Submitted URL:
http://d2emu.com/ 3yr old
Effective URL:
https://d2emu.com/ 3yr old
Submission: On August 11 via api (August 11th 2025, 10:12:33 pm UTC) from US — Scanned from CA

Summary

This website contacted 115 IPs in 7 countries across 109 domains to perform 498 HTTP transactions. The main IP is 104.21.112.1, located in Ascension Island and belongs to CLOUDFLARENET, US. The main domain is d2emu.com. 3yr old
TLS certificate: Issued by WE1 on June 14th 2025. Valid for: 3mo.
This is the only time d2emu.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 104.21.112.1 104.21.112.1 13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 192.178.155.97 192.178.155.97 15169 (GOOGLE) (GOOGLE)
30 142.251.163.155 142.251.163.155 15169 (GOOGLE) (GOOGLE)
3 104.18.2.78 104.18.2.78 13335 (CLOUDFLAR...) (CLOUDFLARENET)
7 172.253.115.95 172.253.115.95 15169 (GOOGLE) (GOOGLE)
3 104.17.25.14 104.17.25.14 13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 104.16.80.73 104.16.80.73 13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 142.251.179.94 142.251.179.94 15169 (GOOGLE) (GOOGLE)
2 142.251.179.113 142.251.179.113 15169 (GOOGLE) (GOOGLE)
1 172.66.171.133 172.66.171.133 13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 99.84.188.122 99.84.188.122 16509 (AMAZON-02) (AMAZON-02)
6 74.119.117.17 74.119.117.17 19750 (AS-CRITEO) (AS-CRITEO)
4 172.66.148.159 172.66.148.159 13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 7 162.19.138.83 162.19.138.83 16276 (OVH OVH SAS) (OVH OVH SAS)
2 104.20.23.13 104.20.23.13 13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 34.107.165.188 34.107.165.188 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 3.213.231.35 3.213.231.35 14618 (AMAZON-AES) (AMAZON-AES)
4 5 52.223.40.198 52.223.40.198 16509 (AMAZON-02) (AMAZON-02)
6 192.178.218.156 192.178.218.156 15169 (GOOGLE) (GOOGLE)
3 3.171.86.171 3.171.86.171 16509 (AMAZON-02) (AMAZON-02)
12 35.244.144.25 35.244.144.25 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
6 64.233.180.154 64.233.180.154 15169 (GOOGLE) (GOOGLE)
1 34.36.200.111 34.36.200.111 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 172.66.148.140 172.66.148.140 13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 142.251.111.148 142.251.111.148 15169 (GOOGLE) (GOOGLE)
1 3.171.100.117 3.171.100.117 16509 (AMAZON-02) (AMAZON-02)
1 104.21.80.1 104.21.80.1 13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3 104.20.22.97 104.20.22.97 13335 (CLOUDFLAR...) (CLOUDFLARENET)
8 104.20.35.150 104.20.35.150 13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3.208.175.5 3.208.175.5 14618 (AMAZON-AES) (AMAZON-AES)
4 6 68.67.181.102 68.67.181.102 29990 (ASN-APPNEX) (ASN-APPNEX)
2 74.119.117.12 74.119.117.12 19750 (AS-CRITEO) (AS-CRITEO)
2 199.250.161.129 199.250.161.129 26459 (TTD-ASN-01) (TTD-ASN-01)
2 34.230.249.135 34.230.249.135 14618 (AMAZON-AES) (AMAZON-AES)
2 34.120.63.153 34.120.63.153 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 5 185.167.164.48 185.167.164.48 198622 (ADFORM Ad...) (ADFORM Adform A/S)
5 138.197.62.132 138.197.62.132 14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
8 34.236.157.112 34.236.157.112 14618 (AMAZON-AES) (AMAZON-AES)
4 35.186.253.211 35.186.253.211 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 104.20.20.189 104.20.20.189 13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 130.211.23.194 130.211.23.194 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 135.125.247.202 135.125.247.202 16276 (OVH OVH SAS) (OVH OVH SAS)
2 162.19.138.118 162.19.138.118 16276 (OVH OVH SAS) (OVH OVH SAS)
1 18.160.10.80 18.160.10.80 16509 (AMAZON-02) (AMAZON-02)
1 184.24.70.89 184.24.70.89 16625 (AKAMAI-AS) (AKAMAI-AS)
1 3.167.69.118 3.167.69.118 16509 (AMAZON-02) (AMAZON-02)
1 104.18.28.101 104.18.28.101 13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 34.102.146.192 34.102.146.192 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 74.119.117.47 74.119.117.47 19750 (AS-CRITEO) (AS-CRITEO)
7 142.251.179.132 142.251.179.132 15169 (GOOGLE) (GOOGLE)
1 1 52.45.221.36 52.45.221.36 14618 (AMAZON-AES) (AMAZON-AES)
1 35.244.193.51 35.244.193.51 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 54.68.43.194 54.68.43.194 16509 (AMAZON-02) (AMAZON-02)
1 2 34.120.135.53 34.120.135.53 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 108.138.64.5 108.138.64.5 16509 (AMAZON-02) (AMAZON-02)
13 18.67.76.121 18.67.76.121 16509 (AMAZON-02) (AMAZON-02)
4 26 35.212.59.62 35.212.59.62 15169 (GOOGLE) (GOOGLE)
6 34.98.64.218 34.98.64.218 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 172.64.146.226 172.64.146.226 13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 199.232.211.52 199.232.211.52 54113 (FASTLY) (FASTLY)
13 22 172.253.115.156 172.253.115.156 15169 (GOOGLE) (GOOGLE)
6 6 15.197.193.217 15.197.193.217 16509 (AMAZON-02) (AMAZON-02)
3 3 52.44.35.98 52.44.35.98 14618 (AMAZON-AES) (AMAZON-AES)
1 2 151.101.130.49 151.101.130.49 54113 (FASTLY) (FASTLY)
2 216.22.16.4 216.22.16.4 30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
4 4 23.9.159.188 23.9.159.188 16625 (AKAMAI-AS) (AKAMAI-AS)
9 23.3.133.134 23.3.133.134 16625 (AKAMAI-AS) (AKAMAI-AS)
4 24 54.172.66.51 54.172.66.51 14618 (AMAZON-AES) (AMAZON-AES)
1 1 54.164.170.29 54.164.170.29 14618 (AMAZON-AES) (AMAZON-AES)
4 6 69.194.240.13 69.194.240.13 26120 (RHYTHMONE) (RHYTHMONE)
3 3 3.208.226.69 3.208.226.69 14618 (AMAZON-AES) (AMAZON-AES)
3 3 172.253.115.155 172.253.115.155 15169 (GOOGLE) (GOOGLE)
1 8.28.7.83 8.28.7.83 62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2 192.184.68.215 192.184.68.215 14618 (AMAZON-AES) (AMAZON-AES)
3 8.28.7.82 8.28.7.82 62713 (AS-PUBMATIC) (AS-PUBMATIC)
4 4 216.48.66.41 216.48.66.41 26762 (CNVR-US-EAST) (CNVR-US-EAST)
3 3 74.214.194.131 74.214.194.131 19189 (PULSEPOINT) (PULSEPOINT)
1 1 67.202.105.21 67.202.105.21 32748 (STEADFAST) (STEADFAST)
1 192.132.33.68 192.132.33.68 18568 (BIDTELLECT) (BIDTELLECT)
1 1 34.198.121.184 34.198.121.184 14618 (AMAZON-AES) (AMAZON-AES)
1 1 3.209.99.248 3.209.99.248 14618 (AMAZON-AES) (AMAZON-AES)
15 24 69.173.151.100 69.173.151.100 26667 (RUBICONPR...) (RUBICONPROJECT)
2 2 80.77.87.161 80.77.87.161 46636 (NATCOWEB) (NATCOWEB)
1 2 151.101.2.49 151.101.2.49 54113 (FASTLY) (FASTLY)
1 35.241.45.217 35.241.45.217 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 34.95.69.49 34.95.69.49 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 167.71.26.251 167.71.26.251 14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
6 8 34.111.113.62 34.111.113.62 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 207.65.37.181 207.65.37.181 62713 (AS-PUBMATIC) (AS-PUBMATIC)
4 6 104.18.27.193 104.18.27.193 13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 6 98.82.158.241 98.82.158.241 14618 (AMAZON-AES) (AMAZON-AES)
1 34.107.140.113 34.107.140.113 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3 3 35.212.38.52 35.212.38.52 15169 (GOOGLE) (GOOGLE)
1 2 8.18.47.7 8.18.47.7 398989 (DEEPINTENT) (DEEPINTENT)
6 6 35.211.202.130 35.211.202.130 15169 (GOOGLE) (GOOGLE)
2 2 50.31.142.159 50.31.142.159 23352 (SERVERCEN...) (SERVERCENTRAL)
1 1 64.74.236.31 64.74.236.31 22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1 1 91.227.144.188 91.227.144.188 50245 (SERVEREL-...) (SERVEREL-AS Serverel Inc.)
5 7 35.244.154.8 35.244.154.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5 8 68.67.181.103 68.67.181.103 29990 (ASN-APPNEX) (ASN-APPNEX)
2 2 44.221.147.74 44.221.147.74 14618 (AMAZON-AES) (AMAZON-AES)
2 2 34.1.234.40 34.1.234.40 19527 (GOOGLE-2) (GOOGLE-2)
1 1 8.2.110.97 8.2.110.97 46636 (NATCOWEB) (NATCOWEB)
1 34.96.105.8 34.96.105.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 204.62.12.198 204.62.12.198 46636 (NATCOWEB) (NATCOWEB)
1 1 34.202.130.254 34.202.130.254 14618 (AMAZON-AES) (AMAZON-AES)
1 1 80.77.85.111 80.77.85.111 46636 (NATCOWEB) (NATCOWEB)
2 34.198.47.23 34.198.47.23 14618 (AMAZON-AES) (AMAZON-AES)
2 2 185.184.8.90 185.184.8.90 204995 (RTB-HOUSE...) (RTB-HOUSE-AMS RTB Marketing and Tech Services Ltd)
1 80.77.82.130 80.77.82.130 46636 (NATCOWEB) (NATCOWEB)
1 1 172.111.38.111 172.111.38.111 63023 (AS-GLOBAL...) (AS-GLOBALTELEHOST)
2 2 188.40.16.220 188.40.16.220 24940 (HETZNER-A...) (HETZNER-AS Hetzner Online GmbH)
2 2 82.145.213.8 82.145.213.8 39832 (NO-OPERA ...) (NO-OPERA Opera Norway AS)
1 1 20.157.93.108 20.157.93.108 8069 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1 80.77.87.163 80.77.87.163 46636 (NATCOWEB) (NATCOWEB)
1 107.178.254.65 107.178.254.65 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 23.221.241.44 23.221.241.44 16625 (AKAMAI-AS) (AKAMAI-AS)
2 10 23.105.12.173 23.105.12.173 30633 (LEASEWEB-...) (LEASEWEB-USA-WDC)
2 18.160.10.109 18.160.10.109 16509 (AMAZON-02) (AMAZON-02)
2 2 3.232.216.59 3.232.216.59 14618 (AMAZON-AES) (AMAZON-AES)
2 4 23.23.116.71 23.23.116.71 14618 (AMAZON-AES) (AMAZON-AES)
19 172.253.115.149 172.253.115.149 15169 (GOOGLE) (GOOGLE)
1 1 69.173.146.5 69.173.146.5 26667 (RUBICONPR...) (RUBICONPROJECT)
1 2 67.220.228.203 67.220.228.203 16509 (AMAZON-02) (AMAZON-02)
2 150.171.22.12 150.171.22.12 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 3.94.137.152 3.94.137.152 14618 (AMAZON-AES) (AMAZON-AES)
1 125.253.89.173 125.253.89.173 19437 (SS-ASH) (SS-ASH)
1 1 52.85.151.129 52.85.151.129 16509 (AMAZON-02) (AMAZON-02)
1 2 52.85.132.68 52.85.132.68 16509 (AMAZON-02) (AMAZON-02)
2 2 3.221.117.8 3.221.117.8 14618 (AMAZON-AES) (AMAZON-AES)
1 138.197.252.137 138.197.252.137 14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
6 3.171.85.59 3.171.85.59 16509 (AMAZON-02) (AMAZON-02)
1 142.251.179.95 142.251.179.95 15169 (GOOGLE) (GOOGLE)
1 23.53.35.198 23.53.35.198 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
7 23.222.200.28 23.222.200.28 16625 (AKAMAI-AS) (AKAMAI-AS)
4 147.182.212.117 147.182.212.117 14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
2 7 35.71.139.29 35.71.139.29 16509 (AMAZON-02) (AMAZON-02)
1 151.101.193.108 151.101.193.108 54113 (FASTLY) (FASTLY)
2 3 35.173.123.99 35.173.123.99 14618 (AMAZON-AES) (AMAZON-AES)
2 2 69.194.242.12 69.194.242.12 26120 (RHYTHMONE) (RHYTHMONE)
2 7 35.244.159.8 35.244.159.8 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2 34.36.216.150 34.36.216.150 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
9 54.160.229.225 54.160.229.225 14618 (AMAZON-AES) (AMAZON-AES)
2 35.190.90.30 35.190.90.30 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 74.119.117.39 74.119.117.39 19750 (AS-CRITEO) (AS-CRITEO)
1 150.171.27.10 150.171.27.10 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1 199.38.167.130 199.38.167.130 54312 (ROCKETFUEL) (ROCKETFUEL)
3 23.45.148.30 23.45.148.30 16625 (AKAMAI-AS) (AKAMAI-AS)
3 54.88.142.103 54.88.142.103 14618 (AMAZON-AES) (AMAZON-AES)
1 5 23.3.132.27 23.3.132.27 16625 (AKAMAI-AS) (AKAMAI-AS)
2 2 216.34.207.204 216.34.207.204 26762 (CNVR-US-EAST) (CNVR-US-EAST)
1 23.33.180.25 23.33.180.25 16625 (AKAMAI-AS) (AKAMAI-AS)
1 70.42.32.191 70.42.32.191 22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
498 115
Apex Domain
Subdomains
Transfer
47 sharethrough.com 4 redirects
btlr.sharethrough.com — Cisco Umbrella Rank: 1226 10yr old
groundcontrol.rendering.sharethrough.com — Cisco Umbrella Rank: 3442 2yr old
b.sharethrough.com — Cisco Umbrella Rank: 2564 10yr old
match.sharethrough.com — Cisco Umbrella Rank: 652 10yr old
157 KB
42 doubleclick.net 16 redirects
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 265 10yr old
googleads.g.doubleclick.net — Cisco Umbrella Rank: 65 9yr old
ad.doubleclick.net — Cisco Umbrella Rank: 178 10yr old
cm.g.doubleclick.net — Cisco Umbrella Rank: 302 10yr old
380 KB
38 rubiconproject.com 20 redirects
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1119 10yr old
eus.rubiconproject.com — Cisco Umbrella Rank: 696 8yr old
pixel.rubiconproject.com — Cisco Umbrella Rank: 440 10yr old
token.rubiconproject.com — Cisco Umbrella Rank: 562 10yr old
pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1590 9yr old
45 KB
37 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 141 10yr old
257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com 10mo old
tpc.googlesyndication.com — Cisco Umbrella Rank: 214 13yr old
389 KB
26 inmobi.com 4 redirects
sync.inmobi.com — Cisco Umbrella Rank: 997 5yr old
8 KB
19 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 426 10yr old
721 KB
19 adsafeprotected.com 2 redirects
fw.adsafeprotected.com — Cisco Umbrella Rank: 992 10yr old
static.adsafeprotected.com — Cisco Umbrella Rank: 796 10yr old
dt.adsafeprotected.com — Cisco Umbrella Rank: 665 10yr old
135 KB
19 openx.net 3 redirects
rtb.openx.net — Cisco Umbrella Rank: 593 9yr old
oajs.openx.net — Cisco Umbrella Rank: 2910 6yr old
google-bidout-d.openx.net — Cisco Umbrella Rank: 2737 7yr old
us-u.openx.net — Cisco Umbrella Rank: 569 10yr old
u.openx.net Failed — Cisco Umbrella Rank: 807 10yr old
ggsoftware-d.openx.net — Cisco Umbrella Rank: 31381 9yr old
5 KB
18 media.net 1 redirects
prebid.media.net — Cisco Umbrella Rank: 1022 8yr old
hbx.media.net — Cisco Umbrella Rank: 1019 8yr old
contextual.media.net — Cisco Umbrella Rank: 957 10yr old
cs.media.net — Cisco Umbrella Rank: 927 7yr old
c21lg-d.media.net — Cisco Umbrella Rank: 2175 5yr old
38 KB
15 adnxs.com 9 redirects
ib.adnxs.com — Cisco Umbrella Rank: 292 10yr old
secure.adnxs.com — Cisco Umbrella Rank: 564 10yr old
acdn.adnxs.com — Cisco Umbrella Rank: 763 11yr old
30 KB
13 adsrvr.org 10 redirects
match.adsrvr.org — Cisco Umbrella Rank: 400 10yr old
direct.adsrvr.org — Cisco Umbrella Rank: 1140 8yr old
8 KB
13 ad.gt
id.hadron.ad.gt — Cisco Umbrella Rank: 1998 4yr old
a.ad.gt — Cisco Umbrella Rank: 1893 10yr old
p.ad.gt — Cisco Umbrella Rank: 2248 9yr old
ids4.ad.gt — Cisco Umbrella Rank: 2191 2yr old
seg.ad.gt — Cisco Umbrella Rank: 2596 8yr old
pixels.ad.gt — Cisco Umbrella Rank: 2253 9yr old
18 KB
12 smartadserver.com 2 redirects
ssbsync.smartadserver.com — Cisco Umbrella Rank: 776 7yr old
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 756 10yr old
6 KB
12 amazon-adsystem.com 3 redirects
c.amazon-adsystem.com — Cisco Umbrella Rank: 361 12yr old
config.aps.amazon-adsystem.com — Cisco Umbrella Rank: 839 3yr old
s.amazon-adsystem.com Failed — Cisco Umbrella Rank: 369 13yr old
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1153 13yr old
97 KB
12 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 490 10yr old
grid-bidder.criteo.com — Cisco Umbrella Rank: 1135 2yr old
ssp-sync.criteo.com — Cisco Umbrella Rank: 951 4yr old
19 KB
11 nitropay.com
s.nitropay.com — Cisco Umbrella Rank: 23137 8yr old
floors.nitropay.com — Cisco Umbrella Rank: 34842 1yr old
pbs.nitropay.com — Cisco Umbrella Rank: 23850 1yr old
282 KB
11 d2emu.com
d2emu.com 3yr old
469 KB
10 cootlogix.com
prebid.cootlogix.com — Cisco Umbrella Rank: 5014 6yr old
bisrtb.cootlogix.com — Cisco Umbrella Rank: 5360 4yr old
sync.cootlogix.com Failed — Cisco Umbrella Rank: 1470 4yr old
52 KB
10 rlcdn.com 5 redirects
api.rlcdn.com — Cisco Umbrella Rank: 979 8yr old
idsync.rlcdn.com Failed — Cisco Umbrella Rank: 565 10yr old
id.rlcdn.com — Cisco Umbrella Rank: 780 9yr old
check.analytics.rlcdn.com — Cisco Umbrella Rank: 3372 5yr old
3 KB
9 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 970 10yr old
image8.pubmatic.com — Cisco Umbrella Rank: 713 8yr old
image6.pubmatic.com — Cisco Umbrella Rank: 782 10yr old
ads.pubmatic.com — Cisco Umbrella Rank: 629 10yr old
15 KB
9 3lift.com 2 redirects
tlx.3lift.com — Cisco Umbrella Rank: 670 10yr old
eb2.3lift.com — Cisco Umbrella Rank: 506 10yr old
6 KB
9 id5-sync.com 2 redirects
id5-sync.com — Cisco Umbrella Rank: 566 9yr old
cdn.id5-sync.com — Cisco Umbrella Rank: 918 7yr old
66 KB
