt5Wn_4d7Rxq9gh3_ooOXRZpc5I35BZicZb0TCPy3Ijua1wOtwWW4-UIKA3HDj4GtMbd84eans0uJFYZ5hHqmuxw4CTQ2C0tg3qiTojISfLVCMcwQpmdaBLeGr1vYGQNa3UK52O6Mc9k0wUzyS4xWHhtq4Hc_SYv1O-QW2_GlhViBJtwclEsLTjE5bOYJmH0tDjiPAiRuWUGPnRjWaEjLE-BN1mHa21TX6S0I&sai=AMfl-YQyI1dlZJ-PwG-kicZGPZLua5N90i_DZS61PhC53Km_LfG3aO7YXpotbgYHD9dIma4lBVnK3JOhXbPjk5G-rpyqCwNtGmeKpFUEQRuL7grGdVBuWHQnAUm3eUlh&sig=Cg0ArKJSzJH2SJQrPOoCEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame D68A 37 B
402 B 812ms
413ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

51cefa874c2b47e86b79fdc293a353e4999715efcf9deadb102de0b57d558289

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame FB5A 37 B
401 B 1227ms
413ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

9242cc1e301faf9197c593a8334f932629a63c6db340d626099d1253e3eeb0d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 6F8F 37 B
402 B 1641ms
414ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

2de5ce426a31db7515924896ba01be435c3a71f2fbf5fc33b54f7d7c8f5525c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 0224 18 KB
7 KB 374ms
123ms Script
text/javascript 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E51D 0
0 132ms
131ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst1BLLOYSuVaZ9vA2owlEDWrD8WcppBRzupoZaf4jnsbnVgpnmlzMv8VQnGjLrp40LiI_xBjN2CSbGHvhTicS7wK1I3dMZU8KOsturPUk1LNDIzZfM8C0vLjWT3RaTiVo2KpckKvs6AaBM2hQeUNSU3oCgezxZ4MmnBsjvRzW7KNEKSwgxgsXBCTF5ug7TqMnIwkWTCyBPHomkU5R4YHCC62jsPw-Psm-Fbtx6ts2IJefT2yGlcfN0zFVfXfZwKGoVvxjd0OlrkmrbuyDWo7B8NiOBHLGHcX0WMSfb4MjXSOgdjx7aldFWcj8GRkBl8ov0MH6O4hRuimrQNyqi-WOlDD_m-HD-PpgeYFirUa4qmMS8xHGYmAAlmBX8XHyIkVJdJhNqN8hl3G3Stv3P381iXVzeE_QHgyNDo4-JSL9ryy9YRc7EBr3cUSTUhNtf7eJe3NGjWcT4peQ&sai=AMfl-YQd_tLvhC1gPblenNDDHc3Dsvy6IxQBQb6puNReiQnMStpLZhdL79ZXQCDKH8dmkIrDhfyOnNgPHRb0pEMbf3gKjJXotrVsNnartLdc4-LDmXi2vq7Vva6zRxFo&sig=Cg0ArKJSzLBPHoGLnRY6EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame E51D 9 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 58
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: 7LeEwjIyQg_3JTtII3W8Y07jrnCogz4K_sAgcpFLF0vHG5rzgcO4Dg==
date: Tue, 25 Mar 2025 01:13:10 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame E51D 219 KB
0 1ms
1ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame CE42 18 KB
0 227ms
227ms Script
text/javascript 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 37C9 0
0 133ms
132ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu7kCuWF8eEL9HTTcGeDKUMfpbANziRunySPJKRIx2mlWpMcatZGEI_Qp-E8A01TQW1hJy0fEvVb9kFgA0Y1HIDqUBcsunx6zGcT8-NYWZe6hWACBEOiXalGlyb1aKSEDZ9yqhzToJjimNbcpfx1T_wncz9qnjxR_RRIQvaB4TY4-EC4wfu4lV3-rOOPVfQxhLjJE5OMYpozh1IMna6qVShTpwoEkh6SjcCLPAFwvdrAxLRPy5by6Ff5emEZ5bT9wigLHWyAlnW5jTE8Aub9zyP8zlEex9AzTDWNbEcIru0Jy3GnJtgbpJXQXDQUpbqExy9GeqgaO3yivvwVoFhm-rXh_iVjBW0FFBmKzEqhyeyaP3IsyVxw6x-W0s8ZsAsFJg1MRU7_q-h0-NCRyPgMM6RmvfEjCujQQsSuOMURYDzX1s7m6NgVQ44tB9e&sai=AMfl-YSggDUGosWKphhG4t5Ye_p37PdZ-j29jbJ-0w5zR0jgHP6gQ-r4HlKcqxJcpKpHsHtYylJu7FODg8XyY4Cvy8BIDJzhKTZEJ8FFBH70jCwX3mw2scFXU8pbR_rN&sig=Cg0ArKJSzCAShNPZIncYEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ Frame 37C9 40 KB
15 KB 134ms
133ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

ff43ad34b1cd60bd7e3f183d8e01d0a5849da0b9bb2811cf7b2c42061cfb62aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 8216766791753425402
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 15181
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 37C9 219 KB
0 1ms
0ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 9B2C 0
0 133ms
132ms Document
text/html 2600:9000:250a:b800:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:b800:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 39
content-length: 12184
content-type: text/html
date: Tue, 25 Mar 2025 01:13:29 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-amz-cf-id: HfrIykr6-ieGSJ_VgCZWBeU6-kbgmInYw7sCSM6B4UK8N6a1SpwKwQ==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 72DD 11 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: RFhOCFKgBec9G1XY4C_qiYcDxTuShviNQMsQOL1BEPc0SJlCfvuL3Q==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E51D 0
0 130ms
129ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E51D 0
0 131ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame E51D 217 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 189a12b47d289e51a6b6b55bc8c7eedc12c72ed9b7ec5a708f14c3447d88a28e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 72DD 2 KB
794 B 169ms
167ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 72DD 30 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: Ys8GcljcdwFvSc5uxAtcRsoe6zzJrvP_CLwyN67zmJLoCcB1CM4COg==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame 2C1B 30 B
271 B 414ms
414ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame F6BB 18 KB
0 93ms
93ms Script
text/javascript 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 37C9 185 KB
59 KB 145ms
144ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

2c7d48b822f575f86303eee20ee32c3e450b365dc1d2d4737f1eea9499404a3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 13099329544976431095
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 60702
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 37C9 0
0 131ms
129ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 37C9 215 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f5b0e9aeb085d3faab0f241bb8fe8a9e02a113ea1327ec610a3cb2b524f3079

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 37C9 0
0 133ms
129ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 2C1B 0
187 B 421ms
419ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=f3244e&cid=6b1a71782bfe76802531742901245856&mp=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: image/png
vary: Origin
server: nginx

GET pixel
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/ Frame 2C1B 0
0

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame D68A 0
187 B 424ms
423ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame FB5A 0
187 B 845ms
415ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 6F8F 0
187 B 1260ms
414ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame DFE9 0
0 358ms
120ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 2872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:26:16 GMT
expires: Tue, 25 Mar 2025 01:16:16 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 52DF 0
0 380ms
135ms Document
text/html 172.253.62.105
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:08 GMT
expires: Tue, 25 Mar 2025 01:14:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 7C01 0
0 351ms
351ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 2872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:26:16 GMT
expires: Tue, 25 Mar 2025 01:16:16 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 7742 0
0 378ms
378ms Document
text/html 172.253.62.105
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:08 GMT
expires: Tue, 25 Mar 2025 01:14:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame E537 0
0 345ms
345ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 2872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:26:16 GMT
expires: Tue, 25 Mar 2025 01:16:16 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 679B 0
0 378ms
378ms Document
text/html 172.253.62.105
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:08 GMT
expires: Tue, 25 Mar 2025 01:14:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 72DD 2 KB
1 KB 178ms
173ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=36&o=1&fc=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 9a058c460d30a214d78a722942c6fa7bbba9320b4c7d1116ebe36f633f57fb6a