8 tapad.com 6 redirects
pixel.tapad.com — Cisco Umbrella Rank: 513 10yr old
pandg.tapad.com Failed 6yr old
3 KB
8 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 73 10yr old
ajax.googleapis.com — Cisco Umbrella Rank: 508 10yr old
40 KB
6 casalemedia.com 4 redirects
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 671 12yr old
5 KB
6 bidswitch.net
x.bidswitch.net Failed — Cisco Umbrella Rank: 417 13yr old
2 KB
6 dotomi.com 6 redirects
stx-match.dotomi.com — Cisco Umbrella Rank: 3453 8yr old
inmobi-match.dotomi.com — Cisco Umbrella Rank: 5455 5yr old
medianet-match.dotomi.com — Cisco Umbrella Rank: 9289 9yr old
2 KB
6 1rx.io 4 redirects
sync.1rx.io — Cisco Umbrella Rank: 543 10yr old
1 KB
5 bidr.io 3 redirects
match.prod.bidr.io — Cisco Umbrella Rank: 700 9yr old
3 KB
5 adform.net 3 redirects
adx2.adform.net — Cisco Umbrella Rank: 19791 12yr old
c1.adform.net — Cisco Umbrella Rank: 753 12yr old
3 KB
5 btloader.com
btloader.com — Cisco Umbrella Rank: 1016 6yr old
api.btloader.com — Cisco Umbrella Rank: 1220 6yr old
40 KB
4 everesttech.net 2 redirects
sync-tm.everesttech.net — Cisco Umbrella Rank: 885 9yr old
1 KB
4 yahoo.com 4 redirects
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 734 10yr old
pbs.yahoo.com Failed 3yr old
2 KB
4 eu-1-id5-sync.com
lbs.eu-1-id5-sync.com — Cisco Umbrella Rank: 1258 4yr old
lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1002 4yr old
1 KB
4 ad-delivery.net
ad-delivery.net — Cisco Umbrella Rank: 1077 9yr old
1 KB
4 nit.ro
t.nit.ro — Cisco Umbrella Rank: 19330 3yr old
3 iqm.com
pxl.iqm.com — Cisco Umbrella Rank: 1801 8yr old
7 KB
3 demdex.net 2 redirects
dpm.demdex.net — Cisco Umbrella Rank: 260 9yr old
2 KB
3 lijit.com 2 redirects
ap.lijit.com — Cisco Umbrella Rank: 793 10yr old
ce.lijit.com — Cisco Umbrella Rank: 1015 10yr old
1 KB
3 smaato.net
s.ad.smaato.net Failed — Cisco Umbrella Rank: 851 6yr old
972 B
3 admanmedia.com 3 redirects
cs.admanmedia.com — Cisco Umbrella Rank: 858 9yr old
1 KB
3 contextweb.com 3 redirects
bh.contextweb.com — Cisco Umbrella Rank: 771 13yr old
3 KB
3 33across.com 1 redirects
cdn-ima.33across.com — Cisco Umbrella Rank: 1387 3yr old
lexicon.33across.com — Cisco Umbrella Rank: 1728 5yr old
ssc-cms.33across.com — Cisco Umbrella Rank: 1033 9yr old
7 KB
3 postrelease.com 1 redirects
exchange.postrelease.com — Cisco Umbrella Rank: 3484 5yr old
jadserve.postrelease.com — Cisco Umbrella Rank: 935 10yr old
1 KB
3 hadronid.net 3 redirects
cdn.hadronid.net — Cisco Umbrella Rank: 1832 4yr old
201 B
3 gstatic.com
fonts.gstatic.com 10yr old
91 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 250 13yr old
148 KB
2 mookie1.com
odr.mookie1.com — Cisco Umbrella Rank: 1347 10yr old
1 KB
2 turn.com 2 redirects
ad.turn.com — Cisco Umbrella Rank: 883 10yr old
906 B
2 ipredictive.com 2 redirects
sync.ipredictive.com — Cisco Umbrella Rank: 994 9yr old
980 B
2 intentiq.com 1 redirects
sync.intentiq.com — Cisco Umbrella Rank: 1145 10yr old
syncv4.intentiq.com — Cisco Umbrella Rank: 1976 4yr old
2 KB
2 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 334 9yr old
1 KB
2 360yield.com 2 redirects
dsp.360yield.com — Cisco Umbrella Rank: 1775 2yr old
742 B
2 opera.com 2 redirects
t.adx.opera.com — Cisco Umbrella Rank: 986 5yr old
2 KB
2 eskimi.com 2 redirects
ittpx.eskimi.com — Cisco Umbrella Rank: 1596 2yr old
1 KB
2 loopme.me 2 redirects
csync.loopme.me — Cisco Umbrella Rank: 893 9yr old
523 B
2 deepintent.com 1 redirects
match.deepintent.com — Cisco Umbrella Rank: 1031 9yr old
763 B
2 sitescout.com
pixel-sync.sitescout.com Failed — Cisco Umbrella Rank: 777 8yr old
757 B
2 zemanta.com
b1sync.zemanta.com Failed — Cisco Umbrella Rank: 765 9yr old
1 KB
2 clean.gg
i.clean.gg — Cisco Umbrella Rank: 1791 8yr old
104 B
2 outbrain.com
b1sync.outbrain.com Failed — Cisco Umbrella Rank: 821 2yr old
sync.outbrain.com — Cisco Umbrella Rank: 1161 9yr old
985 B
2 stackadapt.com 2 redirects
sync.srv.stackadapt.com — Cisco Umbrella Rank: 705 10yr old
2 KB
2 creativecdn.com
creativecdn.com Failed — Cisco Umbrella Rank: 577 13yr old
680 B
2 quantserve.com 2 redirects
cms.quantserve.com — Cisco Umbrella Rank: 939 9yr old
571 B
2 vidazoo.com
static.vidazoo.com — Cisco Umbrella Rank: 6644 9yr old
bis4.vidazoo.com — Cisco Umbrella Rank: 9852 4yr old
49 KB
2 crwdcntrl.net
id.crwdcntrl.net — Cisco Umbrella Rank: 2387 6yr old
tags.crwdcntrl.net — Cisco Umbrella Rank: 1234 13yr old
14 KB
2 privacymanager.io
ats-wrapper.privacymanager.io — Cisco Umbrella Rank: 1961 5yr old
geo.privacymanager.io — Cisco Umbrella Rank: 1970 6yr old
35 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 82 13yr old
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 67 13yr old
256 KB
1 rfihub.com 1 redirects
p.rfihub.com — Cisco Umbrella Rank: 931 10yr old
666 B
1 createjs.com
code.createjs.com — Cisco Umbrella Rank: 2019 12yr old
63 KB
1 primis.tech 1 redirects
live.primis.tech — Cisco Umbrella Rank: 1824 5yr old
561 B
1 a-mo.net
sync.a-mo.net — Cisco Umbrella Rank: 1638 3yr old
720 B
1 pippio.com
pippio.com — Cisco Umbrella Rank: 942 12yr old
569 B
1 temu.com 1 redirects
www.temu.com — Cisco Umbrella Rank: 726 5yr old
421 B
1 ortb.net 1 redirects
tracker-shr.ortb.net — Cisco Umbrella Rank: 5542 2yr old
692 B
1 krushmedia.com
cs.krushmedia.com — Cisco Umbrella Rank: 1813 6yr old
321 B
1 playdigo.com 1 redirects
cs.playdigo.com — Cisco Umbrella Rank: 4432 2yr old
576 B
1 clearnview.com
sync.clearnview.com — Cisco Umbrella Rank: 2183 2yr old
364 B
1 blismedia.com
tr.blismedia.com — Cisco Umbrella Rank: 1827 10yr old
171 B
1 ck-ie.com 1 redirects
us.ck-ie.com — Cisco Umbrella Rank: 2402 6yr old
483 B
1 e-volution.ai 1 redirects
sync.e-volution.ai — Cisco Umbrella Rank: 1800 6yr old
562 B
1 t13.io
s2s.t13.io — Cisco Umbrella Rank: 3625 6yr old
489 B
1 pghub.io
pghub.io — Cisco Umbrella Rank: 2624 5yr old
5 KB
1 bing.com
c.bing.com Failed — Cisco Umbrella Rank: 165 13yr old
689 B
1 bttrack.com
bttrack.com — Cisco Umbrella Rank: 1043 12yr old
307 B
1 disqus.com 1 redirects
ssp.disqus.com — Cisco Umbrella Rank: 1569 5yr old
345 B
1 script.ac
cadmus.script.ac — Cisco Umbrella Rank: 2501 3yr old
55 KB
1 criteo.net
static.criteo.net — Cisco Umbrella Rank: 1003 13yr old
13 KB
1 openxcdn.net
oa.openxcdn.net — Cisco Umbrella Rank: 2538 7yr old
8 KB
1 fastclick.net
secure.cdn.fastclick.net — Cisco Umbrella Rank: 1378 13yr old
22 KB
1 nitrocnct.com
consent.nitrocnct.com — Cisco Umbrella Rank: 24912 4yr old
108 KB
1 dns-finder.com
ag.dns-finder.com — Cisco Umbrella Rank: 1276 1yr old
233 B
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 630 7yr old
7 KB
0 adtrafficquality.google Failed
ep1.adtrafficquality.google Failed 2yr old
0 media6degrees.com Failed
idpix.media6degrees.com Failed 10yr old
0 rtactivate.com Failed
bpi.rtactivate.com Failed 7yr old
0 taboola.com Failed
sync.taboola.com Failed 6yr old
0 aniview.com Failed
sync.aniview.com Failed 7yr old
0 tremorhub.com Failed
partners.tremorhub.com Failed 10yr old
0 bfmio.com Failed
sync.bfmio.com Failed 9yr old
0 rqtrk.eu Failed
wt.rqtrk.eu Failed 6yr old
0 iqzone.com Failed
cs.iqzone.com Failed 4yr old
0 thrtle.com Failed
thrtle.com Failed 8yr old
0 adkernel.com Failed
sync.adkernel.com Failed 9yr old
0 lkqd.net Failed
cs.lkqd.net Failed 9yr old
0 liadm.com Failed
i.liadm.com Failed — Cisco Umbrella Rank: 623 9yr old
0 yahoo.net Failed
hb.yahoo.net Failed 3yr old
0 storygize.net Failed
sid.storygize.net Failed 4yr old
498 109
Domain Requested by
30 pagead2.googlesyndication.com d2emu.com
pagead2.googlesyndication.com
groundcontrol.rendering.sharethrough.com
cadmus.script.ac
googleads.g.doubleclick.net
s0.2mdn.net
tpc.googlesyndication.com
26 sync.inmobi.com 4 redirects s.nitropay.com
sync.inmobi.com
25 cm.g.doubleclick.net 16 redirects google-bidout-d.openx.net
sync.inmobi.com
googleads.g.doubleclick.net
ssbsync.smartadserver.com
eb2.3lift.com
24 match.sharethrough.com 4 redirects d2emu.com
ssbsync.smartadserver.com
sync.inmobi.com
19 s0.2mdn.net d2emu.com
s0.2mdn.net
cdnjs.cloudflare.com
15 pixel.rubiconproject.com 10 redirects cadmus.script.ac
d2emu.com
googleads.g.doubleclick.net
sync.inmobi.com
13 b.sharethrough.com d2emu.com
s.nitropay.com
11 match.adsrvr.org 10 redirects s.nitropay.com
11 d2emu.com d2emu.com
static.cloudflareinsights.com
10 rtb-csync.smartadserver.com 2 redirects ssbsync.smartadserver.com
hbx.media.net
10 us-u.openx.net 2 redirects google-bidout-d.openx.net
ggsoftware-d.openx.net
hbx.media.net
10 ib.adnxs.com 5 redirects s.nitropay.com
googleads.g.doubleclick.net
acdn.adnxs.com
9 dt.adsafeprotected.com d2emu.com
9 token.rubiconproject.com 5 redirects eus.rubiconproject.com
9 eus.rubiconproject.com groundcontrol.rendering.sharethrough.com
cadmus.script.ac
sync.inmobi.com
eus.rubiconproject.com
hbx.media.net
sync.cootlogix.com
8 pixel.tapad.com 6 redirects ggsoftware-d.openx.net
hbx.media.net
8 btlr.sharethrough.com s.nitropay.com
7 eb2.3lift.com 2 redirects s.nitropay.com
eb2.3lift.com
7 hbx.media.net s.nitropay.com
hbx.media.net
7 pbs.nitropay.com s.nitropay.com
d2emu.com
sync.inmobi.com
7 id5-sync.com 2 redirects s.nitropay.com
cdn.id5-sync.com
7 fonts.googleapis.com d2emu.com
s0.2mdn.net
6 static.adsafeprotected.com d2emu.com
fw.adsafeprotected.com
6 dsum-sec.casalemedia.com 4 redirects googleads.g.doubleclick.net
6 s.amazon-adsystem.com d2emu.com
sync.inmobi.com
6 x.bidswitch.net d2emu.com
u.openx.net
6 sync.1rx.io 4 redirects d2emu.com
cadmus.script.ac
6 googleads.g.doubleclick.net pagead2.googlesyndication.com
groundcontrol.rendering.sharethrough.com
cadmus.script.ac
6 securepubads.g.doubleclick.net s.nitropay.com
securepubads.g.doubleclick.net
d2emu.com
6 gum.criteo.com s.nitropay.com
static.criteo.net
gum.criteo.com
5 cs.media.net 1 redirects hbx.media.net
5 match.prod.bidr.io 3 redirects cadmus.script.ac
sync.inmobi.com
5 prebid.cootlogix.com s.nitropay.com
d2emu.com
5 ad.doubleclick.net d2emu.com
4 ssp-sync.criteo.com d2emu.com
4 tpc.googlesyndication.com d2emu.com
tpc.googlesyndication.com
4 fw.adsafeprotected.com 2 redirects d2emu.com
4 sync.cootlogix.com d2emu.com
s.nitropay.com
sync.cootlogix.com
u.openx.net
4 idsync.rlcdn.com d2emu.com
ggsoftware-d.openx.net
hbx.media.net
4 secure.adnxs.com 4 redirects cadmus.script.ac
4 secure-assets.rubiconproject.com 4 redirects
4 sync-tm.everesttech.net 2 redirects google-bidout-d.openx.net
d2emu.com
cadmus.script.ac
4 pr-bh.ybp.yahoo.com 4 redirects
4 rtb.openx.net s.nitropay.com
u.openx.net
4 a.ad.gt d2emu.com
p.ad.gt
4 ad-delivery.net btloader.com
d2emu.com
4 t.nit.ro s.nitropay.com
3 pxl.iqm.com hbx.media.net
3 contextual.media.net hbx.media.net
3 dpm.demdex.net 2 redirects d2emu.com
3 id.rlcdn.com 3 redirects u.openx.net
3 s.ad.smaato.net cadmus.script.ac
3 image6.pubmatic.com d2emu.com
ads.pubmatic.com
hbx.media.net
3 c1.adform.net 3 redirects cadmus.script.ac
3 cs.admanmedia.com 3 redirects
3 bh.contextweb.com 3 redirects d2emu.com
3 image8.pubmatic.com d2emu.com
cadmus.script.ac
sync.inmobi.com
3 seg.ad.gt p.ad.gt
3 p.ad.gt cdn.hadronid.net
p.ad.gt
3 257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com securepubads.g.doubleclick.net
3 cdn.hadronid.net 3 redirects
3 c.amazon-adsystem.com s.nitropay.com
c.amazon-adsystem.com
3 btloader.com s.nitropay.com
btloader.com
3 fonts.gstatic.com fonts.googleapis.com
3 cdnjs.cloudflare.com d2emu.com
cdnjs.cloudflare.com
s0.2mdn.net
3 s.nitropay.com d2emu.com
s.nitropay.com
2 medianet-match.dotomi.com 2 redirects
2 odr.mookie1.com d2emu.com
hbx.media.net
2 ad.turn.com 2 redirects
2 sync.ipredictive.com 2 redirects
2 px.ads.linkedin.com sync.inmobi.com
eb2.3lift.com
2 aax-eu.amazon-adsystem.com 1 redirects sync.inmobi.com
2 dsp.360yield.com 2 redirects
2 check.analytics.rlcdn.com s.nitropay.com
2 ads.pubmatic.com sync.inmobi.com
s.nitropay.com
2 t.adx.opera.com 2 redirects
2 ittpx.eskimi.com 2 redirects
2 csync.loopme.me 2 redirects
2 ap.lijit.com 2 redirects
2 inmobi-match.dotomi.com 2 redirects
2 match.deepintent.com 1 redirects sync.inmobi.com
2 pixel-sync.sitescout.com d2emu.com
2 b1sync.zemanta.com cadmus.script.ac
u.openx.net
2 i.clean.gg cadmus.script.ac
2 sync.srv.stackadapt.com 2 redirects cadmus.script.ac
u.openx.net
2 creativecdn.com d2emu.com
cadmus.script.ac
2 stx-match.dotomi.com 2 redirects d2emu.com
2 cms.quantserve.com 2 redirects cadmus.script.ac
2 ssbsync.smartadserver.com groundcontrol.rendering.sharethrough.com
d2emu.com
cadmus.script.ac
2 groundcontrol.rendering.sharethrough.com d2emu.com
cadmus.script.ac
2 oajs.openx.net 1 redirects d2emu.com
2 lb.eu-1-id5-sync.com cdn.id5-sync.com
2 lbs.eu-1-id5-sync.com cdn.id5-sync.com
2 api.btloader.com btloader.com
2 adx2.adform.net s.nitropay.com
2 prebid.media.net s.nitropay.com
2 exchange.postrelease.com s.nitropay.com
2 direct.adsrvr.org s.nitropay.com
2 grid-bidder.criteo.com s.nitropay.com
2 tlx.3lift.com s.nitropay.com
2 cdn.id5-sync.com s.nitropay.com
d2emu.com
2 www.google-analytics.com www.googletagmanager.com
2 www.googletagmanager.com d2emu.com
p.ad.gt
1 sync.outbrain.com hbx.media.net
1 c21lg-d.media.net hbx.media.net
1 p.rfihub.com 1 redirects
1 acdn.adnxs.com s.nitropay.com
1 ggsoftware-d.openx.net s.nitropay.com
1 code.createjs.com s0.2mdn.net
1 ajax.googleapis.com s0.2mdn.net
1 bis4.vidazoo.com static.vidazoo.com
1 syncv4.intentiq.com sync.inmobi.com
1 sync.intentiq.com 1 redirects
1 live.primis.tech 1 redirects
1 sync.a-mo.net sync.inmobi.com
1 ce.lijit.com sync.inmobi.com
1 pixel-us-east.rubiconproject.com 1 redirects
1 pippio.com sync.inmobi.com
1 www.temu.com 1 redirects
1 tracker-shr.ortb.net 1 redirects
1 cs.krushmedia.com sync.inmobi.com
1 cs.playdigo.com 1 redirects
1 sync.clearnview.com sync.inmobi.com
1 tr.blismedia.com sync.inmobi.com
1 us.ck-ie.com 1 redirects
1 sync.e-volution.ai 1 redirects
1 s2s.t13.io sync.inmobi.com
1 bisrtb.cootlogix.com d2emu.com
1 pghub.io groundcontrol.rendering.sharethrough.com
1 c.bing.com d2emu.com
eb2.3lift.com
1 u.openx.net d2emu.com
cadmus.script.ac
sync.cootlogix.com
1 b1sync.outbrain.com d2emu.com
1 bttrack.com d2emu.com
cadmus.script.ac
1 ssc-cms.33across.com 1 redirects
1 image2.pubmatic.com d2emu.com
1 ssp.disqus.com 1 redirects
1 static.vidazoo.com s.nitropay.com
1 cadmus.script.ac s.nitropay.com
1 google-bidout-d.openx.net oa.openxcdn.net
1 pixels.ad.gt p.ad.gt
1 ids4.ad.gt d2emu.com
1 lexicon.33across.com cdn-ima.33across.com
1 jadserve.postrelease.com 1 redirects
1 static.criteo.net securepubads.g.doubleclick.net
1 oa.openxcdn.net securepubads.g.doubleclick.net
1 cdn-ima.33across.com d2emu.com
1 tags.crwdcntrl.net d2emu.com
1 secure.cdn.fastclick.net d2emu.com
1 config.aps.amazon-adsystem.com c.amazon-adsystem.com
1 consent.nitrocnct.com s.nitropay.com
1 geo.privacymanager.io ats-wrapper.privacymanager.io
1 ag.dns-finder.com btloader.com
1 floors.nitropay.com s.nitropay.com
1 id.crwdcntrl.net s.nitropay.com
1 api.rlcdn.com s.nitropay.com
1 id.hadron.ad.gt s.nitropay.com
1 ats-wrapper.privacymanager.io s.nitropay.com
1 static.cloudflareinsights.com d2emu.com
0 ep1.adtrafficquality.google Failed pagead2.googlesyndication.com
0 idpix.media6degrees.com Failed u.openx.net
0 pandg.tapad.com Failed pghub.io
0 bpi.rtactivate.com Failed hbx.media.net
0 sync.taboola.com Failed hbx.media.net
0 sync.aniview.com Failed hbx.media.net
0 partners.tremorhub.com Failed hbx.media.net
0 sync.bfmio.com Failed hbx.media.net
0 wt.rqtrk.eu Failed pxl.iqm.com
0 cs.iqzone.com Failed hbx.media.net
0 thrtle.com Failed eb2.3lift.com
0 pbs.yahoo.com Failed sync.inmobi.com
eb2.3lift.com
0 sync.adkernel.com Failed sync.inmobi.com
0 cs.lkqd.net Failed googleads.g.doubleclick.net
0 i.liadm.com Failed d2emu.com
0 hb.yahoo.net Failed d2emu.com
0 sid.storygize.net Failed d2emu.com
498 175