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 72DD 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 37
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: MNx8ycoZmyt3NjQOBIgur5TTgFmW7b5kwXxWQGb9BiH-_IlWCRZ1nQ==
date: Tue, 25 Mar 2025 01:13:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 72DD 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Wed, 26 Mar 2025 01:14:06 GMT
access-control-allow-origin: *
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 72DD 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 60
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: kV1BkFvIyAFb5DIVsM0K09AV2UUQnwdVZX8kr9NirS4fAuZoW51SZw==
date: Tue, 25 Mar 2025 01:13:11 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 72DD 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: pNHYebawxr-kNsjTJAoUzl2QLe5NyUPiwze6-WZPqoBZzp-KRWiNEA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame 72DD 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 21
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: YRDQ8u3sCvnl6t_or0oX0w6NtrRKPmzsSnzRlnAPqxbh_RQb4AJSIQ==
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 72DD 5 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: p6Z2VA_II5zM_FebLXG_aQicfI5HxEBXO9n4iykxTps0r6YtPWUwyA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame 72DD 0
170 B 368ms
365ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 72DD 0
168 B 405ms
404ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.2566092989912836
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung City, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Tue, 25 Mar 2025 01:14:07 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 72DD
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=IaUdNmubAOCpen2BYAPiZw

2 B
20 B

187ms
186ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=IaUdNmubAOCpen2BYAPiZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=IaUdNmubAOCpen2BYAPiZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Tue, 25 Mar 2025 01:14:08 GMT
Server: nginx

POST
H3

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame 72DD
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=J7xwrm4mB0mC_g9-YAPiZw

2 B
20 B

188ms
188ms

XHR
application/json

35.190.36.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=J7xwrm4mB0mC_g9-YAPiZw
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H3
Server: 35.190.36.98 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=J7xwrm4mB0mC_g9-YAPiZw
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Tue, 25 Mar 2025 01:14:08 GMT
Server: nginx

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 72DD 0
186 B 120ms
119ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=64765055801

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H3 200 show_ads_impl.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/ Frame 37C9 501 KB
501 KB 122ms
122ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

c8e9318c3c4d4267ff19a29ff8e36700e7e2b9de1dc992191a6e7157c4b97924

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

etag: 16655410260656470125
age: 31209
x-content-type-options: nosniff
expires: Mon, 07 Apr 2025 16:33:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Mon, 24 Mar 2025 16:33:59 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, immutable, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 512581
x-xss-protection: 0
server: cafe

POST
H2 204 events
bidder.criteo.com/csm/ Frame 72DD 0
186 B 119ms
117ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:07 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 72DD 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame 72DD 43 B
0 2ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: reurl.cc
URL: https://reurl.cc/XqAx30
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 72DD 13 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=36&o=1&fc=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 12
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: EaIfmWdoUzyctHu2VEJvVVAQh4cMCxn4zIYxHO5CnTLFv70G66Fk5w==
date: Tue, 25 Mar 2025 01:13:55 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 72DD 5 KB
0 0ms
0ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Tue, 25 Mar 2025 01:24:07 GMT
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET /
t.ssp.hinet.net/ Frame 72DD 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E51D 0
0 138ms
137ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssrFUO1TKI4aJMw1_jgY803NGwFNcRvMuxLv_S1YPQ62LJxY_GhbCP6RlJCE7V9KbE11QK1kqb1vwV6R-eLBb0XJddCXAbBaX7VZqb18Fmbtj20wvPz5Mi8iV8ZrBAtFE5wJqE2QD264lj6sgHCSD1YKODAraXHTWL4-Rr36agTpS5Rx9k0cvmfcGRs6WNZ9o18H4dwo4WH9OznPy8zHRi09mlO9CLZ4n8KVkwd5n-0WKE1M2TcqmDqfGtblMYoWvujn5v-rEq12pbIhG1mdH_g9a6N_Zi6wW74a9Jx0-lxGRjHVAdKx-m4MFv_nrwEivUDBE3nrGyLFXYbhxQHmmx3gSPifLBOxC-M4wt8ZVgSFanUC3-2S2pKIezCV3LW6hj4bdj7dMJMAsoFmiO4vyNPCxSUdvMBQcXkBmdXBZEgfkMm5LvJPAdHmFaoZktQhvzeYdAh9tzNmqaj&sai=AMfl-YQBNoDMPt4fR0LVjrQlbDiuDq8m-oFxnGKRXYjGf8iSQGModwJAG5xP7D4Qp63ID33n66TMV_KN7AIHbk-Aq5zS7SfK1Vv-eN9nS3gCEUCXBV07774ZviFIvNxp&sig=Cg0ArKJSzNnPoReIbun9EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:08 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET pixel
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/ Frame D68A 0
0

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 130ms
130ms Fetch
text/plain 172.253.115.139
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je53l1v9181474282za200&_p=1742865242346&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=102482433~102788824~102803279~102813109&cid=2131144943.1742865243&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEA&_s=2&sid=1742865243&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FXqAx30&dt=Dynamics%20365%20Customer%20Voice&en=scroll&epn.percent_scrolled=90&_et=10&tfd=7248
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.115.139 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f139.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:87:0
report-to: {"group":"ascnsrsggc:87:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:87:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:87:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2C1B 42 B
65 B 131ms
131ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuMAffDl4Sr7vwWQIrGg7xpC9pWpalpZnfD9i-34DtMfjn-YGx-yXjvLuT-p0mUVCWNzpSvQubNK5LMxvmtDXpU2fmcfGO-bNHr9i9qBHQ3NiX060Bp48pqaJ9HgU25HWtiuON6-sJiugX-ZuXkoyqiQ4BjRPXRTkxtNmCkvjYakIU&sig=Cg0ArKJSzFiCVwurMVekEAE&id=lidar2&mcvt=1000&p=108,1030,358,1330&tm=2908.6000003814697&tu=1909&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250324&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1451399479&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3879804500&rst=1742865244739&rpt=2525&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 25 Mar 2025 01:14:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET pixel
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/ Frame FB5A 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 37C9 0
0 135ms
135ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstjkpSSpTTEVu9iL6dHlj0hzk5wRXzhMwjDUsVzigmeT3ZyLiLZpUxA2QEjVM_5Olov7zyHQ_daZcs0ulpFirKxWlg4wN8dbRdWrlWARSazu5Md1A-qieDn1GOS_gBRPX7LR2tGLCCB9GfGBO4z5_qOn6HCz1kQXxR08aUPwjCIoBUow4SaN3Dz165-UYQ-8TIOpv8yS0Z8ZhP_98N2l1VSL5VjUFyOuUfHbv4t16OW2nTzvp6T_Cmi4S9moylT_zIdBAQzQ4m7QoTi4OPkJ1H2eBbRYrbnXmSH9cnevj4RW-Vh74cCvpGvx7PXpYkd9eJVPnbQic47DXwCKADAhgDu-4gFoMnJaAUVgXzqonvQpzPJGb4B4LcUyA9ehXQ0UdhL2-9n1jwQQ-PJ2eIyHwg4Kt9cxXRo4V9PM42g4EApVPSvbPveEpurm8tzru0&sai=AMfl-YTgbSWSF-2A493dw8AqNkNj2VrV7nShgwAbKhRDqaMNTU9oYbGhpHAnKgtfbprVzbQo7fqSVGmtSDuL_THnx7CBE6gtOO-ppLJ1rZLiNrD9dxwCXly0_IMPWO_c&sig=Cg0ArKJSzLalf5HNeDA6EAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:08 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET cm
t.ssp.hinet.net/ Frame 72DD 0
0

GET
H3 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20250320/r20190131/ Frame 2B23 0
0 367ms
121ms Document
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20250320/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

age: 6315
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4228
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 24 Mar 2025 23:28:53 GMT
etag: 2080659458937595761
expires: Mon, 07 Apr 2025 23:28:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET

DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html
adx.holmesmind.com/adx-file/20220715/ Frame 802B
Redirect Chain

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4485239425924787&output=html&h=250&slotname=2784%2F13803&adk=2220942683&adf=2119137496&pi=t.ma~as.2784%2F13803&w=300&lmt=17428652...
https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html

0
0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 37C9 17 KB
13 KB 135ms
135ms XHR
application/json 172.253.115.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250320&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

c6323c52881bc29c6b3212119991086a32e74c91af2d0cca9b96a8ded59ebb4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13159
date: Tue, 25 Mar 2025 01:14:08 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 666F 106 KB
0 0ms
0ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

688f229a7cac61e53d32a21d50ff29e962c48c9e65d65f9da34553c017003a15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 582 / 20172 / m202503190101 / config-hash: 9754453387445197641
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33605
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/ Frame 666F 526 KB
0 6ms
6ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

3b07482a7e55296a20e35304c8d3a30bc4805d350a933c634713001d467eb6cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 7854641952111388716
age: 44028
x-content-type-options: nosniff
expires: Tue, 24 Mar 2026 13:00:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 13:00:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 169032
x-xss-protection: 0
server: cafe

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 57FA 0
0 1ms
1ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 1604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28858
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:47:20 GMT
expires: Tue, 25 Mar 2025 01:37:20 GMT
last-modified: Mon, 24 Mar 2025 19:44:53 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 666F 17 KB
13 KB 139ms
136ms XHR
application/json 172.253.115.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202503190101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

6d18db0e2d9b4a919262081773b708dcfeaa5a9fb70702bc60f5ada39ad2c561

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12980
date: Tue, 25 Mar 2025 01:14:08 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 666F 36 KB
8 KB 266ms
265ms Fetch
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1826415735404735&correlator=122930665107779&eid=31091186%2C31091202%2C83321072&output=ldjh&gdfp_req=1&vrg=202503190101&ptt=17&impl=fif&gdpr=0&iu_parts=128002626%2CGPT_%E7%B8%AE%E7%9F%AD%E7%B6%B2%E5%9D%80%E7%94%A2%E7%94%9F%E5%99%A8reurl%2C14210%2C14210-2&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x250&ifi=1&didk=607409652&dids=gpt-passback&adfs=2597023761&sfv=1-0-41&sc=1&cookie=ID%3Dd1f9df27f391c472%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MZ2WatZsfNjt7Zk7OEyF8XrbvJppA&gpic=UID%3D00001000f88aa859%3AT%3D1742865244%3ART%3D1742865244%3AS%3DALNI_MapQsygeP2ZhifPNiHeFHvd_VRIBA&abxe=1&dt=1742865248696&lmt=1742865248&adxs=650&adys=108&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=lg0khnpb52ki&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=6&url=https%3A%2F%2Freurl.cc%2FXqAx30&ref=https%3A%2F%2Freurl.cc%2FXqAx30&top=https%3A%2F%2Freurl.cc%2FXqAx30&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1742865248629&idt=25&adks=3360245792&frm=23&eo_id_str=ID%3Dfe71415567f1985f%3AT%3D1742865244%3ART%3D1742865244%3AS%3DAA-AfjaD4P_npBVN9Eh8wmd8zVM7&td=1&egid=28629&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

7511e3911b1f0df4c73ca0c04539915aab426169d302345c726ab26a2aefbf88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: dcb
google-lineitem-id: 6499556608
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 25 Mar 2025 01:14:08 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138462658495
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 7961
x-xss-protection: 0
server: cafe

GET
H3 200 container.html
294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 1ACD 0
0 369ms
122ms Document
text/html 142.251.163.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html?n=6

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.132 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f132.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:09 GMT
expires: Tue, 25 Mar 2025 01:14:09 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/ Frame 666F 63 KB
0 0ms
0ms Other
text/plain 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202503200101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 6636832657936373745
age: 47531
x-content-type-options: nosniff
expires: Mon, 31 Mar 2025 12:01:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Mon, 24 Mar 2025 12:01:52 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23172
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202503200101"

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 37C9 18 KB
0 93ms
93ms Script
text/javascript 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202503200101/show_ads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 109D 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 2872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:26:16 GMT
expires: Tue, 25 Mar 2025 01:16:16 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame D9C7 0
0 0ms
0ms Document
text/html 172.253.62.105
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:08 GMT
expires: Tue, 25 Mar 2025 01:14:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 666F 18 KB
0 93ms
93ms Script
text/javascript 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:14:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 8808 0
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 2872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 00:26:16 GMT
expires: Tue, 25 Mar 2025 01:16:16 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame AF5D 0
0 0ms
0ms Document
text/html 172.253.62.105
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.105 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f105.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-A9l-5tRcME5Sr7FSwOfE7w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Tue, 25 Mar 2025 01:14:08 GMT
expires: Tue, 25 Mar 2025 01:14:08 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET pixel
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/ Frame 6F8F 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EFAD 0
0 134ms
133ms Fetch
image/gif 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsujLIbYKclY_uqqznpZkB2xCnpi1EmsEuG_UICASVyHuncsJfosp-zrXNRsJWml5HPh1gpBGI51btZWZJF4foDQU5IptCYqz1WBLTZM3fpJQxGjA7Q3wQc9cGdzIi4QcLHa0gYs7xRemWzvlWONS0qI73pNZX52abK088h_sctWo_IQrI8rWr9jN3yOYX-GkWrNMg_gsNpCqeROPHS8OoEHuQGC43wO9bIu9AticrBrNWdUD2eiiGIsad7plfXzvuvxaCSkilBn54PqxPgpTVdWx7sBoYZFONMepIWUZtN6C7W26oHmXq8NvAErdCHVDH_7M_9pSOzUoA8ckfkUHEtEPyH1xMWVX1CKVMlYEnHOkqAuR4fCD-M41jl5A8srnUgGVHxm6eaxBpBo4_2uY0HYmp_XSNyn-CZahLQeLVzS5vC62megrhSQ_v0iCzVhBbT0ZutqPbDJCw&sai=AMfl-YSt8Q3yxXj1XNcR0lcXokVfUKOsSJrRl1vF6aLKcbplubpmUYDiMnH3dkCPsuO0sdGNu1emKjcvC7gofzvn71a-3crvlVeIzefIzApGVDcEVeCAHRp3HjIGP4K1&sig=Cg0ArKJSzOVSPtLjvVsUEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: reurl.cc
URL: https://reurl.cc/XqAx30

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Tue, 25 Mar 2025 01:14:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ Frame EFAD 9 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: 7tl34LxMadcrIfMWf8ToGVMtRuWCL8aK
etag: "2b18447e41c64d14195cefd72eb57400"
age: 58
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9645
x-amz-cf-id: 7LeEwjIyQg_3JTtII3W8Y07jrnCogz4K_sAgcpFLF0vHG5rzgcO4Dg==
date: Tue, 25 Mar 2025 01:13:10 GMT
content-type: application/javascript
last-modified: Fri, 14 Mar 2025 09:01:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame EFAD 219 KB
0 1ms
0ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202503190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

content-encoding: br
etag: 9225633084484645003
age: 3040
x-content-type-options: nosniff
expires: Tue, 25 Mar 2025 01:23:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 25 Mar 2025 00:23:25 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 68912
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EFAD 0
0 130ms
130ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame EFAD 218 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01e1f6267010b9118cf5c85affce23ae94f796cbfbc3347f01f57148035d3e90

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 capmapping.htm
cdn.holmesmind.com/js/ Frame 4B79 0
0 0ms
0ms Document
text/html 2600:9000:250a:b800:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm?fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:b800:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://reurl.cc/XqAx30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36

Response headers

accept-ranges: bytes
age: 39
content-length: 12184
content-type: text/html
date: Tue, 25 Mar 2025 01:13:29 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 66b6cd04ec22251498906e833eb08668.cloudfront.net (CloudFront)
x-amz-cf-id: HfrIykr6-ieGSJ_VgCZWBeU6-kbgmInYw7sCSM6B4UK8N6a1SpwKwQ==
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame D0B5 11 KB
0 0ms
0ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: RFhOCFKgBec9G1XY4C_qiYcDxTuShviNQMsQOL1BEPc0SJlCfvuL3Q==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EFAD 0
0 134ms
133ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Tue, 25 Mar 2025 01:14:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame D0B5 2 KB
794 B 176ms
175ms Script
text/html 54.64.195.61
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.64.195.61 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-64-195-61.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Tue, 25 Mar 2025 01:14:09 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx/1.14.0 (Ubuntu)
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame D0B5 30 KB
0 1ms
1ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 30
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: Ys8GcljcdwFvSc5uxAtcRsoe6zzJrvP_CLwyN67zmJLoCcB1CM4COg==
date: Tue, 25 Mar 2025 01:13:36 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame E51D 0
0 132ms
131ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsukDCrZhl7jOgX6E5JkQq_O2vkYqp95wPNgk4kxMpeNnKT-z_FAYsu1URv8LrRGPcspHEdRb5f70MHMmt-emnK8HEyd72if4KRD-z0WCfo_uzgefSF5wtfgjSnZPa7OzEnCoKQLVbdKtC6qNLbkUfVpHn0yijH7OVEm5hw10pN1bd4&sig=Cg0ArKJSzC3gDEPKUNnaEAE&id=lidar2&mcvt=1000&p=108,650,358,950&tm=1442.1000003814697&tu=442.20000076293945&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250324&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3360245792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3879804700&rst=1742865247563&rpt=524&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 25 Mar 2025 01:14:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET ads.js
ad.holmesmind.com/adserver/ Frame D0B5 0
0