This site contains links to these domains. Also see Links.

Domain
nitropay.com
discord.gg
adssettings.google.com
Subject Issuer Validity Valid
d2emu.com
WE1
2025-06-14 -
2025-09-12
3mo crt.sh
*.google-analytics.com
WR2
2025-07-07 -
2025-09-29
3mo crt.sh
*.g.doubleclick.net
WR2
2025-07-07 -
2025-09-29
3mo crt.sh
nitropay.com
WE1
2025-07-01 -
2025-09-29
3mo crt.sh
upload.video.google.com
WR2
2025-07-07 -
2025-09-29
3mo crt.sh
cdnjs.cloudflare.com
WE1
2025-07-20 -
2025-10-18
3mo crt.sh
cloudflareinsights.com
WE1
2025-06-25 -
2025-09-23
3mo crt.sh
*.gstatic.com
WR2
2025-07-07 -
2025-09-29
3mo crt.sh
btloader.com
WE1
2025-07-30 -
2025-10-28
3mo crt.sh
*.privacymanager.io
Amazon RSA 2048 M03
2025-05-26 -
2026-06-23
1yr crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-06-25 -
2025-09-25
3mo crt.sh
id.hadron.ad.gt
WE1
2025-07-12 -
2025-10-10
3mo crt.sh
id5-sync.com
E5
2025-07-01 -
2025-09-29
3mo crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2025-02-06 -
2026-03-05
1yr crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M04
2025-08-09 -
2026-09-07
1yr crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2025-03-19 -
2026-04-02
1yr crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M03
2024-11-19 -
2025-12-18
1yr crt.sh
*.nit.ro
WR3
2025-07-09 -
2025-10-07
3mo crt.sh
*.nitropay.com
WR3
2025-07-25 -
2025-10-23
3mo crt.sh
dns-finder.com
WR3
2025-07-10 -
2025-10-08
3mo crt.sh
ad-delivery.net
WE1
2025-07-04 -
2025-10-02
3mo crt.sh
*.doubleclick.net
WR2
2025-07-07 -
2025-09-29
3mo crt.sh
nitrocnct.com
WE1
2025-08-06 -
2025-11-04
3mo crt.sh
*.3lift.com
Amazon RSA 2048 M02
2025-02-10 -
2026-03-11
1yr crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2025-02-21 -
2026-03-23
1yr crt.sh
*.postrelease.com
Amazon RSA 2048 M02
2024-09-25 -
2025-10-23
1yr crt.sh
prebid.media.net
WR3
2025-07-19 -
2025-10-17
3mo crt.sh
track.adform.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-09-03 -
2025-09-24
1yr crt.sh
*.cootlogix.com
Starfield Secure Certificate Authority - G2
2024-10-13 -
2025-10-13
1yr crt.sh
*.sharethrough.com
DigiCert Global G3 TLS ECC SHA384 2020 CA1
2025-07-17 -
2026-08-17
1yr crt.sh
*.openx.net
RapidSSL TLS RSA CA G1
2024-08-14 -
2025-08-18
1yr crt.sh
api.btloader.com
WR3
2025-07-25 -
2025-10-23
3mo crt.sh
eu-1-id5-sync.com
R11
2025-07-01 -
2025-09-29
3mo crt.sh
config.aps.amazon-adsystem.com
Amazon RSA 2048 M02
2024-12-22 -
2026-01-21
1yr crt.sh
secure.cdn.fastclick.net
DigiCert Global G3 TLS ECC SHA384 2020 CA1
2025-06-08 -
2026-06-09
1yr crt.sh
*.33across.com
Sectigo RSA Domain Validation Secure Server CA
2024-09-05 -
2025-09-30
1yr crt.sh
oa.openxcdn.net
WR3
2025-07-10 -
2025-10-08
3mo crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-06-12 -
2025-09-04
3mo crt.sh
lexicon.33across.com
WR3
2025-06-17 -
2025-09-15
3mo crt.sh
p.ad.gt
WE1
2025-07-30 -
2025-10-28
3mo crt.sh
*.ad.gt
Amazon RSA 2048 M03
2025-02-08 -
2026-03-09
1yr crt.sh
*.rendering.sharethrough.com
Amazon RSA 2048 M03
2025-07-28 -
2026-08-26
1yr crt.sh
seg.ad.gt
WE1
2025-06-28 -
2025-09-26
3mo crt.sh
a.ad.gt
WE1
2025-07-27 -
2025-10-25
3mo crt.sh
pixels.ad.gt
WE1
2025-06-27 -
2025-09-25
3mo crt.sh
sync.inmobi.com
Sectigo RSA Organization Validation Secure Server CA
2025-04-29 -
2026-04-29
1yr crt.sh
script.ac
E5
2025-08-10 -
2025-11-08
3mo crt.sh
*.vidazoo.com
Starfield Secure Certificate Authority - G2
2025-03-23 -
2026-03-23
1yr crt.sh
*.smartadserver.com
DigiCert Global G3 TLS ECC SHA384 2020 CA1
2025-01-09 -
2026-02-09
1yr crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1
2025-03-06 -
2026-04-03
1yr crt.sh
*.1rx.io
Sectigo Public Server Authentication CA DV R36
2025-06-23 -
2026-07-24
1yr crt.sh
*.pubmatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2025-02-19 -
2026-03-22
1yr crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA
2025-03-06 -
2026-04-01
1yr crt.sh
pghub.io
WR3
2025-06-18 -
2025-09-16
3mo crt.sh
i.clean.gg
WR3
2025-06-17 -
2025-09-15
3mo crt.sh
s2s.t13.io
WR3
2025-07-01 -
2025-09-29
3mo crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2
2024-12-06 -
2026-01-07
1yr crt.sh
tr.blismedia.com
WR3
2025-07-10 -
2025-10-08
3mo crt.sh
clearnview.com
Go Daddy Secure Certificate Authority - G2
2025-01-15 -
2025-10-07
9mo crt.sh
*.match.prod.bidr.io
Amazon RSA 2048 M03
2024-10-27 -
2025-11-24
1yr crt.sh
*.krushmedia.com
Go Daddy Secure Certificate Authority - G2
2024-10-20 -
2025-11-21
1yr crt.sh
*.analytics.rlcdn.com
Amazon RSA 2048 M03
2025-03-10 -
2026-04-08
1yr crt.sh
fw.adsafeprotected.com
Amazon RSA 2048 M02
2025-01-28 -
2026-02-27
1yr crt.sh
tpc.googlesyndication.com
WR2
2025-07-07 -
2025-09-29
3mo crt.sh
static.adsafeprotected.com
Amazon RSA 2048 M04
2025-03-26 -
2026-04-25
1yr crt.sh
tls.adobe.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-12-13 -
2026-01-13
1yr crt.sh
*.media.net
DigiCert TLS RSA SHA256 2020 CA1
2024-10-23 -
2025-10-22
1yr crt.sh
cdn.adnxs.com
GeoTrust TLS RSA CA G1
2025-04-28 -
2026-05-29
1yr crt.sh
analytics.tapad.com
WR3
2025-08-09 -
2025-11-07
3mo crt.sh
dt.adsafeprotected.com
Amazon RSA 2048 M03
2025-03-09 -
2026-04-07
1yr crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2025-03-16 -
2025-09-16
6mo crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 07
2025-06-12 -
2025-12-09
6mo crt.sh
pxl.iqm.com
E5
2025-06-17 -
2025-09-15
3mo crt.sh
*.outbrain.com
Thawte TLS RSA CA G1
2024-11-13 -
2025-12-02
1yr crt.sh

This page contains 45 frames:

Primary Page: https://d2emu.com/
Frame ID: 2614A2D781DE65B52FF7C2D86BC8FE5F
Requests: 145 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250805/r20190131/zrt_lookup_fy2021.html
Frame ID: 079F9EB26B69DF16D3282ED2A0594FFE
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&gpp=GPP_ERROR_STRING_EXPECTED_APPLICATION_SECTION_ARRAY&client=ca-pub-7278173261118542&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1754950356&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fd2emu.com%2F&pra=5&wgl=1&aihb=0&aiudt=1&asro=0&aifxl=29_18~30_19&aiapm=0.1542&aiapmd=0.25178&aiapmi=0.16&aiapmid=1&aiact=0.5423&aiactd=0.7&aicct=0.7&aicctd=0.5799&ailct=0.5849&ailctd=0.65&aimart=4&aimartd=4&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1754950354702&bpp=24&bdt=682&idt=1313&shv=r20250805&mjsv=m202508060101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=1496790140650&frm=20&pv=2&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=95362655%2C95366795%2C95366912%2C95368520%2C95359266&oid=2&pvsid=6923490710862463&tmod=1092811656&uas=0&nvt=1&fsapi=1&fc=1920&brdim=390%2C390%2C390%2C390%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=1336
Frame ID: A6953538A0759263681C2C72C5A5CE81
Requests: 1 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=6278260873756672&tid=JjPTNd623-33xtL7NC9-989b314d02&upapi=true
Frame ID: 81A23DFA8A29E40A23B5B195A030CBF4
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: D9EDF40DA6A9353ED51CF66D7BABFE14
Requests: 1 HTTP requests in this frame

Frame: https://257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: D409E3956B3034B6830377F70359FDEC
Requests: 1 HTTP requests in this frame

Frame: https://257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: C164C6A09D4D755855689E7F74CBF8B0
Requests: 1 HTTP requests in this frame

Frame: https://groundcontrol.rendering.sharethrough.com/gc.js
Frame ID: CC8F36D7920644CC82C2EC4396D8DEE7
Requests: 11 HTTP requests in this frame

Frame: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Frame ID: 29E710618BED992D6DE152D821674E5A
Requests: 35 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: EFB0083E080D1A21F00487D976CF4AED
Requests: 6 HTTP requests in this frame

Frame: https://257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: 4AF61D5636DD7AC3C3D26308763C19B9
Requests: 1 HTTP requests in this frame

Frame: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Frame ID: BF9758D4F53B156899A1B1B1832F6B09
Requests: 35 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Frame ID: EEF76E03EA6D52C1562D0180413D9151
Requests: 6 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Frame ID: 60FE5AAB49841C48FD79F9B708225632
Requests: 4 HTTP requests in this frame

Frame: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Frame ID: 843A58DFC4406D0EA10D0E0A9BF6940C
Requests: 32 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjXiKbAAjAB&v=APEucNVLOBkYRhi_Yo87vTIF_DCeWkUitoDpkpQmS5xY9gt54ZggJO0PwtlEzsFvAifJwAnIYk3GU9Qdz4tXbTYo6mULeF95qA
Frame ID: 5AACD696DCF9226ADE1CBCBB12FD8CC6
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 2E6F07DF7158D3D34B10A98C3AF1D0E5
Requests: 20 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=d2emu.com&gpp=&gpp_sid=
Frame ID: 97D5E1B5E4E1275DB6529C030FE116B5
Requests: 2 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Frame ID: 1744B4A858D807F5D3BA66A6D061E014
Requests: 28 HTTP requests in this frame

Frame: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Frame ID: 17896C9D731F75F837B493752212FD3A
Requests: 6 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Frame ID: 0F71D130A79E57094F3D69756E8216DB
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjLpre8AjAB&v=APEucNU33tvchzlj0din_ukxzFtkAWRUoNCkmwdy6kMNqLvrJL72TlrcuFsDg66iZLLqtqAHlFZahLF7zKB0_MneBc5Il9PK3LLTEtUgcoyfQ1n6SWSniPY
Frame ID: 0FAB4A446A2AAAB05140B86AE42CFA1A
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: F0B6C72C757616457D06C87A66C2B13F
Requests: 20 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=inmobi&endpoint=us-east
Frame ID: DC6292D904A96737BE93853E0D1957D4
Requests: 20 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159035&gdpr=0&gdpr_consent=&userIdMacro=(PM_UID)&predirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-SEA-76%26dspUserId%3D(PM_UID)
Frame ID: 2162BE1E0880F41B6B2BB88B6305F4BC
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1---&predirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Frame ID: BEAAE69B4CB219230E182B7538026424
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: CBAC60CB2A6577A5D3B3D094E35778DE
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: F2BB5459ED3D15886B729C4AE4B4D2E3
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253
Frame ID: 4E95E2602164BB4ED5A40AF516F2F496
Requests: 11 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Frame ID: 57F4C12509178CF2AE238026451E497E
Requests: 12 HTTP requests in this frame

Frame: https://btloader.com/trustedIframe.html?o=6278260873756672&tid=JjPTNd623-33xtL7NC9-989b314d02&upapi=true
Frame ID: 9FA5A5DD77C39155BF2B450723B493D9
Requests: 1 HTTP requests in this frame

Frame: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Frame ID: 4E72FEE7AFDD3FA1A08A8AEDC5EF0917
Requests: 7 HTTP requests in this frame

Frame: https://hbx.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU87559X&prvid=2034%2C2155%2C2033%2C2076%2C2075%2C2030%2C590%2C2073%2C273%2C233%2C2028%2C2027%2C2104%2C2026%2C236%2C676%2C2025%2C237%2C117%2C636%2C55%2C99%2C2045%2C2120%2C3011%2C3010%2C2041%2C122%2C201%2C2039%2C4%2C521%2C126%2C203%2C523%2C326%2C404%2C9%2C407%2C2011%2C2055%2C2099%2C3020%2C294%2C251%2C2009%2C178%2C255%2C3018%2C653%2C2125%2C214%2C2124%2C413%2C3014%2C338%2C459%2C77%2C2144%2C2022%2C182%2C262%2C3073%2C461%2C222%2C542%2C301%2C345%2C225%2C10000%2C624%2C80%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Frame ID: F49C33966A6263AA3F560EE02A74A3B4
Requests: 30 HTTP requests in this frame

Frame: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1---&coppa=0
Frame ID: 260D29045271F11D25247EC23486B89F
Requests: 4 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=d2emu.com&us_privacy=1---&gpp=
Frame ID: 78131EF8AD4724F82D67794DDA3FC5F7
Requests: 2 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?us_privacy=1---&
Frame ID: DE306A5BE811D0F47FB8B5C28285809C
Requests: 11 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: B10A3E663929C1B9A63311E41EAA2D15
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.4.js
Frame ID: 3F21CA4D371EC3E17DAA76C2D01AFCA2
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.6.4.js
Frame ID: EE41D971A1F1961B0A87ABB5B96ABCBD
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/cksync.html?cs=8&vsid=3979519634066922000V10&type=rkt&refUrl=&vid=3979519634066922000V10&axid_e=&ovsid=1783777349569458445
Frame ID: 3DEF0D5EC69581F119E40A67F5F69A09
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=medianet
Frame ID: 542821A9707FF5F74BC29EC639AE9DD5
Requests: 4 HTTP requests in this frame

Frame: https://hbx.media.net/cksync.html?cs=8&vsid=3979519634066922000V10&type=ppt&refUrl=&vid=49503640853979519634066922000V10&axid_e=&ovsid=B1s4UYBYqrm1&ev=1&pid=560210
Frame ID: 5256711703AAE373FDEA6B405660CE8B
Requests: 1 HTTP requests in this frame

Frame: https://pandg.tapad.com/tag?us_privacy=1---&referrer_url=https%3A%2F%2Fd2emu.com%2F&page_url=https%3A%2F%2Fd2emu.com%2F&owner=P%26G&bp_id=sharethrough&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js
Frame ID: 14A9553ED4E565E8E62BA818B3B163EA
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---
Frame ID: B47A43A6E48805AD39B13AFA409B7E24
Requests: 8 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Frame ID: B5323A14638029E9DE3EE85EC5A2474A
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