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame D0B5 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 37
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: MNx8ycoZmyt3NjQOBIgur5TTgFmW7b5kwXxWQGb9BiH-_IlWCRZ1nQ==
date: Tue, 25 Mar 2025 01:13:34 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame D0B5 130 KB
0 2ms
2ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: 6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67c8043f-2072d"
cross-origin-resource-policy: cross-origin
expires: Wed, 26 Mar 2025 01:14:06 GMT
access-control-allow-origin: *
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: text/javascript
last-modified: Wed, 05 Mar 2025 07:58:55 GMT
server: nginx

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame D0B5 3 KB
0 2ms
2ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 60
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: kV1BkFvIyAFb5DIVsM0K09AV2UUQnwdVZX8kr9NirS4fAuZoW51SZw==
date: Tue, 25 Mar 2025 01:13:11 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame D0B5 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: pNHYebawxr-kNsjTJAoUzl2QLe5NyUPiwze6-WZPqoBZzp-KRWiNEA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame D0B5 3 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 21
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: YRDQ8u3sCvnl6t_or0oX0w6NtrRKPmzsSnzRlnAPqxbh_RQb4AJSIQ==
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame D0B5 5 KB
0 3ms
3ms Script
application/javascript 2600:9000:250a:7c00:0:e06c:e940:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:250a:7c00:0:e06c:e940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 28
via: 1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: p6Z2VA_II5zM_FebLXG_aQicfI5HxEBXO9n4iykxTps0r6YtPWUwyA==
date: Tue, 25 Mar 2025 01:13:39 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: IAD12-P3
x-amz-server-side-encryption: AES256

POST bids
prebid-asia.creativecdn.com/bidder/prebid/ Frame D0B5 0
0

POST prebid.aspx
prebid.scupio.com/recweb/ Frame D0B5 0
0

POST bid
ad2.apx.appier.net/v1/prebid/ Frame D0B5 0
0

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame D0B5 0
186 B 120ms
119ms XHR
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=159&profileId=184&cb=36460367285

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame D0B5 43 B
0 1ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=1
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

GET
H2 200 pixel.gif
static.criteo.net/images/ Frame D0B5 43 B
0 2ms
1ms Image
image/gif 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL: https://static.criteo.net/images/pixel.gif?ch=2
Requested by: Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=31104000, public
timing-allow-origin: *
etag: "493ea254-2b"
cross-origin-resource-policy: cross-origin
expires: Fri, 20 Mar 2026 01:14:06 GMT
cross-origin-embedder-policy: require-corp
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
date: Tue, 25 Mar 2025 01:14:06 GMT
content-type: image/gif
last-modified: Tue, 09 Dec 2008 16:52:36 GMT
server: nginx

POST
H2 204 events
bidder.criteo.com/csm/ Frame D0B5 0
186 B 119ms
117ms Ping
text/plain 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/csm/events

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/XqAx30

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:08 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame D0B5 5 KB
0 0ms
0ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Tue, 25 Mar 2025 01:24:07 GMT
date: Tue, 25 Mar 2025 01:14:07 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET sodar
ep1.adtrafficquality.google/pagead/ Frame F6BB 0
0

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 0224 0
0

GET sodar
ep1.adtrafficquality.google/pagead/ Frame CE42 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 37C9 42 B
65 B 133ms
132ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu_9Z99yPjA1F3tcEAzCsS607gdrEZmTzSdp0_9eoRQmp1_jitFZ5EBQaVz5CBRzULFqD1BfA7t33X1QmqlaqlEJzjynO7_yJLLhc2GC2MbHPHt2-0U7jOmrDc4jrUfx6E387fAIqEDiBGPgYRdqH6E34WmrRqriYL7sPYkK_NkzvY&sig=Cg0ArKJSzNCVSbdmUrNGEAE&id=lidar2&mcvt=1000&p=108,270,358,570&tm=1777&tu=777.0999994277954&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20250324&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=451274506&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=3879804700&rst=1742865247606&rpt=957&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f155.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Tue, 25 Mar 2025 01:14:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 37C9 0
0

GET sodar
ep1.adtrafficquality.google/pagead/ Frame 666F 0
0

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame D0B5 0
187 B 417ms
415ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&mp=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Tue, 25 Mar 2025 01:14:10 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/ Frame D0B5 0
177 B 825ms
412ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/pixel?bd=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da&t=50ef57&referrer=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4324.190 Safari/537.36
Referer: https://reurl.cc/XqAx30

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Tue, 25 Mar 2025 01:14:10 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: creditcards.com.tw
URL: https://creditcards.com.tw/wp-content/uploads/2020/10/%E5%8F%B0%E7%81%A3-Pay-%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1%E6%8E%A8%E8%96%A6%E8%88%87%E6%8C%87%E5%AE%9A%E9%80%9A%E8%B7%AF%E5%84%AA%E6%83%A0%E5%BD%99%E6%95%B4-1080x630.jpg?crop=1

Domain: blog.alphaloan.co
URL: https://blog.alphaloan.co/wp-content/uploads/2021/04/%E6%A8%82%E5%A4%A9%E8%B2%B8-%E4%BF%A1%E7%94%A8%E7%AE%A1%E7%90%86%E6%8C%87%E5%8D%97-1.jpg

Domain: bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net
URL: https://bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/pixel?bd=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da&t=f3244e&referrer=https%3A%2F%2Freurl.cc%2FXqAx30

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/

Domain: bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net
URL: https://bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/pixel?bd=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da&t=50ef57&referrer=

Domain: bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net
URL: https://bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/pixel?bd=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da&t=50ef57&referrer=

Domain: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/cm?c=50ef57&cid=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP

Domain: adx.holmesmind.com
URL: https://adx.holmesmind.com/adx-file/20220715/DkKnrBdt5clw3Tnvnp9EqZncJzw4s090s3IZtsfB.html

Domain: bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net
URL: https://bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net/pixel?bd=bbbc52a1-ad6f-4f25-bae3-f01c5c4957da&t=50ef57&referrer=

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FXqAx30&n=397&o=1&fc=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&d=1&b=2&ts=1&ii=2&FPCK=1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP&fp_uuid=1620-23f848dd5ddaa0c48122a127aafced52&initver=230627P

Domain: prebid-asia.creativecdn.com
URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids

Domain: prebid.scupio.com
URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.6951098423150572

Domain: ad2.apx.appier.net
URL: https://ad2.apx.appier.net/v1/prebid/bid

Domain: ad2.apx.appier.net
URL: https://ad2.apx.appier.net/v1/prebid/bid

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503190101&jk=3410417764173861&bg=!6eql6qXNAAaCZO-FomQ7ADQBe5WfOO8RBpkX8P7t0iSA8pmE47AqPd8f9f89SuujJ7A7KzALc_fVSs_Y9FrrWgQoMkMeAgAAANlSAAAABWgBB34ANTA0XmxHMWOMd1OOvceRTYA0wjg__dOjNVZ9ZkN8Pj4EbiX6su_NvYFrtbftiZFzzlBMFPvkmQLFFvALBRXdMMNfZwTezd3wpiqNWYYvK-RTqXkMmgdoemz4rpZTGOdPyCpdDtPw3FOM5jNPouRvbVx8A1NHGAgwssWBAzForeB28ONYlnVG1f8JCQQoqYac_R6atdwlGxN7hwlwiPDR29pXBQHMZKb9JHIA_pZzKJnWBYu9Y9oOr41wyY3mLhAdeEfRz8bolgnnFRRGi8zjFRWvswXiqWqqBKStbwaMFNG3xkkBVlBjffdiZ7H20gkOn2P5HdfXfvuVlOVvXnQJPgvBpdkwtIegtzMnGxTOj65A9yjl8CBLMXY5ZIMwha3WzYyg9SO_5jJ8jirtd1wsVatu6GU7zBImFLAHw-fycCbCRBbFrgTE3bPF09XFlDVU3KtO-rAPY5BUdrdYgPS3_Ob2BmNZ-83d0V94b4uEq0Ke76xaeu8wE6rsSbT0Q4jS6pnMU7CiwZbkMrGcPPKJayM6yTN_2znPSwhS6dpNoXe0l785uX0GmaMQPuG9f5bDHlIu-3cQXwqIklPZq7QpExOTZ9fgPDmhid6E41G-tHHbIrRK5lCCUGMqJtfM73Umd65cGc063wGqqVMs15KojAX_X9IsDmnXeaD_fJUcxCCWCNvAHOAT8aDew2sP8LLhKvgEs6rv2GlVm_BJMEEsXgR0nTgImnl5cmHGWB9b_fB-LhzPpEC7AOrYrs194mnyTJ9jabDuUfx0V4TADXjADt236CA76q0ajycZBf1rC5uuAqzBd6-BqODBUf6TwmHaG1xXbTXY0PFkvJsPNJ7uHEbOc6iAJxHfF3JwS4zMtz9fcbL9MieBJmWWXigOCAks0TLlzi5GBIIpSeLTtwgNH0BQwItijZ2frDkBXH9xcp6MJoQiXRCEK1r-Dh7c55kPbjkrX2oAl485V3zMAAp7TGJR8heE12XpYD2wgf8S0cxs5N4boUSQ1sEpE02u7A