D2Emu

Page URL History Show full URLs

  1. http://d2emu.com/ HTTP 307
    https://d2emu.com/ Page URL

Detected technologies

(Advertising)
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

(Analytics)
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • 2mdn\.net

(Font scripts)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

(Advertising)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net

(Analytics)
Overall confidence: 100%
Detected patterns

(Font scripts)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

(Tag managers)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

(Advertising)
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

(JavaScript libraries)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

498
Requests

60 %
HTTPS

0 %
IPv6

109
Domains

175
Subdomains

115
IPs

7
Countries

3881 kB
Transfer

11429 kB
Size

193
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://d2emu.com/ HTTP 307
    https://d2emu.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51
  • https://cdn.hadronid.net/hadron.js?partner_id=720&_it=prebid HTTP 301
  • https://a.ad.gt/api/v1/u/matches/720?_it=nitro
Request Chain 75
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fpbs.nitropay.com%252Fsetuid%253Fbidder%253Dappnexus%2526gdpr%253D%2526gdpr_consent%253D%2526gpp%253D%2526gpp_sid%253D%2526f%253Di%2526uid%253D%2524UID HTTP 302
  • https://pbs.nitropay.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1820804327581032944
Request Chain 98
  • https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fd2emu.com%2F&ref=&_it=amazon&partner_id=720 HTTP 301
  • https://a.ad.gt/api/v1/u/matches/720?_it=nitro
Request Chain 105
  • https://jadserve.postrelease.com/suid/101787?gdpr=&gdpr_consent=&us_privacy=1---&ntv_gpp_consent=&ntv_r=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dnativo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3DNTV_USER_ID HTTP 302
  • https://pbs.nitropay.com/setuid?bidder=nativo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=348a1407-ed92-4fcf-a8e7-6746b2b37265
Request Chain 107
  • https://cdn.hadronid.net/hadron.js?partner_id=720&sync=1&url=https%3A%2F%2Fd2emu.com%2F HTTP 301
  • https://a.ad.gt/api/v1/u/matches/720?_it=nitro
Request Chain 111
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fd2emu.com%2F&rid=esp HTTP 302
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fd2emu.com%2F&rid=esp&cc=1
Request Chain 125
  • https://sync.inmobi.com/prebid?gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D HTTP 302
  • https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry= HTTP 302
  • https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Request Chain 134
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELIx9ThBKyNZIY4VNJc4RhA&google_cver=1
Request Chain 136
  • https://match.adsrvr.org/track/cmf/openx?oxid=365fdd56-c15f-7ddb-ce13-68295fbfdc6a&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=46f4af91-2ba3-4305-896c-c258960d2f82&ttd_puid=365fdd56-c15f-7ddb-ce13-68295fbfdc6a&gdpr=0&gdpr_consent=
Request Chain 137
  • https://pr-bh.ybp.yahoo.com/sync/openx/a298bb12-51f3-ef92-ffc4-7edca0e81123?gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-HpvP6JJE2p_e6S5OpetwHNwjlXC_9_Aep.k-~A
Request Chain 138
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aJpq1wACzIfGmAAz
Request Chain 144
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=18694&gdpr=0&gdpr_consent= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Request Chain 145
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Request Chain 146
  • https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D7rkJAhPCWXbw9Lq5dZxc6TvN%26source_user_id%3D%24UID&partner=sharethrough HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=7rkJAhPCWXbw9Lq5dZxc6TvN&source_user_id=ua-81fd56b2-48f1-3e89-8216-09777d0f25b1
Request Chain 148
  • https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGRHhFN1JOTllBQUJ2MWhsQzQ2Zw&gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Cdtech%2Csas%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Cdtech%2Csas%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAFDxE7RNNYAABv1hlC46g&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cdtech%252Csas%252Cshr%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2
Request Chain 149
  • https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=&__qcmcs=1 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=S_zZ4UulhLhQ8tK2S6DNuE_x0bBQodOwSaXIxgq6
Request Chain 152
  • https://sync.1rx.io/usersync2/rmpssp?sub=sharethrough HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=175kELn9xvfXoe3C4qjRaWS8&source_user_id=OPTOUT
Request Chain 153
  • https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=MWQyMjcwNGEtZjg2NS00ZGRmLTliYzgtOTQ2YjM3OTc1YjNj HTTP 302
  • https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
Request Chain 154
  • https://stx-match.dotomi.com/match/bounce/current?networkId=44410&version=1&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&gdpr=0&gdpr_consent= HTTP 302
  • https://stx-match.dotomi.com/match/bounce/current?DotomiTest=6a2c8911d26d245a&is_secure=true&networkId=44410&version=1&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AQANl1Yt18fOLAJg1FNiAQEBAQEBAQCZmjBfhwEBAQEBAQEB&expiration=1755036760&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 155
  • https://bh.contextweb.com/bh/rtset?pid=558357&ev=1&rurl=https%3a%2f%2fmatch.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&source_user_id=%%VGUID%% HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=B1s4UYBYqrm1&pid=558357
Request Chain 156
  • https://ssc-cms.33across.com/ps/?ri=0013300001kQj2HAAS&ru=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DkzFyzzqXEqukMDumpVLB6Eq3%26source_user_id%3D33XUSERID33X HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=212978335208556
Request Chain 158
  • https://pr-bh.ybp.yahoo.com/sync/sharethrough/1d22704a-f865-4ddf-9bc8-946b37975b3c?gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=BVbSRuzbUWjBEF6bQrmLHKkX&source_user_id=y-EVuEv7FE2oPC9UqtYnNSn7p5p3V24nR_tgAznSa.cuLe~A
Request Chain 159
  • https://creativecdn.com/cm-notify?pi=sharethrough&gdpr=0&gdpr_consent= HTTP 302
  • https://creativecdn.com/cm-notify?pi=sharethrough&gdpr=0&gdpr_consent=&tc=1
Request Chain 160
  • https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-391c8d83-49a2-59f3-794f-ad0abf692754$ip$212.104.215.93&gdpr=0&gdpr_consent=
Request Chain 161
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4T9T-1O-JASD&gdpr=0
Request Chain 162
  • https://cs.admanmedia.com/c01d0246d79eba64b8a7cca07e5b7dc7.gif?puid=1d22704a-f865-4ddf-9bc8-946b37975b3c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DqUVJTHutDLcyGRS8xfsW2M4g%26source_user_id%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=88798587-ae47-45e5-8b6c-76f0348c4a57&gdpr=0&gdpr_consent=
Request Chain 163
  • https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=1294&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=6765784818800077139&gdpr=0&gdpr_consent=
Request Chain 164
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1820804327581032944
Request Chain 165
  • https://match.deepintent.com/usersync/158 HTTP 303
  • https://match.sharethrough.com/sync/v1?source_id=4rQWDMHEFSdfRbtp7Kei6UsB&source_user_id=di_ccdebe26368d40c2bcad0
Request Chain 166
  • https://s.ad.smaato.net/c/?adExInit=s&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DxTFJbLbs37tyhbKsPP9VC2cm%26source_user_id%3D%24UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=35667f21a0
Request Chain 167
  • https://b1sync.zemanta.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D HTTP 302
  • https://b1sync.outbrain.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D&s=2
Request Chain 168
  • https://sync-tm.everesttech.net/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A&_test=aJpq2QAAAKSsrgAs
Request Chain 187
  • https://id5-sync.com/i/1528/8.gif?o=api&id5id=ID5*ESG_VeiFtRvXzmvpS9-jfwX1znfhpTLUa4v6OAsRPCs8H6H9kimRfaF5J12lGy6j&gdpr_consent=undefined&gdpr=false HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/1528/108/7/2.gif?puid=872f1004-f090-468e-85e1-7f0850cb1387&gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F429%2F6%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D
Request Chain 194
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Request Chain 211
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Request Chain 212
  • https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-391c8d83-49a2-59f3-794f-ad0abf692754$ip$212.104.215.93&gdpr=0&gdpr_consent=
Request Chain 217
  • https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=6765784818800077139&gdpr=0&gdpr_consent=
Request Chain 218
  • https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent= HTTP 303
  • https://bh.contextweb.com/bh/rtset?ev=AAFDxE7RNNYAABv1hlC46g&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Ddtech%252Csas%252Cshr%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dshr%26bee_sync_hop_count%3D1&gdpr=0
Request Chain 219
  • https://sync-tm.everesttech.net/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A&_test=aJpq2QACzBL6XQAz
Request Chain 220
  • https://bttrack.com/pixel/cookiesyncredir?rurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DFGhqNjC2WnFmmvNpTL32LMME%26source_user_id%3D%7Bglobalid%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=45f8f828-bb98-4aa4-953b-2f569a26479c&gdpr=0&gdpr_consent=
Request Chain 221
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=7ead435e-a2cd-4cbf-8876-adb66822613f&ph=c6b01e12-aa62-4ae6-9e10-71346e597c31&r=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DF2Stothm3wg5g6opTuaPadz9%26source_user_id%3D HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=f83c286b-731b-4036-8bb8-4e6355747e02
Request Chain 222
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1820804327581032944
Request Chain 223
  • https://s.ad.smaato.net/c/?adExInit=s&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DxTFJbLbs37tyhbKsPP9VC2cm%26source_user_id%3D%24UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=35667f21a0
Request Chain 224
  • https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=S_zZ4UulhLhQ8tK2S6DNuE_x0bBQodOwSaXIxgq6
Request Chain 225
  • https://b1sync.zemanta.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D HTTP 302
  • https://b1sync.outbrain.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D&s=2
Request Chain 228
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=18694&gdpr=0&gdpr_consent= HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Request Chain 231
  • https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=NTlhN2Q1NzQtMWUzZS00ODYzLTlhNDEtOWYxOThhYmNlZGU0 HTTP 302
  • https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
Request Chain 232
  • https://cs.admanmedia.com/c01d0246d79eba64b8a7cca07e5b7dc7.gif?puid=59a7d574-1e3e-4863-9a41-9f198abcede4&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DqUVJTHutDLcyGRS8xfsW2M4g%26source_user_id%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=88798587-ae47-45e5-8b6c-76f0348c4a57&gdpr=0&gdpr_consent=
Request Chain 233
  • https://stx-match.dotomi.com/match/bounce/current?networkId=44410&version=1&nuid=59a7d574-1e3e-4863-9a41-9f198abcede4&gdpr=0&gdpr_consent= HTTP 302
  • https://stx-match.dotomi.com/match/bounce/current?DotomiTest=aa728c0eac807c7&is_secure=true&networkId=44410&version=1&nuid=59a7d574-1e3e-4863-9a41-9f198abcede4&gdpr=0&gdpr_consent=
Request Chain 234
  • https://pr-bh.ybp.yahoo.com/sync/sharethrough/59a7d574-1e3e-4863-9a41-9f198abcede4?gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=BVbSRuzbUWjBEF6bQrmLHKkX&source_user_id=y-EVuEv7FE2oPC9UqtYnNSn7p5p3V24nR_tgAznSa.cuLe~A
Request Chain 244
  • https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm HTTP 302
  • https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEF-1kxQFgYLbbfGb50g4NGI&google_cver=1
Request Chain 246
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1&C=1
Request Chain 247
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aJpq2NHM7G4AM-0mAASYIgAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1
Request Chain 254
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-nitro&gdpr=&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://pbs.nitropay.com/setuid?bidder=rubicon&uid=ME7O4T9T-1O-JASD&us_privacy=1---
Request Chain 256
  • https://s.amazon-adsystem.com/dcm?pid=eea9dd1e-d48b-4df9-9291-35dc5c187623&id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41 HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=eea9dd1e-d48b-4df9-9291-35dc5c187623&id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&dcc=t
Request Chain 259
  • https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_cm HTTP 302
  • https://sync.inmobi.com/gob?google_gid=CAESEAwvIeS78AsS2NtPa_gICyM&google_cver=1 HTTP 302
  • https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=&retry= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_hm=NFuTDGaON6wxcVMgDqxV&google_push=&google_nid=inmobi_new_eb
Request Chain 260
  • https://s.ad.smaato.net/c/?dspInit=1001980&dspCookie=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&gdpr=0&gdpr_consent= HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=35667f21a0&gdpr=0&gdpr_consent=
Request Chain 261
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=g6nxmp9&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=21&dspUserId=46f4af91-2ba3-4305-896c-c258960d2f82
Request Chain 262
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3535&partner_device_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26dspUserId%3D%24%7BTA_DEVICE_ID%7D HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3535&partner_device_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26dspUserId%3D%24%7BTA_DEVICE_ID%7D HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%252Chttps%25253A%25252F%25252Fsync.inmobi.com%25252Fsetuid%25253FbidderID%25253D877%252526dspUserId%25253D5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=46f4af91-2ba3-4305-896c-c258960d2f82&ttd_puid=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%2Chttps%253A%252F%252Fsync.inmobi.com%252Fsetuid%253FbidderID%253D877%2526dspUserId%253D5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%2C HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=877&dspUserId=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2
Request Chain 264
  • https://x.bidswitch.net/sync?ssp=aerserv&user_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&gdpr=0&gdpr_pd=&gdpr_consent=&us_privacy=&expires=30 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=aerserv&user_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&gdpr=0&gdpr_pd=&gdpr_consent=&us_privacy=&expires=30 HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=aerserv HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=6765784818800077139&ssp=aerserv HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=128&dspUserId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=&gdpr_consent=&us_privacy=
Request Chain 265
  • https://b1sync.zemanta.com/usersync/inmobi/?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://b1sync.outbrain.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=0&gdpr_consent=&puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&s=2&us_privacy= HTTP 302
  • https://b1sync.zemanta.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=0&gdpr_consent=&obuid=77d863ca-bfff-42bb-bef2-b31e4a21b32e&puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&s=2&us_privacy= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=210&dspUserId=__ZUID__&gdpr=0
Request Chain 266
  • https://sync.e-volution.ai/a184e2218ea9f18e32c70fb304405e72.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D957%26dspUserId%3D%5BUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=957&dspUserId=6229211d-0d72-4f2b-9961-12e744f31ad2
Request Chain 267
  • https://inmobi-match.dotomi.com/match/bounce/current?networkId=98193&version=1&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41 HTTP 302
  • https://inmobi-match.dotomi.com/match/bounce/current?DotomiTest=88cf87774452482&is_secure=true&networkId=98193&version=1&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41 HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQAN-WQ7mAlNOAIisdm-AQEBAQEBAQCZmjBhcAEBAQEBAQEB&expiration=1755036761&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&is_secure=true
Request Chain 268
  • https://id.rlcdn.com/713074.gif HTTP 307
  • https://id.rlcdn.com/1000.gif?memo=CPLCKxoNCNnV6cQGEgUI6AcQAEIASgA HTTP 307
  • https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
Request Chain 269
  • https://ib.adnxs.com/getuid?https://sync.inmobi.com/setuid?bidderID=32&dspUserId=$UID HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=32&dspUserId=1820804327581032944
Request Chain 271
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D13%26dspUserId%3D%24UID HTTP 307
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D13%26dspUserId%3D%24UID&sovrn_retry=true HTTP 307
  • https://sync.inmobi.com/setuid?bidderID=13&dspUserId=LJpUALZH0jc6F_obRdi4dmiK
Request Chain 272
  • https://csync.loopme.me/?pubid=9724&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D109%26dspUserId%3D%7Bviewer_token%7D HTTP 307
  • https://sync.inmobi.com/setuid?bidderID=109&dspUserId=5ea36180-cebc-480b-bcb4-3a31720da973&gdpr_consent=null&gdpr=0
Request Chain 273
  • https://us.ck-ie.com/inmslw82.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-893%26dspUserId%3D%7B%24PARTNER_UID%7D HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=695a1446c371f7aca17ed314b8fb32c5d1edf8c1b244151f7b215022f82da6fb
Request Chain 275
  • https://s.ad.smaato.net/c/?adExInit=inmobi&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=82&dspUserId=35667f21a0
Request Chain 276
  • https://sync.1rx.io/usersync2/inmobi&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=23&dspUserId=OPTOUT
Request Chain 278
  • https://sync.srv.stackadapt.com/sync?nid=138&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=238&dspUserId=ORyNg0miWfN5T60Kv2knVNRo110
Request Chain 280
  • https://cs.playdigo.com/dd3f91b3168664e47ebd1aec9512abd4.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1302%26dspUserId%3D%5BUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=3de35a0e-0366-47b1-8d74-03e4d468c2ac
Request Chain 282
  • https://creativecdn.com/cm-notify?pi=inmobi&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=16&dspUserId=C_pgKG0SJyaTO2kRskKQqfAgRR42lsxfV5mM_0IMmTI&pi=inmobi&gdpr=0&gdpr_consent=
Request Chain 284
  • https://tracker-shr.ortb.net/sync?id=1&uid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41 HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=276&dspUserId=35243110-c923-213f-a837-46529640c5a0
Request Chain 285
  • https://ittpx.eskimi.com/sync?sp_id=64&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://ittpx.eskimi.com/sync?gdpr=0&gdpr_consent=&sp_id=64&us_privacy=&er=true HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=814&dspUserId=54c8201b-19af-4941-aed7-0719576a8192
Request Chain 286
  • https://t.adx.opera.com/pub/sync?pubid=pub6871903319744&gdpr=0&consent=&us_privacy= HTTP 302
  • https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=d900db5100c47272&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub6871903319744 HTTP 302
  • https://t.adx.opera.com/sync?vendor=60369&pubid=pub6871903319744 HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU162408b591a6480d9e8c41fd2e71c520
Request Chain 287
  • https://cs.admanmedia.com/e03deca3316b700a1ce99c41e324fd03.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D149%26dspUserId%3D%5BUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=149&dspUserId=88798587-ae47-45e5-8b6c-76f0348c4a57
Request Chain 288
  • https://idsync.rlcdn.com/713113.gif?partner_uid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41 HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=13fc8101735d79d229ecc42073f5fc7620c9d4d4ab563c51bca28431c680543f791426b5417dce21&_=2
Request Chain 293
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESECWS8E5JJYGfBKWejEDvxdM&google_cver=1
Request Chain 294
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMDgwNDMyNzU4MTAzMjk0NA%3D%3D&gdpr=0
Request Chain 295
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_dbm&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
Request Chain 296
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=&gdpr=0
Request Chain 298
  • https://sync.1rx.io/usersync2/rmpssp?sub=equativ&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D162%26partneruserid%3D%5BRX_UUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=162&partneruserid=OPTOUT
Request Chain 299
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3212965387357049904&gdpr=0&gdpr_consent=
Request Chain 300
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
Request Chain 301
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzIxMjk2NTM4NzM1NzA0OTkwNA==&gdpr=0&gdpr_consent=
Request Chain 306
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
Request Chain 307
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7bcba429-649b-4b69-8a63-804b304b8743&gdpr_consent=null&gdpr=0
Request Chain 308
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=B1s4UYBYqrm1&ev=1&pid=560288&gdpr_consent=&gdpr=0
Request Chain 309
  • https://dsp.360yield.com/dsp_match/275?ssp=45&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D85%26partneruserid%3D$%7BDSP_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://dsp.360yield.com/ul_cb/dsp_match/275?ssp=45&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D85%26partneruserid%3D$%7BDSP_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=85&partneruserid=ad12ddb7-6beb-4883-b852-29574b3c9423&gdpr=0&gdpr_consent=
Request Chain 332
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=inmobi&gdpr_consent=1---&khaos=ME7O4SXT-16-H440 HTTP 302
  • https://sync.inmobi.com/setuid?bidderID=52&dspUserId=ME7O4SXT-16-H440&gdpr_consent=1---
Request Chain 334
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr_consent=1--- HTTP 302
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr_consent=1---&dcc=t
Request Chain 335
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr_consent=1--- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTJkYmU1NWQ2ZjFhZjVkNTg4NGMxODA1M2E4ODNhYWNjNDc0NGVmNQ&gdpr_consent=1---
Request Chain 336
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr_consent=1--- HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr_consent=1---&dcc=t
Request Chain 337
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr_consent=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&expires=30
Request Chain 338
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr_consent=1--- HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=ME7O4T9T-1O-JASD&ex=d-rubiconproject.com&status=ok&gdpr_consent=1---
Request Chain 339
  • https://token.rubiconproject.com/token?pid=36584&gdpr_consent=1--- HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=ME7O4T9T-1O-JASD&gdpr_consent=1---
Request Chain 340
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&gdpr_consent=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr_consent=1---&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
Request Chain 341
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr_consent=1--- HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/9jCc04tyo1t-2Hu-tO__7cn5EUdSAgOZEtemQ7w0kco?csrc=&gdpr_consent=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-xm3e0n1E2oL3X.6_nphDQqoMrKfbEBtWgUi8Tw--~A&gdpr=0&gdpr_consent=1---
Request Chain 342
  • https://token.rubiconproject.com/token?pid=25470&gdpr_consent=1--- HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUU3TzRUOVQtMU8tSkFTRA==&gdpr_consent=1--- HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr_consent=1---&google_gid=CAESEOWGtAcfbY1AYqbIpo4EgnQ&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUU3TzRTWFQtMTYtSDQ0MA==&google_push=&gdpr_consent=1---
Request Chain 344
  • https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr_consent=1--- HTTP 302
  • https://ce.lijit.com/merge?pid=80&3pid=ME7O4T9T-1O-JASD&gdpr_consent=1---
Request Chain 345
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr_consent=1--- HTTP 302
  • https://sync.a-mo.net/setuid/magnite?uid=ME7O4T9T-1O-JASD&gdpr_consent=1---
Request Chain 346
  • https://pixel.rubiconproject.com/exchange/sync.php?p=primis&gdpr_consent=1--- HTTP 302
  • https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=ME7O4T9T-1O-JASD&gdpr_consent=1--- HTTP 301
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=ME7O4T9T-1O-JASD HTTP 302
  • https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=ME7O4T9T-1O-JASD&ckls=true&ci=auws5KNEEy&nc=false&trid=1420422248
Request Chain 347
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange&gdpr_consent=1--- HTTP 302
  • https://pbs.yahoo.com/setuid?bidder=rubicon&uid=ME7O4SXT-16-H440&gdpr_consent=1---
Request Chain 348
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr_consent=1--- HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr_consent=1---
Request Chain 349
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr_consent=1--- HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=76dce58b-a78d-4622-a204-0c7f55995773&expires=30&gdpr_consent=1---
Request Chain 350
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=1---&khaos=ME7O4SXT-16-H440 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr=0
Request Chain 388
  • https://match.adsrvr.org/track/usersync?us_privacy=1---&gdpr=0&gdpr_consent=undefined&ust=image HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82
Request Chain 389
  • https://fw.adsafeprotected.com/rfw/st/2572523/88821676/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022230610&ias_pubId=83fd1714&ias_chanId=101&ias_placementId=22855463669&bidurl=https://d2emu.com/&ias_dealId=mBGaf&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0ijnOYgIbmVkHASs11T9I8a&adsafe_url=https%3A%2F%2Fd2emu.com%2F&adsafe_type=abcedfq&adsafe_jsinfo=,id:470afa9c-a30c-8f7e-4267-c76e8cc3068b,c:kZxmik,sl:outOfView,em:true,fr:true,thd:1,mn:jsserver-primary-7d776947d9-ggrpw,rg:va,pt:1-5-15,wc:390.390.1600.1200,ac:440.450.160.600,am:sp,cc:390.390.160.600,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:751,mot:0,app:0,maw:0,tdt:s,fm:uTBCShI+11%7C12%7C13%7C14%7C15%7C16%7C171*.2572523-88821676%7C1711%7C1712%7C1713%7C172%7C173%7C181%7C182%7C19%7C1a11%7C1a12%7C1a13%7C1a2%7C1a3%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i%7C1j,idMap:171*,pl:CV8L.CV8L.CV8L.CV8L.CV8L,rmeas:1,rend:0,renddet:na,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:815,oid:4d24116f-7700-11f0-bfa0-9e70b3775ca5,v:19.8.605,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://static.adsafeprotected.com/skeleton.js?ias_xappb=
Request Chain 391
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=8192551922752742053&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 392
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=1820804327581032944
Request Chain 393
  • https://id.rlcdn.com/464246.gif?partner_uid=6399a230-0c18-4bbb-916a-e8da6624bdb2 HTTP 307
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=6399a230-0c18-4bbb-916a-e8da6624bdb2
Request Chain 395
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0 HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=1321fdd7-9d3b-41e2-9613-725546e71dc6-689a6adc-4341&gdpr=0&gdpr_consent=
Request Chain 396
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID} HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073028&val=76dce58b-a78d-4622-a204-0c7f55995773
Request Chain 397
  • https://fw.adsafeprotected.com/rfw/st/2527642/88099442/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022032771&ias_pubId=S2rESyUH&ias_chanId=101&ias_placementId=22699554197&bidurl=https://d2emu.com/&ias_dealId=mBGaf&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0iRePawfMAH8SjiNp46nuaJ&adsafe_url=https%3A%2F%2Fd2emu.com%2F&adsafe_type=abcedfq&adsafe_jsinfo=,id:682ba251-840e-3309-aa59-e01b25fe7bdf,c:kZxmju,sl:outOfView,em:true,fr:true,thd:1,mn:jsserver-primary-7d776947d9-f8wjb,rg:va,pt:1-5-15,wc:390.390.1600.1200,ac:1690.450.300.600,am:sp,cc:390.390.300.600,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:913,mot:0,app:0,maw:0,tdt:s,fm:uTBCSh4+11%7C12%7C13%7C14%7C15%7C16%7C1711%7C1712%7C1713%7C1714%7C172%7C173%7C181%7C182%7C19%7C1a1*.2527642-88099442%7C1a11%7C1a12%7C1a13%7C1a2%7C1a3%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i%7C1j,idMap:1a1*,pl:CV8L.CV8L.CV8L.CV8L.CV8L,rmeas:1,rend:0,renddet:na,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,tt:rjss,et:926,oid:4d232721-7700-11f0-8c88-be98e164f132,v:19.8.605,sp:1,st:0,fwm:1,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
  • https://static.adsafeprotected.com/skeleton.js?ias_xappb=
Request Chain 403
  • https://x.bidswitch.net/sync?ssp=criteo&custom_data=aMCLEV9FNmYyV0JCQlAlMkZYMkZKJTJCTEhvMERHbW1PWkNzQ0xNVkF5U0ltSHlkQkJLbyUzRA&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-x_l6fFWKtEehGji4tA-QmQvlOByDgR7aeeO7Vw HTTP 302
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&ssp=criteo&gdpr=0&gdpr_consent=
Request Chain 404
  • https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dtPPlzV9iM1J0NFBmSzdyT3M4aVRldlFCdXZXRnA1aWJyaDFpTFh1NlhNeWdVcTcwJTNE%26u%3d%24UID&gdpr=0&gdpr_consent= HTTP 302
  • https://ssp-sync.criteo.com/user-sync/match?p=tPPlzV9iM1J0NFBmSzdyT3M4aVRldlFCdXZXRnA1aWJyaDFpTFh1NlhNeWdVcTcwJTNE&u=1820804327581032944&gdpr=0&gdpr_consent=
Request Chain 405
  • https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-x_l6fFWKtEehGji4tA-QmQvlOByDgR7aeeO7Vw&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dUXQfF18yNmFlaUZzVmdnY3ZRaUZ2QUxpNWRYRUhlSVlSMXJzNkZHS2FnSDR6MTBRJTNE%26u%3d%25%25GOOGLE_GID%25%25&gdpr=0&gdpr_consent= HTTP 302
  • https://ssp-sync.criteo.com/user-sync/match?p=UXQfF18yNmFlaUZzVmdnY3ZRaUZ2QUxpNWRYRUhlSVlSMXJzNkZHS2FnSDR6MTBRJTNE&u=CAESEIXoMfZ7pua9anONyT2WX3E&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 406
  • https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent= HTTP 302
  • https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=6991502948339887798
Request Chain 407
  • https://cs.admanmedia.com/e805be652c9053b8f771665f0ac3c361.gif?puid=k-x_l6fFWKtEehGji4tA-QmQvlOByDgR7aeeO7Vw&redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dXCJJ-F9iYndqbU51M3lOTDY1alluOUM4QkkzbHAlMkI3SHRSejRvcVdkUEtxZFJlJTJCZyUzRA%26u%3d%24%7bUSER_ID%7d&gdpr=0&gdpr_consent=&ccpa= HTTP 302
  • https://ssp-sync.criteo.com/user-sync/match?p=XCJJ-F9iYndqbU51M3lOTDY1alluOUM4QkkzbHAlMkI3SHRSejRvcVdkUEtxZFJlJTJCZyUzRA&u=${USER_ID}
Request Chain 410
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---?gdpr=0&gdpr_consent=&us_privacy=1---&uid=${BSW_UUID}&cookie_age=${COOKIE_AGE} HTTP 302
  • https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=0&gdpr_consent=&us_privacy=1---
Request Chain 411
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=46f4af91-2ba3-4305-896c-c258960d2f82&dongle=0cfd&gdpr=0&gdpr_consent=
Request Chain 412
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEI_S-uGA2go4kA7mO7nuOtY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 413
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTUxOTExMjIxNDM5NTUxNTg3Mg%3D%3D
Request Chain 414
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTUxOTExMjIxNDM5NTUxNTg3Mg%3D%3D HTTP 302
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Request Chain 417
  • https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1639519112214395515872&gpp_s=&gpp_as= HTTP 303
  • https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1639519112214395515872&gpp_s=&_li_chk=true&gpp_as=&previous_uuid=2ddbbc8337d04bb29bce3ab413459f86 HTTP 303
  • https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=2ddbbc83-37d0-4bb2-9bce-3ab413459f86&us_privacy=1YN-
Request Chain 418
  • https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1639519112214395515872 HTTP 303
  • https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1639519112214395515872&_li_chk=true&previous_uuid=e7a3dc072a2a49cab918c675ed36a6d2 HTTP 303
  • https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=e7a3dc07-2a2a-49ca-b918-c675ed36a6d2&us_privacy=1YN-
Request Chain 419
  • https://pr-bh.ybp.yahoo.com/sync/triplelift/1639519112214395515872?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2662&xuid=y-8rBqjq9E2oSEQ.daZocZMjx9IEgE0Rr.Zp.GXsm3nw--~A&dongle=0883
Request Chain 422
  • https://p.rfihub.com/cm?pub=19967&in=1&forward=https%3A%2F%2Fcontextual.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Drkt%26refUrl%3D%26vid%3D3979519634066922000V10%26axid_e%3D%26ovsid%3D{userid} HTTP 302
  • https://contextual.media.net/cksync.html?cs=8&vsid=3979519634066922000V10&type=rkt&refUrl=&vid=3979519634066922000V10&axid_e=&ovsid=1783777349569458445
Request Chain 423
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=medianet HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=medianet
Request Chain 425
  • https://bh.contextweb.com/bh/rtset?pid=560210&ev=1&rurl=https%3A%2F%2Fhbx.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Dppt%26refUrl%3D%26vid%3D49503640853979519634066922000V10%26axid_e%3D%26ovsid%3D%25%25VGUID%25%25 HTTP 302
  • https://hbx.media.net/cksync.html?cs=8&vsid=3979519634066922000V10&type=ppt&refUrl=&vid=49503640853979519634066922000V10&axid_e=&ovsid=B1s4UYBYqrm1&ev=1&pid=560210
Request Chain 426
  • https://cm.g.doubleclick.net/pixel?cs=8&google_nid=media&google_cm=1&google_hm=Mzk3OTUxOTYzNDA2NjkyMjAwMFYxMA%3D%3D&google_sc=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.media.net/cksync?type=g&cs=8&gdpr=0&gdpr_consent=&google_gid=CAESEEloWtccfCavyajwKa9dm9s&google_cver=1
Request Chain 427
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8m33zk4&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.media.net/cksync?cs=1&type=ttd&ovsid=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Request Chain 428
  • https://x.bidswitch.net/sync?ssp=medianet&gdpr=0&gdpr_consent=&gdpr_pd=1 HTTP 302
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&ssp=medianet&gdpr=0&gdpr_consent=
Request Chain 429
  • https://cs.media.net/cksync?cs=1&type=exp&ovsid=setstatuscode&redirect=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3D3501%26partner_device_id%3D3979519634066922000V10 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3501&partner_device_id=3979519634066922000V10 HTTP 302
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%252C%252C HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1820804327581032944&pt=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%2C%2C
Request Chain 430
  • https://medianet-match.dotomi.com/match/bounce/current?version=1&networkId=57734&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fhbx.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Dcon%26refUrl%3D%26vid%3D49503640853979519634066922000V10%26axid_e%3D%26ovsid%3D%24UID HTTP 302
  • https://medianet-match.dotomi.com/match/bounce/current?DotomiTest=106c0767fd742392&is_secure=true&version=1&networkId=57734&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fhbx.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Dcon%26refUrl%3D%26vid%3D49503640853979519634066922000V10%26axid_e%3D%26ovsid%3D%24UID HTTP 302
  • https://hbx.media.net/cksync.php?cs=8&vsid=3979519634066922000V10&type=con&refUrl=&vid=49503640853979519634066922000V10&axid_e=&ovsid=AQAA_W0tJrE-1AJOAc1TAQEBAQEBAQCZmjBuDAEBAQEBAQEB&expiration=1755036764&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 431
  • https://us-u.openx.net/w/1.0/cm?id=78e2dffc-bb89-4bb2-ae92-f592d006518b&ph=6a16560a-f6c6-4851-b7b5-0b2c0190166a&r=https%3A%2F%2Fhbx.media.net%2Fcksync.html%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Dopx%26refUrl%3D%26vid%3D49503640853979519634066922000V10%26axid_e%3D%26ovsid%3D HTTP 302
  • https://hbx.media.net/cksync.html?cs=8&vsid=3979519634066922000V10&type=opx&refUrl=&vid=49503640853979519634066922000V10&axid_e=&ovsid=fe73b4c9-6a5f-473b-ad5c-1647ed504eb6
Request Chain 432
  • https://creativecdn.com/cm-notify?pi=medianet HTTP 302
  • https://contextual.media.net/cksync.php?cs=1&vsid=%7BMedia.net_User_id%7D&type=rbh&ovsid=C_pgKG0SJyaTO2kRskKQqfAgRR42lsxfV5mM_0IMmTI&pi=medianet
Request Chain 433
  • https://match.deepintent.com/usersync/131?redir=https%3A%2F%2Fhbx.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Ddi%26refUrl%3D%26vid%3D49503640853979519634066922000V10%26axid_e%3D%26ovsid%3D%24%7BDI_USER_ID%7D HTTP 303
  • https://hbx.media.net/cksync.php?cs=8&vsid=3979519634066922000V10&type=di&refUrl=&vid=49503640853979519634066922000V10&axid_e=&ovsid=di_ccdebe26368d40c2bcad0
Request Chain 434
  • https://match.sharethrough.com/universal/v1?supply_id=zKJmsEAd HTTP 302
  • https://cs.media.net/cksync.php?cs=3&type=shr&ovsid=ae8c427e-58eb-4a23-b875-39b0891b4fff
Request Chain 435
  • https://sync.1rx.io/usersync2/rmp1r1?sub=medianet&redir=https%3A%2F%2Fhbx.media.net%2Fcksync.php%3Fcs%3D8%26vsid%3D3979519634066922000V10%26type%3Dr1%26refUrl%3D%26vid%3D49503640853979519634066922000V10%26axid_e%3D%26ovsid%3D%5BRX_UUID%5D HTTP 302
  • https://hbx.media.net/cksync.php?cs=8&vsid=3979519634066922000V10&type=r1&refUrl=&vid=49503640853979519634066922000V10&axid_e=&ovsid=OPTOUT
Request Chain 454
  • https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
Request Chain 455
  • https://pixel.rubiconproject.com/exchange/sync.php?p=medianet&gdpr_consent=1---&khaos=ME7O4SXT-16-H440 HTTP 302
  • https://contextual.media.net/cksync.php?type=rbcn&ovsid=ME7O4SXT-16-H440&gdpr_consent=1---
Request Chain 458
  • https://dsum-sec.casalemedia.com/rrum?cm_dsp_id=178&external_user_id=63132694-9b5a-4de7-a6bc-19455fef0d05&cb=https://pxl.iqm.com/i/ck/indexch?cmid= HTTP 302
  • https://pxl.iqm.com/i/ck/indexch?cmid=aJpq2MAoIboAKvcmAgOQ4gAA
Request Chain 465
  • https://idsync.rlcdn.com/709732.gif?partner_uid=63132694-9b5a-4de7-a6bc-19455fef0d05 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESED01_7Pxzr0sQK2ToyGt_xE&google_cver=1
Request Chain 466
  • https://cm.g.doubleclick.net/pixel?google_nid=iqm&google_cm HTTP 302
  • https://pxl.iqm.com/i/ck/adx?google_gid=CAESEId5DeSqxBi6pU_PalP6LbE&google_cver=1
Request Chain 470
  • https://s.ad.smaato.net/c/?dspInit=1001145&dspCookie=63132694-9b5a-4de7-a6bc-19455fef0d05 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=133&partneruserid=35667f21a0&gdpr=0&gdpr_consent=
Request Chain 476
  • https://feed.pghub.io/tag?us_privacy=1---&referrer_url=https%3A%2F%2Fd2emu.com%2F&page_url=https%3A%2F%2Fd2emu.com%2F&owner=P%26G&bp_id=sharethrough&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js HTTP 302
  • https://pandg.tapad.com/tag?us_privacy=1---&referrer_url=https%3A%2F%2Fd2emu.com%2F&page_url=https%3A%2F%2Fd2emu.com%2F&owner=P%26G&bp_id=sharethrough&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js
Request Chain 493
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=1820804327581032944&gdpr=0&gdpr_consent=&us_privacy=1---&gdpr=0&gdpr_consent=
Request Chain 498
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