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503190101&jk=339799573503629&bg=!wMOlw4zNAAaCZO-FomQ7ADQBe5WfOOl8CtfPLjEIeWnBS3Y11g3ECTKweSsIXmkox2HPvFKI6lctG9_7K5SLJZenUwgCAgAAAN5SAAAACGgBB34ANXbJVvuXawZ3pbGUP55kZKyk1PUociWPthMFLPWPAE9V3VnfiJGJyAR7domZLToKEAtfaJccmQLMeRaDAhwR1cEA9jbyt1cxq7lG-YCZRvZOdlf1BnypWbZzvJqaUzMHrC68nmvYH712zYitNZ02ldfqcTH8UMVXKIrjhrsfo-c93VKo2SpAfSBtw5-IQethdwJV4ZHRl0A67wq4PULoTsIUY7ojWZb1A2viSkrvrSZ0zI_mtRDH5acZss-yd3WoN4gEwQn4z7iiTHRcHoXZwjp2NSWF7s982MXMdzSJUPOP3KdCvBLBTPyCKVxj_evRwIDu_SwwgRKPt4OjhfK2MlDvpdyqu-rweof8_bbVN_yItExLwhGdy8dWiETsjz5xCZR-TAqNYgIvZXzXXuL7fJ64BqMLsd_4H2pitYQFsC6cep8TOKEAls1nv5Rd_h-93reUmYn-BmXTh4iQu5mMbRj0pfDDRJyHr9oR6zBMk3EpfPnDnBqVjG2-SfnTJs8lzW2br1N0ZDzFjc13M6TNm6MWz_KsGd4lR9NN8uyYj25MTsFVCH15dA2eI6lZ9q62yhDKIfXjwfDeAPV4i-EjuMxgtOxzbpJ3l6eSeWoE-LXk5EFupRWJvCnt0-tvXWOOuWWHKV25M03GJ44WdJwhlW_Kx3L_O_dGfOjaNEpIlbnIioMACPFBv5X7pU9zh4Rtre4YYAcLanicinWrSxbWtmBLZy3kLOUTT0S11VMHrnIFVHPNjwNLLUENmu56uMl3mP6rPUd2kzc5z6zEC72y8LPT_UVCD5YB1oaZirMfUINm2GHMSmuW36ojZWEm2NCZdRTOOlL5kLRPiH1xV6uQYeUZ3gOqinQlUPS0mc6O-HfL8WaJA-kktubC42vmRtKCHe9D6J-MZjB57ZMYF6BEd06nbaxuXQTfjj0wQJ-tKdU3hMw3r4m6n6z11KdvTtjxzElkx_P5uZJIkNQDNsw45BM91_WrwH3lIKimrUvp8Rswv7xSAG-_HspZ7YPjqtJcdp17MA0

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503190101&jk=1420590574473844&bg=!NTalNnnNAAaCZO-FomQ7ADQBe5WfOH-ofvX51j1GaofmwR6BZBHZLV8frPNqhirh_HvDm8RMNGz0f5spMQiPttFplq0TAgAAAPdSAAAACWgBB34ANUWzNsviJ3K-GgUCBisZ7ElMxbRxi5f4UUc19B7cvyKvkhQXFEBRxwt-owHmOTyqQKnRmcRWmQLDoayc5FqZQRP-DmngA2ltniG6Z95fxqim86UfnG5lRPy4a0ggY9rmPRi28MwkrVw9v-UywaXfe1M3CoukA_QxtIVwvAgOv8ZRz42lLkfz7a8vCSfP5mNgMgCvrRie7lVn379kQiNpUTs1IaHWp0TZo2PTIgFmyPQPg8VEKeft4gzbJOseEGAuJmOOb59HuW2swwto0bLwoKKaE-KYudQcq2aLbonydFloHndelM0yESEsosZ-_ETcKpV7A-5O28s3MpRjpo9r6yh5VzmXgJtIlSYELnKDZNZVOhFJuq0Uk3n6UYI60l9w_fHkRS1DOMiQkDRo4h2FaPqc3FvetOVUR18kXLKmk4Nn4UV3epOmaF-Ma49d7GVnVNBhkS-eWG6K0MNE41IRwuqjYclKBfi1_ew7HaWisllLF1U-0JUhYsCv-xit2bYztf97e0EhBYl1T31CTj5NkraA3rpeIHTvRXqcIWVNzE4zuMRhGKmbhL6Y8CygVc-cMpWpS_0-crymbYIsvhwXXqOH0gk-obQSNmVGuKNC7vkcEhBFMwdENbt8jxBZmtaAcRzf3vU8S2_H4izNKQ5qku1pvvFdTKkgbo6cUbdci-g8yf_0eZdwKfX0afXu_sqD3TZzjXSNIIyJJJDaWdvABRPlagY_EzZmA5hgrV3_15MQFwmPJEofSh9qgzOhRKX7EM524l1rhZo5SrTtcHUJCgcZQts0RjNiljhHmX7LLsFr1-l-KQsE3J2O7cTk9MtNgzK20PNgkm-MF8jl8IjT3MSVts9fXh0dTdU9mrzzirecaDsSFM_hfkouK0xlBCPsvCH-2sE07OVko5erXmE9e2K3qR0KaX_kWwWbyvwBp_L-CHG9rVvlld-q-lJq03eRDABud4NHJbeuQhtS9OpcH3BUe8V97pqHiB5zE-X0NWURl8satm14xnmiDNI

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gda_r20250320&jk=643302925392309&bg=!hYalhsnNAAaCZO-FomQ7ADQBe5WfON9odS_HrEWmXAyMCTT_SbCJVDE5TggCUG2aYxPmk94c_-Pe3Gzp2RbV6FFzEPe5AgAAAOJSAAAACGgBB34ANTpP_PKR0Von6JTdSyDE9bqms3f4n7Vr8Lie9W6IPTRBdd6-e24MzujSSb5Qmz9IuNYl0mFAmQLLV4hI2f8kTD5HxCX-NY2ts8DokLpxTA-O4IcQtKbUDt6Hqd52sHu34IKtQeX3GlS67P_QygJF-Dr6tHuHZBUMyVtScHxM6Ii8pN42_6oi6xmsMUAaxfQkxE5D48BFRt6W4dTkyJ0_lJxZMcNZCpbQRaM3yHY4fRO5Xnb33_pXef01Yj2fxM5UYujtTKnCUzg7h64QYr20P5NlylkzaozYWc40k-LBtLgOsMkXL4BbRoO-4RqyangJ4sIEHahEC0vqpOk3W1ms9DeVr2wAwh9Vjvr7diBkbaZ87zP3mlJXd_SkmEHXdO4mUl8X3bfFspQV4BI5BScFMiPP3THmT-p53wZW3DzNVlR7f8pGJgqBeuzAZBetFI6YuYnjjoqPr-udDOt9eKt3BZFbnVRg_KYxLuMxNXLEwAtkRHK-UbhrxTzVA8S7FeuhIjOjLlohZoVzm95S2IqR-38gU7P4YpnaCGVqtx7Rqznu-AaGIJUgKGCYsXpfKu1l3K8_F86y7_HFtfLVcDWZU7nK92uTSLm_wz5gJCqPp0Q94Rs3Y7etb-9KYtsizIGu9-Q8HXBTz96avSxH6SHokGS0PnWMRCxBX2SV-TqR5zbCIeTKK7y6xi_ht0ErfStBrHZK4DnNHu-c6g52bMgbUHTsRmEWh9dLMOSaFj6khlCJHW7uS-__bXRhTCWafyeG7WlP4_EezyMyWkFbvEpC9e1sqlHv6sfomltI25uamf9-po_qJwhJwmnRpENzlENdIPsjDiOABYJuVpHvNlceWYJAMNjTLmf4qhe_Ft-vVQhEeI4N7o_PVe69q43huVME8o9JprnJIWkuUUNCibeSYLxBryiMGmXEeHzBxmXB3SWrDe9etH6EnaQNAtgWGnPrISPVJzj8qwgm2HKbWNQ1uJ2c0PPpEQCoQv-FjA5cBjLERpDQZQ_LdWEB8PKmuoi1eKxDcw

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202503190101&jk=1826415735404735&bg=!CAulC0TNAAaCZO-FomQ7ADQBe5WfOFKG8-SQO5HriMQ5Tr6I2z3vr1zu4-hNVp-6yekjKLqxsF5Pw0Sjj2282Nph-hElAgAAAFpSAAAAB2gBB34ANRvxP7kPXblZRzDxlu1zge0MsrRnuZ2AAEdGTKQugT1P6sMiiPuF4iXjK3TXcdeEe9ehAa7NCgA8VDKzRWm5PsFJ1PTKs4Qt9tCb3-zJDdded7cGXn_v3ndtQ9LqCCBbgckYzbqqKkg8qwPTPehSSdV4Uly9mQMOimg9IOu3T4I9QW-vJJ9Aq-bk0F5gfrhOZR4SySgiC_1ymUf6wUQrfSYCUQ0vCU6oEoOZaUDfbP_d60dRvn_yOCAW-Ec65r4SE4ik8u9JUtXyBC-9LBEPMK0TXlD1c0uMw-JqLmIoDTuctWsK8s_RVwn3xslonycetZ5AVlhR_FbCq5R3uXkORUS6qeMHcuymeoipUu8gW3a4cp0vCl1uZ8VPVNNAu0lENIxGmCpF0ED2WaUDl9xF5JItozYf3DQNcvyqhC3gEfVa9LkMuBxdSqoqcNT-gXuOEj4fV2Q-CU3HgSA98q8CSVFMWdcrLZJnkZ5UbcqZ6-KyGNswaM1TpMwX2fYQDbpuqxtHy35zO23QMsrjo4QtpHArqIvHY7KZtsA_6iZJvWrRklrpr9RqtEElitQN-qA9NzWSDw8f26W0fmHpS1rTWOueckBd0im7Zd9JvXoO22aWchy7kABgYhU5UVtUFsKS6FEfuybQWxY_MPqsmkHsOiy4PZwCkaSzkxwvdcEPYZa9GS3Zx016NU58jSK4WkAgKgGez7tS6UJH0FfSON3ZFInSXs0rdoALbWitrbT6suzNH_Dwkzv_BkLDa-XLsjvlkja2WzRttag38XUAvNIP74uyi9_mjNcIhLCDsRp4dZS8eIa7etRW9gdjlfiJA9KHx_CoK_SSAoeXWyuvdPgzTwkCzuQ0XmaX47XIC0S3eT8MrW74dI6Bw3v9jBcyxQLwiyFKZOG3pu_PgNo12Jgq_Abi1vV5lqXAjREYV0sg1LBIPsl_YxCVNAUgg3PVkYPPZ_MnCGPmbEmg_vieta2zpCtIHMAPKqMXALxofQAqCQ1aGPhtaZMWXSOXoccZ_RakHW2uIrotb8cjd25wP8c9pqyavOUSgdQxi8G7Z2M4e0K5A1CuQnGPgiKSCP3UQp5MjRKZ1rkdh0Lqh2hE0zlaADLxekNMiM8lxNzgRlmn-P23jMVJMs5wtIZr_z77cx_oFNewkX96qh2LpYjYTkx2h3HIgBAHJz0oRM01Mrkz4D5avdM6MJI

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

48 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
onead.onevision.com.tw/	1970-01-21 12:53:21	Name: onevision_guid Value: 70596e6d-0916-11f0-9211-0242ac120002
onead.onevision.com.tw/	1970-01-21 12:53:21	Name: oid Value: 70596e5c-0916-11f0-9211-0242ac120002
reurl.cc/	1970-01-21 12:53:21	Name: oid Value: %257B%2522oid%2522%253A%252270596e6d-0916-11f0-9211-0242ac120002%2522%252C%2522ts%2522%253A-62135596800%252C%2522v%2522%253A%252220201117%2522%257D
.reurl.cc/	1970-01-21 04:09:11	Name: _gid Value: GA1.2.1031192962.1742865243
.reurl.cc/	1970-01-21 04:07:45	Name: _gat Value: 1
.reurl.cc/	1970-01-21 06:17:21	Name: _fbp Value: fb.1.1742865243016.15418984167960242
.reurl.cc/	1970-01-21 13:43:45	Name: _ga Value: GA1.1.2131144943.1742865243
.reurl.cc/	1970-01-21 13:43:45	Name: _ga_ZDFZCDVDK1 Value: GS1.1.1742865243.1.0.1742865243.0.0.0
.reurl.cc/	1970-01-21 13:43:45	Name: _ga_N394QBRGC0 Value: GS1.1.1742865243.1.0.1742865243.60.0.0
.adsrvr.org/	1970-01-21 12:53:21	Name: TDID Value: 1d62d286-ee63-4f84-8c7e-8a56fb103151
.adsrvr.org/	1970-01-21 12:53:21	Name: TDCPM Value: CAEYBSABKAIyCwig-vf_odH1PRAFOAE.
.prnasia.com/	1970-01-21 04:07:47	Name: __cf_bm Value: 3sNtZnunKh3IbUtHcB3Zp2A1Jt0eiqpMbpI9AsVFVkw-1742865243-1.0.1.1-C3rUWMaOs_CHvmpLxVnv0bkEoM04BxJmFPziI9FgeGXQdu3zYxlN2HAkvt93P5CEzz6d6qEpemrsI1r.XmbxpVLGokF44g2dqcAEOMTGS9I
.eyeota.net/	1970-01-21 12:53:21	Name: mako_uid Value: 195cadd1d8a-65270000010a52ef
.eyeota.net/	1970-01-21 04:07:45	Name: SERVERID Value: 21231~DM
.crwdcntrl.net/	1970-01-21 10:36:33	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 10:36:33	Name: _cc_id Value: 1bfa004520841c8f14b0254fe0bee53
.yahoo.com/	1970-01-21 12:53:42	Name: A3 Value: d=AQABBFsD4mcCENRVgv7jw7Pk69i7WAwUn3YFEgEBAQFU42frZ9wr0iMA_eMAAA&S=AQAAAvPl-TV0wo7eEBVr7FzF1bw
.analytics.yahoo.com/	1970-01-21 12:53:21	Name: IDSYNC Value: 19d3~2o8p
.doubleclick.net/	1970-01-21 13:43:45	Name: IDE Value: AHWqTUkpbYmZRjvk_ZP7UyQHV0SHlsJUuTrdiQVI5iL14rfoVqHlyYV-p1Ig_yPY6TE
.reurl.cc/	1970-01-21 13:29:21	Name: __gads Value: ID=d1f9df27f391c472:T=1742865244:RT=1742865244:S=ALNI_MZ2WatZsfNjt7Zk7OEyF8XrbvJppA
.reurl.cc/	1970-01-21 13:29:21	Name: __gpi Value: UID=00001000f88aa859:T=1742865244:RT=1742865244:S=ALNI_MapQsygeP2ZhifPNiHeFHvd_VRIBA
.reurl.cc/	1970-01-21 08:26:57	Name: __eoi Value: ID=fe71415567f1985f:T=1742865244:RT=1742865244:S=AA-AfjaD4P_npBVN9Eh8wmd8zVM7
.criteo.com/	1970-01-21 13:29:21	Name: uid Value: dea62536-02d0-4ea2-afdd-7a590008d972
.reurl.cc/	1970-01-21 12:53:21	Name: FCNEC Value: %5B%5B%22AKsRol9jr-9dn1urLgwMt3X1tu7aXz1hKbYhayiA5CF1Y7T27I6QK8yV_KS8FFlqTWevH3XUppfbalwa9z0_kn7LBRHvQI37IqoSuLelsNrZw4oPcYe47UCHjISYTKU4de7lpNPfWkDOKdm7c_tkHd8dEwR44Fsr-w%3D%3D%22%5D%5D
.reurl.cc/	1970-01-21 04:50:57	Name: ISMD5VERSION Value: 1
.reurl.cc/	1970-01-21 12:53:21	Name: _ss_pp_id Value: 6b1a71782bfe76802531742901245856
.holmesmind.com/	1970-01-21 13:43:45	Name: P Value: 313040-XckqYkaXfQDzjRykMx0JePMtu4YLzcWX
.holmesmind.com/	1970-01-21 04:28:52	Name: Vision Value: 20250325-23:59,20250325-12,20250325-12,20250325-23:59
.holmesmind.com/	1970-01-21 04:28:52	Name: C Value: null
.holmesmind.com/	1970-01-21 06:32:42	Name: RK Value: null
.reurl.cc/	1970-01-21 04:50:57	Name: CFFPCKUUID Value: 3031-EG9vqL05fDAQvBZIXdTAu06wQI9pGhhC
.reurl.cc/	1970-01-21 04:50:57	Name: CFFPCKUUIDMAIN Value: 1620-geS8vpcNyiVVOtgboIZUtPafhkdeC9fP
.reurl.cc/	1970-01-21 04:50:57	Name: FPUUID Value: 1620-23f848dd5ddaa0c48122a127aafced52
.holmesmind.com/	1970-01-21 04:08:42	Name: test_cookie Value: CheckForPermission
.holmesmind.com/	1970-01-21 04:09:11	Name: fcm Value: 1
.reurl.cc/	1970-01-21 13:43:45	Name: _td Value: b4403b89-1022-4e49-a42e-89af563a599d
.reurl.cc/	1970-01-21 04:07:45	Name: _tg_csi Value: 1
.popin.cc/	1970-01-21 12:53:21	Name: uid Value: 6b1a71782bfe76802531742901245856
.lndata.com/	1970-01-21 12:53:50	Name: admckid Value: 2503250914061478209
track.91app.io/	1970-01-21 13:43:45	Name: deviceid Value: 7d6a50b3-4275-4a1d-9183-6a2aeb846f48
.reurl.cc/	1970-01-21 12:53:21	Name: __htid Value: bbbc52a1-ad6f-4f25-bae3-f01c5c4957da
.reurl.cc/	1970-01-21 04:07:48	Name: _ht_em Value: 1
.reurl.cc/	1970-01-21 04:09:11	Name: _ht_f3244e Value: 1
.reurl.cc/	1970-01-21 04:09:11	Name: _ht_50ef57 Value: 1
.reurl.cc/	1970-01-21 04:09:11	Name: _ht_hi Value: 1
.holmesmind.com/	1970-01-21 04:28:52	Name: R Value: null
.holmesmind.com/	1970-01-21 06:32:42	Name: G Value: we3u7ZGJymKY5J47cKd8kQ==
.hinet.net/	1970-01-21 13:43:45	Name: uuid Value: 38ae48ad-777d-408e-8cdf-6388079a7f52