498 HTTP transactions
4 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H3
200
Primary Request / Show response
d2emu.com/
Redirect Chain
  • http://d2emu.com/
  • https://d2emu.com/
97 KB
13 KB
365ms
264ms
Document
text/html
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9930b809d4a8d76ed1ba006effd9961006d51ce7fc2db5c685919ad397efc36

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
96db133efdb375bf-SEA
content-encoding
zstd
content-type
text/html
date
Mon, 11 Aug 2025 22:12:33 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3%2FFWoiuURm6mTXV8UBG0G2%2Bg7xxofWVo5RF4xIVSU7GDmrPSHNgo3wDW%2BJBgdBOM%2Bvpb1wXqyoQNUNkbPYMvN4XBviwvAqWaX8T%2BlPm4sh3Cg8tUZFIZePl5IvA%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfCacheStatus;desc="DYNAMIC" cfOrigin;dur=138,cfEdge;dur=42 cfL4;desc="?proto=QUIC&rtt=75955&min_rtt=75403&rtt_var=7096&sent=12&recv=12&lost=0&retrans=0&sent_bytes=4827&recv_bytes=4576&delivery_rate=1920955&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=16746&unsent_bytes=0&cid=11a331749d66baa3&ts=275&inflight_dur=256&x=60"
vary
accept-encoding