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://reurl.cc/XqAx30(Line 76) Message: [GroupMarkerNotSet(crbug.com/242999)!:A03072251C350000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://blog.alphaloan.co/wp-content/uploads/2021/04/%E6%A8%82%E5%A4%A9%E8%B2%B8-%E4%BF%A1%E7%94%A8%E7%AE%A1%E7%90%86%E6%8C%87%E5%8D%97-1.jpg Message: Failed to load resource: net::ERR_CONNECTION_REFUSED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

294c39ee506ce297bd1501afdbd2aaf8.safeframe.googlesyndication.com
557aded4c9667d3fab5b66b42951bcc0.safeframe.googlesyndication.com
6cfe4b1e0c8002e0cec3f18322c6824e.safeframe.googlesyndication.com
ad-specs.guoshipartners.com
ad.holmesmind.com
ad.tagtoo.co
ad2.apx.appier.net
adx.holmesmind.com
analytics.google.com
api.popin.cc
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net
bcp.crwdcntrl.net
bidder.criteo.com
blog.alphaloan.co
cdn-ima.33across.com
cdn.holmesmind.com
cdn.jsdelivr.net
cms.analytics.yahoo.com
connect.facebook.net
cpt.geniee.jp
creditcards.com.tw
ecs.tagtoo.co
ep1.adtrafficquality.google
ep2.adtrafficquality.google
f0e95e1911995a29855d1211badab07c.safeframe.googlesyndication.com
fecddb20c9f3ccf4f49aafce69717ba5.safeframe.googlesyndication.com
fundingchoicesmessages.google.com
gocm.c.appier.net
googleads.g.doubleclick.net
gum.criteo.com
hb.aralego.com
img.gbyhn.com.tw
img.racingcharger.tw
invstatic101.creativecdn.com
log.popin.cc
match.adsrvr.org
mma.prnasia.com
oa.openxcdn.net
onead.onevision.com.tw
pagead2.googlesyndication.com
prebid-asia.creativecdn.com
prebid.scupio.com
ps.eyeota.net
r.popin.cc
re-news.tw
reurl.cc
s.w.org
securepubads.g.doubleclick.net
static.criteo.net
static.wixstatic.com
stats.g.doubleclick.net
storage.reurl.cc
t.ssp.hinet.net
td.doubleclick.net
trc.taboola.com
tw.popin.cc
uec.tagtoo.co
ups.analytics.yahoo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
yads.c.yimg.jp
ad.holmesmind.com
ad2.apx.appier.net
adx.holmesmind.com
bbbc52a1-ad6f-4f25-bae3-f01c5c4957da.t.ssp.hinet.net
blog.alphaloan.co
creditcards.com.tw
ep1.adtrafficquality.google
prebid-asia.creativecdn.com
prebid.scupio.com
t.ssp.hinet.net
100.28.140.230
103.1.220.9
103.132.192.30
104.18.29.101
107.178.241.176
119.63.193.220
119.63.198.143
119.63.198.188
119.63.198.189
142.250.31.132
142.251.111.155
142.251.163.132
142.251.167.154
142.251.167.155
168.95.245.4
172.105.213.147
172.253.115.132
172.253.115.139
172.253.115.156
172.253.122.101
172.253.122.132
172.253.62.105
172.253.63.154
172.67.150.31
182.22.16.251
192.0.77.48
192.96.203.13
2001:4998:14:800::1000
203.137.133.156
203.75.214.136
210.59.219.34
2600:9000:250a:7c00:0:e06c:e940:93a1
2600:9000:250a:b800:0:e06c:e940:93a1
2600:9000:250b:c200:1e:5c56:d400:93a1
2606:4700::6812:5fe1
2607:f8b0:4004:c06::9c
2607:f8b0:4004:c08::71
2607:f8b0:4004:c19::61
2607:f8b0:4004:c1d::84
2607:f8b0:4004:c1d::9d
2607:f8b0:4004:c1f::9c
2607:f8b0:4004:c21::8a
2620:100:a00b::12
2620:100:a00b::30
2620:100:a00b::5
2a04:4e42:400::485
2a04:4e42::300
3.33.220.150
31.13.66.19
31.13.66.35
34.102.146.192
34.102.218.41
34.107.150.21
34.111.12.34
34.149.98.30
34.160.26.175
34.96.70.87
35.185.130.121
35.190.36.98
52.3.138.212
54.64.195.61
64.233.180.132
0176b20c4879444a159d23fe232a7dfd0dcf12c68d6969f814b15cbdc22a8937
01e1f6267010b9118cf5c85affce23ae94f796cbfbc3347f01f57148035d3e90
039e147a3d5e4b0857c0230686525f58ab3b688ea092c8d963be13ac1ae0bc19
0614ad45d47a5da6d9880c2e175c88526cd223c16d2121e48bab3a9e1121f55d
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c310205ab2dbf30ae9b8a24ee1359f493e1bf5c982c124e42af22b759ac07ce
0d5f72fa17406cb784088b7c7f36763a1a2057fa33961feb227c88f8643c09f3
0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2
0f8d68a259760ba4655ea0e2cbbbab09fd4f45e2f94a8dd44dea4ed8b27fa0ea
13b3fea42a999bd1edc7815ad83b8529ad25262807607a54101486b76d2a39a0
151c7004167a473bcd41f61ff34a35968325627f1af40d664eb6a15a5c8fd0df
16cf673198b29bb08e83f5d8f74182d97d9c6dfa729c60f90f6195e739de9d20
17f447eff8935175783a7ef7353923f6040500b012ca22d2dad6249901cd227d
189a12b47d289e51a6b6b55bc8c7eedc12c72ed9b7ec5a708f14c3447d88a28e
1bf41ca1364230ce3a9cbbac1110ff4d7d287a9f978fa74297aa30117c4da9c0
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e9c9db89bca855106476450b890fa3cfcfb276fcd698dc3602404ba26d1dead
210c5274f50739be0024e5357d0f80e65d9df065e7ddc47b5ac0ad883afd2d75
22743d9dc93a38d7096ec7c9a02146da7a721ada15192d87e81d78ff53cb2f2a
25aa1db2c5fff13f9b15a2709cdcd1f55c7c56c621cc7553dbfe0063279c3a78
2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840
2c7d48b822f575f86303eee20ee32c3e450b365dc1d2d4737f1eea9499404a3d
2de5ce426a31db7515924896ba01be435c3a71f2fbf5fc33b54f7d7c8f5525c2
2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f
3050a5556edc5876cd83e63f15e56fe19cb428129345a58d1f57687414504698
3108e15dfc911f1a730106ee1e44c941639e0b7add838d095680425e86d086c3
31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30
3402df1af7b8665c51ac7e2d4fed5dc6cac147d61966672d9cf32a34acafedfe
35368042e7985f15e1e471961e2e6e1d822b6c1b5c2b282bf2fc97f7926eec2f
365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60
395afb1491e62cb0666325882b2d9ffd6258f76bc2da4f8c163e0b484d82927e
3b07482a7e55296a20e35304c8d3a30bc4805d350a933c634713001d467eb6cc
3df3e9a13132631718a2843cf49fff08f798133b4e6957562e31d48e42a0078b
43a71fb6e8f61126f7dfb3fe8a1a01eba8cfbff5cd7d681bba0e62f64ad924c7
46e977bd2e693545c10424af0ca8ae2061ce096d8e5658d997fa9ca60471e26d
4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f5b0e9aeb085d3faab0f241bb8fe8a9e02a113ea1327ec610a3cb2b524f3079
51cefa874c2b47e86b79fdc293a353e4999715efcf9deadb102de0b57d558289
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32
64e21603d2e1540c0da767e0135df5f36748a4dac09ae5d6648b0f8b32ee5e15
654b8fbb3beb01a6f08eb873015b728be6ac596b9d51f6c65dbf728e22441e0e
6690e3c30b0eededab18045eb475d854615ca6c2205a1ee112762ea1d1625484
688f229a7cac61e53d32a21d50ff29e962c48c9e65d65f9da34553c017003a15
698fe0a6500f771d98d1ca713a5445d523fac649207572b69123699702854c0b
6d03166137610370c00d5af20236e916aee1b3d4e2f8b5ed1293b5ed0f050c87
6d18db0e2d9b4a919262081773b708dcfeaa5a9fb70702bc60f5ada39ad2c561
70f23f6f47025f395dfa58f84bd86d1463448fa6b1275a5c872f26a4526fdc8a
72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3
724bf9b6cead6b42a8435c2dd63959f95a2868fc29d0c19f44b7f26c83a18cdd
73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c
749079c4e18ad34ac381e98d3fa23e070937ae17b73e27bb066eae5350ed667d
7511e3911b1f0df4c73ca0c04539915aab426169d302345c726ab26a2aefbf88
76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517
7c838752fe34c3313db25a266edcfb196f1fd93037a68e6cead7cbaebe110e86
7f73422fabf3e3c0bdc38c55c68464b112b15537766ca9dc7292316032d25cfb
80279f6baf172b794e35da391ac30711c57a3276abda4280d170920df9cca9b1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
851c3da53f870dab9f8fd365f8eb9af27af956d79a96f89f412f8baa5b7b1624
8aad7f034c2e39ee145189b327d6b1df64240486e08c7eba41d399e7e72797a6
8f083b07f3b2aa8c2b404e006849983bb50eb4bdb0aec2fa91d22de540c10b21
8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e
913947f0aeb73626c855bfd3f715ae0a27a5aee727b53a0281cd324ea3e0565c
9242cc1e301faf9197c593a8334f932629a63c6db340d626099d1253e3eeb0d1
95634eb651772e9ecc489c8a2e12cccb71cd06089ae3f03f8dab3654ce669c8c
991422674ba67764e4352fd0c8c393362e558130c27f0d48f1d886d09aeff247
9a058c460d30a214d78a722942c6fa7bbba9320b4c7d1116ebe36f633f57fb6a
9b06724bad0c4a751d64a777260664f9b2fa627b4536f5c8b143ee3d0234d3e8
9cf1114324a6653750f0f8af7783a744e45adadca47c48844e4ee0f11df269bf
a04f34704979641276f23e67418c306096c72e46cfbf111165eed8ca46acf794
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
af1ae8f58c1dc0a3193b9ae82ea975d2567f5c272bc3045484b52a1e4940ac10
af57f9310ddf77f7f86c7409e2879a408aa2089be22ea85e2004a93a0a0a33ff
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b6c5af2d5c532a14b5aa51656c9d5e8be329b1424ec1df2947ad2de309622448
b83e5a367880e8ad89b16ca3ba6695ceb8806e3727c746265ffd5c9b0c6b6023
b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5
ba17ede1117181a80c53cd062b8888bccf458b5d39978b5078172431c3325a22
bc3f28594940a835936309f57d05dbcd46b002c1fcf528a3b0062ddfef218261
bc73ed340ef20534b613afea9bd95f199a55b77beab7c472e92ad92b4e39a1aa
c17314e7d6e1c20fb0a0aec00c3fac548d515945ab3985f7a25eb437a639d2b3
c280d38004a82811e8659f68bbd6dc8dde7f7c6a95d3172d7ddec4acf8c96d6f
c5b2c8132270b4b66ffbf437781cfb6157470b0fcc4ee64dbc84de2bf34344ea
c6323c52881bc29c6b3212119991086a32e74c91af2d0cca9b96a8ded59ebb4a
c8e9318c3c4d4267ff19a29ff8e36700e7e2b9de1dc992191a6e7157c4b97924
cd0db2d68f6fb00e1197e823f47e1f53aa2aa2ae85228a5e5d04a4a863629cc1
cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda
ddd9d29beabaeecc9c76408242dfc2b76305ec52511992d3cfbc81a500ee0670
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7e4fb9b3b1239835abc60fd16d2e64da36bfa919b8e81f11eea442c2bbf05f2
e824217e74a487b3080dc6cbaf36989c37cd6061c6dd07888f79c41fbceb4c55
e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990
ed1353670cbe52a301571e6717fab543726f43f7bed2edd0ffca2e74f6a1d8bf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b
f48f76bd3c251f292803b3446a96c1f24b1c5486f0442e50f213acb30e715275
f9f2b646145f92ff6b5b2bbd5cdc6099254a19047fc708b7acc872e6c499f04a
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99
ff43ad34b1cd60bd7e3f183d8e01d0a5849da0b9bb2811cf7b2c42061cfb62aa
ffae84e0dcecb5c3c608654ce28dbb6d26cef061b6f6e663087a23b77f782f22

reurl.cc Open in urlscan Pro 35.185.130.121 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

281 Requests

90 %HTTPS

27 %IPv6

39 Domains

63 Subdomains

59 IPs

5 Countries

3398 kBTransfer

11714 kBSize

48 Cookies

20 Outgoing links

Redirected requests

281 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

reurl.cc Open in urlscan Pro
35.185.130.121 Public Scan

Screenshot
Live screenshot

Full Image

281
Requests

90 %
HTTPS

27 %
IPv6

39
Domains

63
Subdomains

59
IPs

5
Countries

3398 kB
Transfer

11714 kB
Size

48
Cookies

281 HTTP transactions
7 data transactions