Redirect headers

Location
https://d2emu.com/
Non-Authoritative-Reason
HttpsUpgrades
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
396 KB
135 KB
601ms
233ms
Script
application/javascript
192.178.155.97
GOOGLE
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-1DNME47EKC
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.178.155.97 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadrs-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
547f9d759f1dcb7961f4ab84dba3a9c78657f95cb1b2e01ecb30e67c7fcde49c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
zstd
report-to
{"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires
Mon, 11 Aug 2025 22:12:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=ascgcycc:1099:0
content-length
137708
x-xss-protection
0
server
Google Tag Manager
GET
H3
200
adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/
158 KB
53 KB
448ms
161ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7278173261118542
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
55eca69f87a93de2456b418d05f9ffdebf2d2804bedad4f84c628b27c7d57cde
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
5878135478807910388
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
link
<https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
54248
x-xss-protection
0
server
cafe
GET
H3
200
ads-1773.js Show response
s.nitropay.com/
729 KB
231 KB
194ms
105ms
Script
text/javascript
104.18.2.78
CLOUDFLARENET
General
Full URL
https://s.nitropay.com/ads-1773.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.2.78 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd0bb7ceef6450039cfc709ab49f018af4c18e9bb826e77d05697b2d290a21d1
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Type
x-goog-meta-goog-reserved-file-mtime
1753109413
content-encoding
gzip
cf-cache-status
HIT
etag
W/"8487fa877990a95ff73deefa3d3d470d:1754942149000:CA"
age
7882
x-goog-hash
crc32c=ZMOuyQ==, md5=hIf6h3mQqV/3Pe76PT1HDQ==
x-goog-stored-content-encoding
identity
expires
Tue, 11 Aug 2026 19:56:24 GMT
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
741444
server-timing
cfExtPri
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/javascript
last-modified
Mon, 11 Aug 2025 19:55:49 GMT
vary
Accept-Encoding
priority
u=3,i=?0
x-guploader-uploadid
ABgVH88isTt-tikgfBL4-44YbAQDl2m12pqmIfu_MdfTIji_yNLSUvuMUhsMVf0HQcLitb1utjweQfc
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
private, max-age=600
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db13455bbe490b-YVR
access-control-allow-origin
*
x-goog-generation
1753110191695928
server
cloudflare
GET
H2
200
css
fonts.googleapis.com/
26 KB
2 KB
533ms
238ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,300,400,400i,500
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
ced3aa7c5576e07d62bf6a2f8a31a529f5afc1fdd0274a5e5a39469412784273
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 22:12:34 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
css
fonts.googleapis.com/
10 KB
1 KB
516ms
222ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%20Mono:100,300,400,400i,500
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
a51414f1d4be4d1f9ad1a01a54f55eafe0659e5bf8dacadb59be947815e86ae7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 22:12:34 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.1/css/
58 KB
11 KB
211ms
120ms
Stylesheet
text/css
104.17.25.14
CLOUDFLARENET
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.1/css/all.min.css
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9716994f96b14296dd1b21d3e0a73f07ee88e7935d07ebdc51a9df7eb934a10
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eebda3d-e637"
age
3496327
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4q2%2FuRsjN1gKyCbOZIlTzG%2FoyiJKggrgYPiZ16u035F8WsF5Ct3cLHqf7SWuZX9kpeHHlnp3YkmT9oap7zKLGZooh4i7kGuIRQz%2F3x5Fda8qrLGu7%2FXDCorHuVJRyh35YqdBTbrR"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sat, 01 Aug 2026 22:12:34 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/css; charset=utf-8
last-modified
Thu, 18 Jun 2020 21:18:53 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
96db13417e128444-YVR
accept-ranges
bytes
access-control-allow-origin
*
content-length
10392
server
cloudflare
GET
H3
200
normalize.css
d2emu.com/css/
6 KB
2 KB
107ms
102ms
Stylesheet
text/css
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/css/normalize.css
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5838f522446a1e7c42bb250c02ea2b683a2d3aaf4e222afff98316fdb592e1de

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=14400
content-encoding
zstd
cf-cache-status
HIT
etag
W/"689a5252-17f9"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NzHe5uRqqLJUW2aoE6TOuDA2EgUgQ9gqbkf%2BeXOxbsKDs8npewDbzPpdlOzgUpml18snvbNovuTFNqJP%2FLeLdUova2Le5uVlR3fo%2BBwRJI9f%2BOFkOY0NemeJCCY%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
96db1340fdc675bf-SEA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75755&min_rtt=75153&rtt_var=1011&sent=35&recv=26&lost=0&retrans=0&sent_bytes=19247&recv_bytes=6678&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30039&unsent_bytes=0&cid=11a331749d66baa3&ts=431&inflight_dur=398&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/css
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
server
cloudflare
vary
Accept-Encoding
GET
H3
200
styles.css
d2emu.com/css/
2 KB
1 KB
109ms
103ms
Stylesheet
text/css
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/css/styles.css
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd4ca1fec4ccbe1d770ab6e173b425ec4d975fe92a2f170724b9c035396bde77

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=14400
content-encoding
zstd
cf-cache-status
HIT
etag
W/"689a5252-8d1"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EzdmTscHNTbLE0pD1Ju2iTRHIYz02JcM802nsRwSuWbvBawlSsHMnBZXRyocfJPhkbHxCPFjJuz%2FOeRCc5%2BlE%2BYa2m%2FFLIjbFUEXLjhjw0npWMGlUC2ST5qeID8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
96db1340fdc775bf-SEA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75755&min_rtt=75153&rtt_var=1011&sent=39&recv=26&lost=0&retrans=0&sent_bytes=21860&recv_bytes=6678&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30039&unsent_bytes=0&cid=11a331749d66baa3&ts=434&inflight_dur=405&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/css
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
server
cloudflare
vary
Accept-Encoding
GET
H3
200
dclone.css
d2emu.com/css/
16 KB
5 KB
176ms
171ms
Stylesheet
text/css
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/css/dclone.css
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
92e791bc45e4c95d81bf28b23831ff53469a0ae13cb52437f16ddf311cc4dc6c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=14400
content-encoding
zstd
cf-cache-status
HIT
etag
W/"689a5252-3f8f"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2Fqxpjmiw5atZbKcsVa%2BiJhE1GMhYNm3N1fcnLuLQDvym9xg%2BLikaDOggH%2BdKWemngQRnbuGdHnI3ZhvkpuKxBJjCoWKu9sSdp8Dffczq%2BzJkumdp7s1A4CXs%2B4%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
96db1340fdc975bf-SEA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75755&min_rtt=75153&rtt_var=1011&sent=64&recv=26&lost=0&retrans=0&sent_bytes=48227&recv_bytes=6678&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30039&unsent_bytes=0&cid=11a331749d66baa3&ts=436&inflight_dur=410&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/css
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
server
cloudflare
vary
Accept-Encoding
GET
H3
200
darkmode.js Show response
d2emu.com/thirdparty/
6 KB
2 KB
185ms
181ms
Script
application/javascript
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/thirdparty/darkmode.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22f2ea9a07bd88632716cafdbefc358173c6e26e2bb3965b23de213d6fb219a2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=14400
content-encoding
zstd
cf-cache-status
HIT
etag
W/"689a5252-18c7"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LnzyPVlqBZQU1Z7td1LYcQs%2BTd0jLolBqz06nUhvD5pjS9X%2Bde1nJG8vFLJ5R3etXvDuQk%2BkRQq92RFtceZhyNLRBuF9M%2FbLM3ZZNTfL4PpMNlpXm95qDXxO24s%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
96db1340fdc875bf-SEA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75755&min_rtt=75153&rtt_var=1011&sent=65&recv=26&lost=0&retrans=0&sent_bytes=48297&recv_bytes=6678&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30039&unsent_bytes=0&cid=11a331749d66baa3&ts=440&inflight_dur=410&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
application/javascript
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
server
cloudflare
vary
Accept-Encoding
GET
H3
200
jquery-3.6.3.min.js Show response
d2emu.com/thirdparty/
88 KB
33 KB
108ms
105ms
Script
application/javascript
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/thirdparty/jquery-3.6.3.min.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
448ef0632211ba18d7c1557a6d22250820ac3b4465ba2e73b7137f4dc4a31a12

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=14400
content-encoding
zstd
cf-cache-status
HIT
etag
W/"689a5252-15f5a"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uEcKb8z25dX6Gw7OzoptUijD9Uqx8otzpTbJyDDCFxd0h7cqXRS7DYzHFDUmXSmOAXgwRVTLwS9R8mbdEFI1liKOvoPV0KV7170Y8Q5uSxvMqw6kooHbC4H8HnU%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
96db1340fdcb75bf-SEA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75755&min_rtt=75153&rtt_var=1011&sent=42&recv=26&lost=0&retrans=0&sent_bytes=23423&recv_bytes=6678&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30039&unsent_bytes=0&cid=11a331749d66baa3&ts=435&inflight_dur=408&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
application/javascript
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
server
cloudflare
vary
Accept-Encoding
GET
H3
200
dark.js Show response
d2emu.com/js/
821 B
942 B
97ms
94ms
Script
application/javascript
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/js/dark.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
09fa5c6a45d91a7c3391705def0d353e1a761c727886b47c013e8dcdb542c8ed

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control
max-age=14400
content-encoding
zstd
cf-cache-status
HIT
etag
W/"689a5252-335"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=63mi1DdGZOj7bNiUM70rNxB5oJ6gqMDVmFARGc4ITSfhas4sHh50tNI7cILi9vatDAnlOaUVHWAMBwI3WGBBkQfkaC0SL7rGI3GAL63E35NhniVUbNvdVWkkzPc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
96db1340fdca75bf-SEA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75755&min_rtt=75153&rtt_var=1011&sent=33&recv=26&lost=0&retrans=0&sent_bytes=18258&recv_bytes=6678&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=30039&unsent_bytes=0&cid=11a331749d66baa3&ts=424&inflight_dur=398&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
application/javascript
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
server
cloudflare
vary
Accept-Encoding
GET
H3
200
android-chrome-512x512.png
d2emu.com/images/
305 KB
306 KB
90ms
90ms
Image
image/png
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/images/android-chrome-512x512.png
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdb59a367339739430f343a819973150635e3332d9ede1bc53bd4a5704ba095d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cf-cache-status
HIT
etag
"689a5252-4c487"
age
272
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p04Uyg99c1xWFBJVGEoQLctj%2ByFP5R2S65hxUkqEJPB%2F2ULzQtYp%2FB9eFLqW1DAnveEnH929ybUZ0bEolQ44%2B%2BXEFRpBGTb5vx3GTsG2zXnMuXFfSt06trH1%2F5c%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=75661&min_rtt=75028&rtt_var=461&sent=87&recv=56&lost=0&retrans=1&sent_bytes=66239&recv_bytes=8345&delivery_rate=5326822&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=77974&unsent_bytes=0&cid=11a331749d66baa3&ts=944&inflight_dur=688&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
image/png
last-modified
Mon, 11 Aug 2025 20:28:02 GMT
vary
Accept-Encoding
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
96db13444de475bf-SEA
accept-ranges
bytes
content-length
312455
server
cloudflare
GET
H2
200
vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/
19 KB
7 KB
261ms
101ms
Script
text/javascript
104.16.80.73
CLOUDFLARENET
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://d2emu.com/

Response headers

cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"2024.6.1"
cross-origin-resource-policy
cross-origin
cf-ray
96db1345cf1948f3-YVR
access-control-allow-origin
*
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
text/javascript;charset=UTF-8
last-modified
Thu, 06 Jun 2024 15:52:56 GMT
vary
Accept-Encoding
server
cloudflare
GET
DATA
200
OK
truncated
/
2 KB
0
Stylesheet
text/css

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
76661eee17aa73bf038be78aaf80fa793a3b5d943ca879f8194ecdbe7b37ba80

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
text/css;charset=UTF-8
GET
DATA
200
OK
truncated
/
2 KB
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b020c68d95b8ceb26886b0c51f2a098430a8b5f7f14b1857b60828eacc3e324

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml;charset=UTF-8
GET
H3
200
show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202508060101/
506 KB
167 KB
143ms
141ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202508060101/show_ads_impl_fy2021.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7278173261118542
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
a7d9d084a024c12840d049d2787ec684e1ba73647ecab623b9ee1e9577192e43
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
1116001531992717049
age
23287
x-content-type-options
nosniff
expires
Mon, 25 Aug 2025 15:44:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 15:44:27 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
171318
x-xss-protection
0
server
cafe
GET
H3
200
exocet-blizzard-light.ttf
d2emu.com/css/
94 KB
95 KB
114ms
112ms
Font
application/octet-stream
104.21.112.1
CLOUDFLARENET
General
Full URL
https://d2emu.com/css/exocet-blizzard-light.ttf
Requested by
Host: d2emu.com
URL: https://d2emu.com/css/dclone.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.112.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
754e738d05e884f0c3b980d0ad2512792d1d998ab267e8cbfc79df7f984d6be1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://d2emu.com/css/dclone.css

Response headers

cf-cache-status
HIT
etag
"6898e6d3-1796c"
age
7183
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaBUAQAWx7CdA%2F%2FQ37agO9woIcA%2FLMAEBbsWC7CZRQ%2BK3v6Cl9R0ruSO1o3Uh57oFdF9og%2BNI5%2BXHGC9joWkJsORl1ZFbzLh97R8NxzhC66EZOgPvvoBl2iM0j8%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=76658&min_rtt=75028&rtt_var=1288&sent=356&recv=87&lost=0&retrans=1&sent_bytes=386405&recv_bytes=10041&delivery_rate=14771412&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=311896&unsent_bytes=0&cid=11a331749d66baa3&ts=1152&inflight_dur=884&x=60"
date
Mon, 11 Aug 2025 22:12:34 GMT
content-type
application/octet-stream
last-modified
Sun, 10 Aug 2025 18:37:07 GMT
vary
Accept-Encoding
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
96db13456df075bf-SEA
accept-ranges
bytes
content-length
96620
server
cloudflare
GET
H3
200
KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v48/
39 KB
39 KB
288ms
139ms
Font
font/woff2
142.251.179.94
GOOGLE
General
Full URL
https://fonts.gstatic.com/s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,300,400,400i,500
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f94.1e100.net
Software
sffe /
Resource Hash
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://fonts.googleapis.com/

Response headers

age
430616
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 06 Aug 2026 22:35:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Aug 2025 22:35:39 GMT
last-modified
Thu, 29 May 2025 23:30:55 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40128
x-xss-protection
0
server
sffe
GET
H3
200
L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2
fonts.gstatic.com/s/robotomono/v30/
32 KB
32 KB
276ms
147ms
Font
font/woff2
142.251.179.94
GOOGLE
General
Full URL
https://fonts.gstatic.com/s/robotomono/v30/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%20Mono:100,300,400,400i,500
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f94.1e100.net
Software
sffe /
Resource Hash
b81cd55177300649be8f95b3b747d721ce607e8ed2856e25bd0c630cfd631faf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://fonts.googleapis.com/

Response headers

age
450643
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 06 Aug 2026 17:01:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Aug 2025 17:01:52 GMT
last-modified
Mon, 19 May 2025 17:25:14 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
32796
x-xss-protection
0
server
sffe
GET
H3
200
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.1/webfonts/
78 KB
79 KB
322ms
320ms
Font
application/octet-stream
104.17.25.14
CLOUDFLARENET
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.1/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.1/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bf1b8d8ac1b4ef0caea0db8cbe1b6a35f8a84a2f5fffa2421936cc11a1a91fc
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.1/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"5eebda3d-139c8"
age
298365
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mixO5kclsT3TXWEPVkuO6pqyGnbfni46iZqfUGEYvrHDXRbMB8E5RDbeCDYV9l3xFqMNEvJ7xUsRQBgwgLpzApcF%2B9CkOGUzyxfKxReVmYN1xj9o%2FKpaaMOqcoD0gId8K3gp%2FC1q"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sat, 01 Aug 2026 22:12:35 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Mon, 11 Aug 2025 22:12:35 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Thu, 18 Jun 2020 21:18:53 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
96db1346de8a90db-SEA
accept-ranges
bytes
access-control-allow-origin
*
content-length
80328
server
cloudflare
POST
H2
204
collect
www.google-analytics.com/g/
0
0
587ms
229ms
Fetch
text/plain
142.251.179.113
GOOGLE
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-1DNME47EKC&gtm=45je5870v9167816017za200zd9167816017&_p=1754950354050&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~105033766~105033768~105103161~105103163~105135708~105135710&cid=472573402.1754950355&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1754950354&sct=1&seg=0&dl=https%3A%2F%2Fd2emu.com%2F&dt=D2Emu&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1376
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1DNME47EKC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f113.1e100.net
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to
{"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://d2emu.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:102:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:35 GMT
content-type
text/plain
server
Golfe2
POST
H3
204
ping
pagead2.googlesyndication.com/pagead/
0
0
149ms
148ms
Fetch
text/html
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7278173261118542
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://d2emu.com/

Response headers

GET
H2
200
tag Show response
btloader.com/
123 KB
36 KB
278ms
86ms
Script
application/javascript
172.66.171.133
CLOUDFLARENET
General
Full URL
https://btloader.com/tag?o=6278260873756672&upapi=true
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.171.133 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3b8afcb0b20fe286ec4615f47768214d7bc6cc8066c997ef9daf0eb2d21f86cf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-robots-tag
noindex, nofollow
cache-control
public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding
gzip
cf-cache-status
HIT
etag
"a738ee460514ce59ac7e80d4f20f8795"
via
1.1 google
cf-ray
96db134d6958adb4-SEA
access-control-allow-origin
*
content-length
36632
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
application/javascript
last-modified
Mon, 11 Aug 2025 21:56:27 GMT
vary
Accept-Encoding
server
cloudflare
GET
H2
200
ats.js Show response
ats-wrapper.privacymanager.io/ats-modules/438cb908-ed61-41e9-b716-05d5f4122a64/
102 KB
34 KB
636ms
230ms
Script
application/javascript
99.84.188.122
AMAZON-02
General
Full URL
https://ats-wrapper.privacymanager.io/ats-modules/438cb908-ed61-41e9-b716-05d5f4122a64/ats.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.188.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-188-122.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
eadf24c12c3d65285d244278af34745eb1a2c46fbea574f89261fa23c7cfadf6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

vary
accept-encoding
cache-control
must-revalidate,public,max-age=3600
content-encoding
gzip
x-amz-version-id
.HH3o5HchMXSl.A0rXLDFConA9WKJiNW
etag
W/"4891ce8da1713245cf941a1a1a648dc2"
age
863
via
1.1 a97d638d4e395a6f27b927572cf3bfda.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
vCK-bVi8VqCz-ZL8ejGP5Vx3ar6m1ss-u1xRWTXANk1lHuNWLB0ebQ==
date
Mon, 11 Aug 2025 21:58:14 GMT
content-type
application/javascript
last-modified
Tue, 29 Jul 2025 04:14:24 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-C2
x-amz-server-side-encryption
AES256
OPTIONS
H2
200
json
gum.criteo.com/sid/ Frame
0
0
615ms
314ms
Preflight
application/json
74.119.117.17
AS-CRITEO
General
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fd2emu.com%2F&domain=d2emu.com&cw=1&lsw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://d2emu.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://d2emu.com
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-type
application/json; charset=utf-8
date
Mon, 11 Aug 2025 22:12:35 GMT
expires
0
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
226905
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
GET
H2
200
json Show response
gum.criteo.com/sid/
357 B
932 B
595ms
315ms
Fetch
application/json
74.119.117.17
AS-CRITEO
General
Full URL
https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fd2emu.com%2F&domain=d2emu.com&cw=1&lsw=1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
090223994b9c0cc4e5d3c5c666423bc34cdbb5c6e1d0bc9a2c85905333af196f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
application/json
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET
server-processing-duration-in-ticks
496928
expires
0
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel
GET
H2
200
pbhid Show response
id.hadron.ad.gt/api/v1/
2 B
276 B
335ms
146ms
Fetch
application/json
172.66.148.159
CLOUDFLARENET
General
Full URL
https://id.hadron.ad.gt/api/v1/pbhid?partner_id=720&_it=prebid&t=1&src=id&domain=d2emu.com
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
max-age=604800
content-encoding
br
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
access-control-allow-methods
HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray
96db134da9e9ec17-SEA
access-control-allow-origin
*
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
application/json; charset=utf8
server
cloudflare
access-control-allow-headers
authorization,content-type
POST
H2
200
prebid Show response
id5-sync.com/api/config/
194 B
647 B
897ms
404ms
Fetch
application/json
162.19.138.83
OVH OVH SAS
General
Full URL
https://id5-sync.com/api/config/prebid
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31532338.ip-162-19-138.eu
Software
/
Resource Hash
b0ac7f46536b9c97219b1e67bcb29296ca1978b8a36a1043fa60d87821af7940
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-origin
https://d2emu.com
p3p
CP="CAO PSA OUR"
date
Mon, 11 Aug 2025 22:12:35 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
GET
H2
200
id5PrebidModule.js Show response
cdn.id5-sync.com/api/1.0/
92 KB
27 KB
346ms
95ms
Script
text/javascript
104.20.23.13
CLOUDFLARENET
General
Full URL
https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a6cb45ea7814e6ac7230621d5fff9cf48e7a7b4b935b8963c895dcc94740ee75
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-amz-id-2
gYbpv4cxQl8NKIL0seBOVPPbREs2TpHABvG1eZ7Dp2dBOw/xZjrXXNY7+fnj9ofT2Zpvlj37BtpSvIW8HMlj263q8epqA2TTW7D4T1KoA6g=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"7b9d1ba408d6a19e7061eda9bb44771f"
age
1932
x-amz-request-id
VYP15JKZDZQ5ZCCH
cf-ray
96db1353af9beb3a-SEA
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/javascript;charset=utf-8
last-modified
Tue, 29 Jul 2025 12:29:41 GMT
vary
accept-encoding
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H2
204
envelope Show response
api.rlcdn.com/api/identity/
0
274 B
402ms
147ms
Fetch
34.107.165.188
GOOGLE-CLOUD-PLAT...
General
Full URL
https://api.rlcdn.com/api/identity/envelope?pid=14333
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.165.188 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
188.165.107.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, OPTIONS
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:36 GMT
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
GET
H2
200
id Show response
id.crwdcntrl.net/
75 B
821 B
658ms
261ms
Fetch
application/json
3.213.231.35
AMAZON-AES
General
Full URL
https://id.crwdcntrl.net/id?c=17611
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.231.35 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-231-35.compute-1.amazonaws.com
Software
/
Resource Hash
7bf5b31e04a6d5b70e125667784f173c747b4d32d520c4104ec0177d0f337cff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
access-control-allow-credentials
true
expires
0
access-control-allow-origin
https://d2emu.com
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
75
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
application/json;charset=utf-8
GET
H2
200
rid Show response
match.adsrvr.org/track/
109 B
568 B
384ms
194ms
Fetch
application/json
52.223.40.198
AMAZON-02
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=tpfrvh0&fmt=json
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
bae00ec0cd58ffac65d08be4d59cb4725c07d324a123a1700b2d435885b81d83

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
private
content-encoding
gzip
access-control-allow-credentials
true
expires
Wed, 10 Sep 2025 22:12:36 GMT
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
application/json
vary
Origin,Accept-Encoding
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
GET
H3
200
gpt.js Show response
securepubads.g.doubleclick.net/tag/js/
112 KB
34 KB
440ms
160ms
Script
text/javascript
192.178.218.156
GOOGLE
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.218.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadtq-in-f156.1e100.net
Software
cafe /
Resource Hash
197e58241c2c9432da02ef8d2be1fbd04c37939359f6424c0fd9da8c69147d9d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
137 / 20311 / 31093999 / config-hash: 15813603572021039391
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
34635
x-xss-protection
0
server
cafe
GET
H3
200
gpp-61d490e.min.js Show response
s.nitropay.com/
227 KB
47 KB
93ms
92ms
Script
text/javascript
104.18.2.78
CLOUDFLARENET
General
Full URL
https://s.nitropay.com/gpp-61d490e.min.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.2.78 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc5521185e7dec9f2c67fdf916d6a81db3ca1d571b1e8d89ffb7dec282e83d31
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
content-encoding
gzip
x-goog-hash
crc32c=kd50Hw==, md5=85Xn3RooJE0C7GGraVVcGw==
etag
W/"f395e7dd1a28244d02ec61ab69555c1b"
age
388703
cf-cache-status
HIT
x-goog-stored-content-encoding
identity
expires
Wed, 13 Aug 2025 18:41:48 GMT
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
232723
server-timing
cfExtPri
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/javascript
last-modified
Mon, 23 Jun 2025 17:15:57 GMT
vary
Accept-Encoding
priority
u=3,i=?0
x-guploader-uploadid
ABgVH89FIbvs6plZk6H5bH52FHGPLEhFQHf8LQ1jxSKg4ADZz4-g7JCaTf6StNcrdbtG_3hn
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
public, max-age=604800
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db135409ea490b-YVR
access-control-allow-origin
*
x-goog-generation
1750698957275780
server
cloudflare
GET
H2
200
apstag.js Show response
c.amazon-adsystem.com/aax2/
331 KB
83 KB
600ms
234ms
Script
application/javascript
3.171.86.171
AMAZON-02
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-86-171.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
856fbabc6c5ab42cee6104b14b6bfebc9dc5e91b44bedd5038e94632b69e9731

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

vary
Accept-Encoding
cache-control
max-age=3600
content-encoding
gzip
etag
W/"37debc9b7d063fec2c484dd9812c1170"
age
2561
via
1.1 23bb75571f07e0a7a182023119364d7e.cloudfront.net (CloudFront), 1.1 e4ed21ef6440d05d23aa2a82e459e776.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
jkvMhEuh4340kFd9n38X7aUdyM7ohgcuM6MjMqlmgbrUQQbRkE8QHw==
date
Mon, 11 Aug 2025 21:29:57 GMT
content-type
application/javascript
x-amz-cf-pop
IAD55-P7, IAD89-P3
server
AmazonS3
last-modified
Mon, 11 Aug 2025 20:14:29 GMT
x-amz-server-side-encryption
AES256
GET
H2
204
p
t.nit.ro/
0
0
408ms
146ms
Fetch
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://t.nit.ro/p?d=QhJodHRwczovL2QyZW11LmNvbS9aJDAxOTg5YjMxLTRiZDAtN2ZhMi1hY2FmLTUzYmQ2MWQwN2Q1YmICQ0FqAkJDigEQCgtfZXhwLmZsb29ycxIBMYoBDQoIX2V4cC5paXESATCKARgKE19leHAuY29uc2VudC1jb25maWcSATCSAQCaAQc2MGZlZmI00AHtDdgBAQ%3D%3D
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:36 GMT
vary
Origin
GET
H3
200
1.gif
s.nitropay.com/
42 B
652 B
97ms
96ms
Image
image/gif
104.18.2.78
CLOUDFLARENET
General
Full URL
https://s.nitropay.com/1.gif?x=1&adslot=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.2.78 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
3
access-control-expose-headers
Content-Type
x-goog-hash
crc32c=ljrbyA==, md5=2JdGiI2i2VELZKnwMers1Q==
cf-cache-status
HIT
etag
"d89746888da2d9510b64a9f031eaecd5"
age
388815
x-goog-stored-content-encoding
identity
expires
Mon, 11 Aug 2025 15:07:57 GMT
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
42
server-timing
cfExtPri
date
Mon, 11 Aug 2025 22:12:37 GMT
x-goog-custom-time
1970-01-01T00:00:00Z
content-type
image/gif
last-modified
Fri, 22 Jan 2021 08:58:45 GMT
vary
Accept-Encoding
priority
u=3,i
x-guploader-uploadid
ABgVH89FeoB65v_6XhnzfLBB6_8XYfxIMj1MTjTt2WqO7xxAO21aq8E__n7Nm5MRIu2epKKJrEUFU68
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
public, max-age=604800
x-goog-meta-
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db135409f3490b-YVR
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1611305925409947
content-length
42
server
cloudflare
GET
H3
200
zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20250805/r20190131/ Frame 079F
8 KB
4 KB
434ms
142ms
Document
text/html
64.233.180.154
GOOGLE
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20250805/r20190131/zrt_lookup_fy2021.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202508060101/show_ads_impl_fy2021.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
on-in-f154.1e100.net
Software
cafe /
Resource Hash
1ec2f8f4e51da9bcdeec07a5f242bb23fa38d3dbe29c6a2e389723692e0fe69a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

age
2845
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
3857
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 21:25:11 GMT
etag
5721509764469777035
expires
Mon, 25 Aug 2025 21:25:11 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
ads Show response
googleads.g.doubleclick.net/pagead/ Frame A695
603 B
68 B
490ms
211ms
Document
text/html
64.233.180.154
GOOGLE
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&gpp=GPP_ERROR_STRING_EXPECTED_APPLICATION_SECTION_ARRAY&client=ca-pub-7278173261118542&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1754950356&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fd2emu.com%2F&pra=5&wgl=1&aihb=0&aiudt=1&asro=0&aifxl=29_18~30_19&aiapm=0.1542&aiapmd=0.25178&aiapmi=0.16&aiapmid=1&aiact=0.5423&aiactd=0.7&aicct=0.7&aicctd=0.5799&ailct=0.5849&ailctd=0.65&aimart=4&aimartd=4&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1754950354702&bpp=24&bdt=682&idt=1313&shv=r20250805&mjsv=m202508060101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=1496790140650&frm=20&pv=2&u_tz=-420&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=95362655%2C95366795%2C95366912%2C95368520%2C95359266&oid=2&pvsid=6923490710862463&tmod=1092811656&uas=0&nvt=1&fsapi=1&fc=1920&brdim=390%2C390%2C390%2C390%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=1336
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202508060101/show_ads_impl_fy2021.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
on-in-f154.1e100.net
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Sec-Browsing-Topics
();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:36 GMT
expires
Mon, 11 Aug 2025 22:12:36 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
f Show response
floors.nitropay.com/
338 B
307 B
416ms
145ms
Fetch
application/json
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://floors.nitropay.com/f?s=1773&c=CA&fp=9aetop
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
20c78865b1ea29aad2a304fb6e0fac3d6291191685fff98bebfba441b758f202

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
174
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
application/json
vary
Origin
GET
H2
200
dns Show response
ag.dns-finder.com/meta/
2 B
233 B
393ms
146ms
Fetch
text/plain
34.36.200.111
GOOGLE-CLOUD-PLAT...
General
Full URL
https://ag.dns-finder.com/meta/dns
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
111.200.36.34.bc.googleusercontent.com
Software
/
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers
X-Resolver
x-resolver
default
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
text/plain; charset=utf-8
vary
Origin
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
623 B
309ms
145ms
Fetch
image/gif
172.66.148.140
CLOUDFLARENET
General
Full URL
https://ad-delivery.net/px.gif?ch=2
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1669382
x-goog-stored-content-encoding
identity
expires
Wed, 23 Jul 2025 15:24:07 GMT
x-goog-stored-content-length
43
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
ABgVH8_ngMrBrZcdrnh1IQQteZ70JUZQ4t02mD3CimCQY1CrpUB6yZ3MfDXkqsleGWLTHEH8
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db134fcc0e9982-SEA
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
px.gif Show response
ad-delivery.net/
43 B
110 B
310ms
146ms
Fetch
image/gif
172.66.148.140
CLOUDFLARENET
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.051290393555508906
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
1669382
x-goog-stored-content-encoding
identity
expires
Wed, 23 Jul 2025 15:24:07 GMT
x-goog-stored-content-length
43
date
Mon, 11 Aug 2025 22:12:36 GMT
content-type
image/gif
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
x-guploader-uploadid
ABgVH8_ngMrBrZcdrnh1IQQteZ70JUZQ4t02mD3CimCQY1CrpUB6yZ3MfDXkqsleGWLTHEH8
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db134fcc109982-SEA
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
px.gif
ad-delivery.net/
43 B
46 B
303ms
148ms
Image
image/gif
172.66.148.140
CLOUDFLARENET
General
Full URL
https://ad-delivery.net/px.gif?ch=2
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
292602
x-goog-stored-content-encoding
identity
expires
Fri, 08 Aug 2025 13:31:22 GMT
x-goog-stored-content-length
43
date
Mon, 11 Aug 2025 22:12:37 GMT
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
content-type
image/gif
x-guploader-uploadid
ABgVH8904oeeNNNG8HmGI3CPZytgZdIufX9j66WWp1shPopp9R3xu7bplZHj52w5wfp4yip4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db1355a8b560ce-SEA
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H3
200
favicon.ico
ad.doubleclick.net/
1 KB
130 B
286ms
140ms
Image
image/x-icon
142.251.111.148
GOOGLE
General
Full URL
https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.111.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bk-in-f148.1e100.net
Software
sffe /
Resource Hash
d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
age
34659
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 12 Aug 2025 12:34:58 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 12:34:58 GMT
last-modified
Tue, 08 May 2012 13:08:06 GMT
content-type
image/x-icon
vary
Accept-Encoding
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
104
x-xss-protection
0
server
sffe
GET
H2
200
px.gif
ad-delivery.net/
43 B
541 B
285ms
149ms
Image
image/gif
172.66.148.140
CLOUDFLARENET
General
Full URL
https://ad-delivery.net/px.gif?ch=1&e=0.051290393555508906
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.140 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
5
access-control-expose-headers
*, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status
HIT
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
age
292602
x-goog-stored-content-encoding
identity
expires
Fri, 08 Aug 2025 13:31:22 GMT
x-goog-stored-content-length
43
date
Mon, 11 Aug 2025 22:12:37 GMT
last-modified
Wed, 05 May 2021 19:25:32 GMT
vary
accept-encoding
content-type
image/gif
x-guploader-uploadid
ABgVH8904oeeNNNG8HmGI3CPZytgZdIufX9j66WWp1shPopp9R3xu7bplZHj52w5wfp4yip4
cache-control
public, max-age=86400
x-goog-storage-class
MULTI_REGIONAL
cf-ray
96db1355a8bd60ce-SEA
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1620242732037093
content-length
43
server
cloudflare
GET
H2
200
/ Show response
geo.privacymanager.io/
30 B
627 B
625ms
258ms
Fetch
application/json
3.171.100.117
AMAZON-02
General
Full URL
https://geo.privacymanager.io/
Requested by
Host: ats-wrapper.privacymanager.io
URL: https://ats-wrapper.privacymanager.io/ats-modules/438cb908-ed61-41e9-b716-05d5f4122a64/ats.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.100.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-100-117.iad12.r.cloudfront.net
Software
/
Resource Hash
d6c063cfcf19e64b6c95103a899ced08c6f8a357f6394ec02977acdbe9a94125

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-amz-apigw-id
PHD6JHjljoEEYSw=
age
86267
x-amzn-trace-id
Root=1-689919da-4a43c334152cd54e22c5d89c;Parent=5ec2ab012dbc9f44;Sampled=0;Lineage=1:06620786:0
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
x-amzn-requestid
365460ae-4724-4915-8a8a-a073053827f5
via
1.1 1448cc53c16b560cf86c5348358d4682.cloudfront.net (CloudFront), 1.1 c7904a191557d069faf4e0ae7f35d0b2.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Hit from cloudfront
content-length
30
x-amz-cf-id
Bne63HJ2i5Sf2xtSq1LcPdY1mcVx61rjVqj9jAt_Ys53qdKlBXenqg==
date
Sun, 10 Aug 2025 22:14:50 GMT
content-type
application/json
x-amz-cf-pop
IAD61-P2, IAD12-P5
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
GET
H3
200
additional-consent-providers.csv Show response
consent.nitrocnct.com/
107 KB
108 KB
189ms
95ms
XHR
text/csv
104.21.80.1
CLOUDFLARENET
General
Full URL
https://consent.nitrocnct.com/additional-consent-providers.csv
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/gpp-61d490e.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.80.1 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e44f6ec86acfe83aca288597bf56662e535055f48fec6083360b1a15d8262499

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Content-Length, Content-Type, Date, Origin, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash
crc32c=46FWvA==, md5=C5ebpuopeCk4sUi4/a0dgg==
cf-cache-status
REVALIDATED
etag
"0b979ba6ea29782938b148b8fdad1d82"
age
2647
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RAyvmx7ermnHaodiadWYKSkYaj3S6ANe0o3vfGS0DVhcXzQ06K1GO2t8qr7Yc0wk%2FdeA1jaJ5QW%2BSt%2BXtFSvOJnHwdfG%2BSTdwty0JPs818G2eEZuwbYIl%2FqS4owEXJuRB4ZaPhX8VFE%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding
identity
expires
Mon, 11 Aug 2025 22:42:22 GMT
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
109172
server-timing
cfL4;desc="?proto=QUIC&rtt=76388&min_rtt=76385&rtt_var=21488&sent=10&recv=8&lost=0&retrans=0&sent_bytes=4763&recv_bytes=4339&delivery_rate=90871227&ss_exit_cwnd=0&ss_exit_reason=0&cwnd=16190&unsent_bytes=0&cid=974083123609a308&ts=102&inflight_dur=78&x=60"
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/csv
last-modified
Tue, 25 Feb 2025 15:57:30 GMT
vary
Accept-Encoding
x-guploader-uploadid
ABgVH8-OZeXjjFrIh5A-w-v5kXE5Cl7Qfg8mObVAtY8rF6DOEUcGRGNxm1nmkd9FfHi8yLiBljTcpoA
cache-control
public, max-age=3600
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class
STANDARD
cf-ray
96db1355ba680899-SEA
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1740499050366347
content-length
109172
server
cloudflare
GET
H3
200
pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/
575 KB
182 KB
143ms
142ms
Script
text/javascript
192.178.218.156
GOOGLE
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.218.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadtq-in-f156.1e100.net
Software
cafe /
Resource Hash
7017ec7b6eabd401a406fb6a7358c9cab577ec04eae96996292be119e6ef0d75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
11161755793691178870
age
43787
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 10:02:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 10:02:50 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
186736
x-xss-protection
0
server
cafe
GET
H3
200
gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202508070101/
63 KB
23 KB
145ms
142ms
Other
text/plain
192.178.218.156
GOOGLE
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/dict/m202508070101/gpt
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.218.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadtq-in-f156.1e100.net
Software
cafe /
Resource Hash
405e6b13945fe51e9324e75a66a200f140d5454679eb781bda3af9bc55ddb92c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
br
etag
5991720260218776714
age
6636
x-content-type-options
nosniff
expires
Mon, 18 Aug 2025 20:22:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 20:22:01 GMT
content-type
text/plain; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
23907
x-xss-protection
0
server
cafe
use-as-dictionary
match="/gampad/ads", id="m202508070101"
GET
H2
200
720 Show response
a.ad.gt/api/v1/u/matches/
Redirect Chain
  • https://cdn.hadronid.net/hadron.js?partner_id=720&_it=prebid
  • https://a.ad.gt/api/v1/u/matches/720?_it=nitro
6 KB
3 KB
266ms
94ms
Script
application/javascript
104.20.35.150
CLOUDFLARENET
General
Full URL
https://a.ad.gt/api/v1/u/matches/720?_it=nitro
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bb11394fc8bafba35aea4c657751135177e7cc39b4c60152d1cab652e323c05

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=7200
content-encoding
gzip
cf-cache-status
HIT
age
639
cross-origin-resource-policy
cross-origin
cf-ray
96db135c1b12ec27-SEA
date
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Mon, 11 Aug 2025 20:22:12 GMT
content-type
application/javascript
vary
accept-encoding
server
cloudflare

Redirect headers

cf-ray
96db135a1d53ebea-SEA
location
https://a.ad.gt/api/v1/u/matches/720?_it=nitro
date
Mon, 11 Aug 2025 22:12:38 GMT
vary
accept-encoding
server
cloudflare
POST
H2
200
cookie_sync Show response
pbs.nitropay.com/
1 KB
2 KB
294ms
119ms
Fetch
application/json
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/cookie_sync
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
2ebbb6439ac3846f2b08b8c8557fe02cabbd45fdc114555fea3424bd8b2f501d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-credentials
true
via
1.1 google
expires
0
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1374
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding,Origin
POST
H2
200
auction Show response
pbs.nitropay.com/openrtb2/
255 B
365 B
557ms
392ms
Fetch
application/json
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/openrtb2/auction
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
6c3b6427af43e7aa390e1efd345fd24b7d1c2d5c36ba84aa9ef932b34a8b7712

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
expires
0
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
255
date
Mon, 11 Aug 2025 22:12:37 GMT
x-prebid
pbs-go/3.16.0
content-type
application/json
vary
Accept-Encoding,Origin
POST
H2
200
auction Show response
tlx.3lift.com/header/
19 B
1 KB
733ms
337ms
Fetch
application/json
3.208.175.5
AMAZON-AES
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=9.40.0&referrer=https%3A%2F%2Fd2emu.com%2F&tmax=1200&us_privacy=1---
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.208.175.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-208-175-5.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
accept-ch
sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model
access-control-allow-credentials
true
observe-browsing-topics
?1
expires
Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin
https://d2emu.com
x-auction-status
15
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection
0
content-type
application/json; charset=utf-8
vary
Accept-Encoding
POST
H2
200
prebid Show response
ib.adnxs.com/ut/v3/
250 B
811 B
680ms
316ms
Fetch
application/json
68.67.181.102
ASN-APPNEX
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
03e3052b23904b94a0cbcbacd52f965bf72ac025d1953332dffd1248cd04a902
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
https://d2emu.com
an-x-request-uuid
dd6715d9-1599-45cb-958c-4fa963969dd2
content-length
250
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:38 GMT
x-xss-protection
0
content-type
application/json; charset=utf-8
server
nginx/1.25.5
POST
H2
204
request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/
0
484 B
736ms
377ms
Fetch
74.119.117.12
AS-CRITEO
General
Full URL
https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.40.0&cb=87762892830&lsavail=1&bundle=YIMu9V8weVAlMkZ0a28yOXFSejNkOTRDRWVLYU8yYUVuamxGQzdMWFNRN0VsMmRWd1lvV2JwcEclMkZXV1RKbmd1Ulh0RW5yVWF1YkptdjkxaEhrNm5Qdjd6RWNGN0o2S2dlJTJGWVNidk43NmJOc3hHaWhnSmdPY3RkNlFCSWNlWXplMzhCNlU1UQ&networkId=7413
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
observe-browsing-topics
?1
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:37 GMT
vary
Origin
server
Kestrel
POST
H2
200
Nitro Show response
direct.adsrvr.org/bid/bidder/
0
242 B
514ms
217ms
Fetch
application/json
199.250.161.129
TTD-ASN-01
General
Full URL
https://direct.adsrvr.org/bid/bidder/Nitro
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.3
cache-control
private
access-control-allow-credentials
true
access-control-allow-origin
https://d2emu.com
content-length
0
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
application/json
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
POST
H2
204
prebid Show response
exchange.postrelease.com/
0
305 B
651ms
262ms
Fetch
34.230.249.135
AMAZON-AES
General
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_eid=W3sic291cmNlIjoiY3JpdGVvLmNvbSIsInVpZHMiOlt7ImlkIjoiQXJxTUcxOW1ZV2xVTUVOdmMxRldUR1ExWjBWaVIyVTVTRGwzV0d4aFFWUXljbWxaUVU5b1EzbGlOa1l3V21Gbk5tWlhhMWg1VlU5WlYzRmlkVGxoTW1GWFZHNTZNU1V5UWpoeGFTVXlSamxMTUVSWFJWZEJVRzVFUkZWMVpWRWxNMFFsTTBRIiwiYXR5cGUiOjF9XX0seyJzb3VyY2UiOiJwdWJjaWQub3JnIiwidWlkcyI6W3siaWQiOiIzMjM4ZjZhYS02MDQzLTQyMTMtOWE5Ny1jODJmNTc1MDgwMmIiLCJhdHlwZSI6MX1dfSx7InNvdXJjZSI6ImFkc2VydmVyLm9yZyIsInVpZHMiOlt7ImlkIjoiNDZmNGFmOTEtMmJhMy00MzA1LTg5NmMtYzI1ODk2MGQyZjgyIiwiYXR5cGUiOjEsImV4dCI6eyJydGlQYXJ0bmVyIjoiVERJRCJ9fV19XQ==&us_privacy=1---&ntv_ptd=1662105&ntv_pas=eyIxNjYyMTA1IjpbWzE2MCw2MDBdLFszMDAsNjAwXSxbMzAwLDI1MF1dLCJsZW5ndGgiOjF9&ntv_ppf=eyJiYW5uZXItbGVmdCI6eyJiYW5uZXIiOnsiMTYweDYwMCI6MC4wMSwiMzAweDYwMCI6MC4wMSwiMzAweDI1MCI6MC4wMSwiKiI6MC4wMX0sIioiOnt9fX0=&ntv_pbv=v9.40.0&ntv_pb_rid=1914b201c2918cd&ntv_ppc=W3siYWRVbml0Q29kZSI6ImJhbm5lci1sZWZ0IiwibWVkaWFUeXBlcyI6eyJiYW5uZXIiOnsic2l6ZXMiOltbMTYwLDYwMF0sWzMwMCw2MDBdLFszMDAsMjUwXV0sInBvcyI6MX19fV0=&ntv_dbr=eyJiYW5uZXItbGVmdCI6MH0=&ntv_url=https%3A%2F%2Fd2emu.com%2F
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.230.249.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-249-135.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
access-control-allow-credentials
true
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
https://d2emu.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:38 GMT
server
nginx/1.12.2
POST
H2
200
prebid Show response
prebid.media.net/rtb/
1 KB
1 KB
482ms
236ms
Fetch
application/json
34.120.63.153
GOOGLE-CLOUD-PLAT...
General
Full URL
https://prebid.media.net/rtb/prebid?cid=8CU87559X
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
153.63.120.34.bc.googleusercontent.com
Software
envoy /
Resource Hash
bf7c7c6aca9e5288d6a50b7151fd58cac82c661cd0154e887fff7244036e92e8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
max-age=0, no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
accept-ch
Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time
147
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
expires
Mon, 11 Aug 2025 22:12:37 GMT
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
application/json;charset=utf-8
server
envoy
POST
H2
204
openrtb Show response
adx2.adform.net/adx/
0
527 B
619ms
249ms
Fetch
185.167.164.48
ADFORM Adform A/S
General
Full URL
https://adx2.adform.net/adx/openrtb
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
POST,OPTIONS
expires
-1
access-control-allow-origin
https://d2emu.com
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date
Mon, 11 Aug 2025 22:12:38 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
POST
H/1.1
204
No Content
64ad08781b504dd7d06be9f7 Show response
prebid.cootlogix.com/prebid/multi/
0
1 KB
756ms
397ms
Fetch
138.197.62.132
DIGITALOCEAN-ASN
General
Full URL
https://prebid.cootlogix.com/prebid/multi/64ad08781b504dd7d06be9f7
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.62.132 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin
https://d2emu.com
cache-control
max-age=0, no-cache, must-revalidate, proxy-revalidate
date
Mon, 11 Aug 2025 22:12:38 GMT
vary
Accept-Encoding
access-control-allow-credentials
true
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
POST
H/1.1
204
No Content
64ad05fa1b504dd7d06babfb Show response
prebid.cootlogix.com/prebid/multi/
0
1 KB
732ms
374ms
Fetch
138.197.62.132
DIGITALOCEAN-ASN
General
Full URL
https://prebid.cootlogix.com/prebid/multi/64ad05fa1b504dd7d06babfb
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.62.132 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin
https://d2emu.com
cache-control
max-age=0, no-cache, must-revalidate, proxy-revalidate
date
Mon, 11 Aug 2025 22:12:38 GMT
vary
Accept-Encoding
access-control-allow-credentials
true
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
POST
H2
200
v1 Show response
btlr.sharethrough.com/universal/
25 KB
16 KB
679ms
356ms
Fetch
application/json
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
117164b0cfb00280b6229835f1e59324f4aed7382973ccb85a701b8e9b5e01d5
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.5
strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
content-length
15766
content-type
application/json; charset=utf-8
access-control-allow-credentials
true
POST
H2
200
v1 Show response
btlr.sharethrough.com/universal/
548 B
716 B
644ms
323ms
Fetch
application/json
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
1434fa787455922fe78cf84f0e691fd0e8d74cffaa0d6aa7326411dddd583e5f
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.5
strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
content-length
361
content-type
application/json; charset=utf-8
access-control-allow-credentials
true
POST
H2
200
v1 Show response
btlr.sharethrough.com/universal/
652 B
771 B
678ms
355ms
Fetch
application/json
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
d2d969ad2181a46c688d5a7783a6b4282d569e6b368fce9de8af9468cf05032d
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.5
strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
content-length
416
content-type
application/json; charset=utf-8
access-control-allow-credentials
true
POST
H2
204
v1 Show response
btlr.sharethrough.com/universal/
0
116 B
574ms
252ms
Fetch
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
access-control-allow-credentials
true
POST
H2
200
prebidjs Show response
rtb.openx.net/openrtbb/
53 B
380 B
400ms
152ms
Fetch
text/plain
35.186.253.211
GOOGLE-CLOUD-PLAT...
General
Full URL
https://rtb.openx.net/openrtbb/prebidjs
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
/
Resource Hash
c9a49a74a219b8c11a6c968e7957027c225c9ca78a8cfaee2a85be1ac3551dde

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-forwarded-for
212.104.215.93
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/plain
vary
Origin
POST
H2
200
prebidjs Show response
rtb.openx.net/openrtbb/
53 B
222 B
399ms
152ms
Fetch
text/plain
35.186.253.211
GOOGLE-CLOUD-PLAT...
General
Full URL
https://rtb.openx.net/openrtbb/prebidjs
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
/
Resource Hash
8c88baa59d7fdd0470b6b1f947cd616b4ce7ab0029693e6a9eeaae9bc0d4f452

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-forwarded-for
212.104.215.93
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/plain
vary
Origin
GET
H2
200
trustedIframe.html Show response
btloader.com/ Frame 81A2
4 KB
2 KB
258ms
101ms
Document
text/html
104.20.20.189
CLOUDFLARENET
General
Full URL
https://btloader.com/trustedIframe.html?o=6278260873756672&tid=JjPTNd623-33xtL7NC9-989b314d02&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0859e704d6c17bc40690f45d57d47d7c53683ab2f597e2e37a8900ac247a052

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cf-ray
96db1357c9ebadb4-SEA
content-encoding
br
content-type
text/html
date
Mon, 11 Aug 2025 22:12:37 GMT
server
cloudflare
vary
Accept-Encoding
GET
H2
200
country Show response
api.btloader.com/
37 B
215 B
323ms
146ms
Fetch
application/json
130.211.23.194
GOOGLE-CLOUD-PLAT...
General
Full URL
https://api.btloader.com/country?o=6278260873756672
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash
63c8a71e02dad8f567226247d5694840937f61e94ddb0c49288e8e68873c6097

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
application/json
vary
Origin
POST
H2
204
pv
api.btloader.com/
0
0
320ms
146ms
Fetch
130.211.23.194
GOOGLE-CLOUD-PLAT...
General
Full URL
https://api.btloader.com/pv?nlf=false&tid=JjPTNd623-33xtL7NC9-989b314d02&sid=aviR4Qs5-TSPzX6Pq-989b314d02&cv=2.1.133&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
194.23.211.130.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

via
1.1 google
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:37 GMT
vary
Origin
GET
H2
200
bounce Show response
id5-sync.com/
30 B
298 B
229ms
226ms
Fetch
text/plain
162.19.138.83
OVH OVH SAS
General
Full URL
https://id5-sync.com/bounce
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31532338.ip-162-19-138.eu
Software
/
Resource Hash
b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/plain;charset=utf-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials
true
GET
H/1.1
200
OK
v1 Show response
lbs.eu-1-id5-sync.com/lbs/
54 B
224 B
947ms
415ms
Fetch
application/json
135.125.247.202
OVH OVH SAS
General
Full URL
https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
135.125.247.202 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software
/
Resource Hash
c51149b7048660bb26070669d1b1789024965d72d9f5a8de3b8d93f16e6bf6f1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

access-control-allow-origin
https://d2emu.com
content-length
54
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/json
vary
Origin
GET
H2
200
v1 Show response
lb.eu-1-id5-sync.com/lb/
45 B
328 B
934ms
407ms
Fetch
application/json
162.19.138.118
OVH OVH SAS
General
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31533569.ip-162-19-138.eu
Software
/
Resource Hash
0c11913ac100bc6f46ad30976b2be8b17b2c10f13aa99e6e4b47ca7b058e1c1a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
GET
H3
200
setuid
pbs.nitropay.com/
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fpbs.nitropay.com%252Fsetuid%253Fbidder%253Dappnexus%2526gdpr%253D%2526gdpr_consent%253D%2526gpp%253D%2526gpp_sid%253D%2526f%253Di%2526uid...
  • https://pbs.nitropay.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1820804327581032944
86 B
104 B
128ms
128ms
Image
image/png
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1820804327581032944
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
86
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
image/png
vary
Accept-Encoding,Origin

Redirect headers

cache-control
no-store, no-cache, private
location
https://pbs.nitropay.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1820804327581032944
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
201807cd-5b24-4069-a9d6-e5585e6f25ee
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:38 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
200
da657530-03e5-4306-95bc-d4eb370426c9 Show response
config.aps.amazon-adsystem.com/configs/
563 B
830 B
616ms
255ms
Script
application/javascript
18.160.10.80
AMAZON-02
General
Full URL
https://config.aps.amazon-adsystem.com/configs/da657530-03e5-4306-95bc-d4eb370426c9
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.160.10.80 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-160-10-80.iad12.r.cloudfront.net
Software
CloudFront /
Resource Hash
1c73721ff306c814b31f7382bebb10fa78fffe7cb09260f79e1c865148ec61fd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=3600
age
1872
via
1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
content-length
563
x-amz-cf-id
4vk7ssJ75x1cGRGDnTtfdyJWa2LDU7kjkDUBLT0j5wGNNesboau8mw==
date
Mon, 11 Aug 2025 21:41:26 GMT
content-type
application/javascript
x-amz-cf-pop
IAD12-P3
server
CloudFront
GET
H2
200
config Show response
c.amazon-adsystem.com/cdn/prod/
4 KB
4 KB
221ms
218ms
XHR
application/json
3.171.86.171
AMAZON-02
General
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fd2emu.com&pubid=da657530-03e5-4306-95bc-d4eb370426c9
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-86-171.iad89.r.cloudfront.net
Software
Server /
Resource Hash
939b03f353d4b8fb5b1c0106d7f933270865e2eaf3f2ae3f883a65704c5c1f95

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=21550, s-maxage=21600
age
1895
access-control-allow-credentials
true
via
1.1 e4ed21ef6440d05d23aa2a82e459e776.cloudfront.net (CloudFront)
access-control-allow-origin
https://d2emu.com
x-cache
Hit from cloudfront
content-length
3901
x-amz-cf-id
P-dU-cvc57F6h-dGjB2uMrhoh_Bf8NW28ZfpGejobgHJzx8w4872PQ==
date
Mon, 11 Aug 2025 21:41:02 GMT
content-type
application/json;charset=UTF-8
x-amz-cf-pop
IAD89-P3
server
Server
GET
H2
200
aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/
6 KB
3 KB
609ms
254ms
XHR
application/javascript
3.171.86.171
AMAZON-02
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-86-171.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

access-control-max-age
3000
content-encoding
gzip
x-amz-version-id
r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag
W/"a4d296427fc806b21335359e398c025c"
age
29142
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
SWkUqHS07q_TV_DMfUnqSwJVWDQoiCfsDmQRfDUJDjzIhucw0eAjHA==
date
Mon, 11 Aug 2025 14:06:57 GMT
content-type
application/javascript
vary
Origin,accept-encoding
last-modified
Thu, 29 Feb 2024 02:13:08 GMT
cache-control
public, max-age=86400
via
1.1 04eae9f89d461f79682103da6d0e3f4e.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
POST
H2
200
auction Show response
pbs.nitropay.com/openrtb2/
254 B
314 B
171ms
168ms
Fetch
application/json
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/openrtb2/auction
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
735e2c2f0b1f46333edf69c308fce1ea2a83d66ee0679ade54bee4441f01f501

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
expires
0
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
254
date
Mon, 11 Aug 2025 22:12:38 GMT
x-prebid
pbs-go/3.16.0
content-type
application/json
vary
Accept-Encoding,Origin
POST
H2
200
v1 Show response
btlr.sharethrough.com/universal/
471 B
655 B
258ms
255ms
Fetch
application/json
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
b71bb9c50bb3dff96ef607712cf69a556e6ae01bb98e230a522234b7613d6753
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.5
strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
content-length
300
content-type
application/json; charset=utf-8
access-control-allow-credentials
true
POST
H2
200
v1 Show response
btlr.sharethrough.com/universal/
390 B
592 B
327ms
325ms
Fetch
application/json
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
3d2f48f4b2f4f9d9699d1dea3d0b57254b60e6397d42f12aafdb08a5a0c335d1
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.5
strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
content-length
237
content-type
application/json; charset=utf-8
access-control-allow-credentials
true
POST
H2
200
v1 Show response
btlr.sharethrough.com/universal/
470 B
667 B
256ms
253ms
Fetch
application/json
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
e65844f1aad042c0abf31cc26bf740cbcd42b93f23108afec02f6cce715201a9
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.5
strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
content-length
312
content-type
application/json; charset=utf-8
access-control-allow-credentials
true
POST
H2
204
v1 Show response
btlr.sharethrough.com/universal/
0
115 B
185ms
183ms
Fetch
34.236.157.112
AMAZON-AES
General
Full URL
https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.236.157.112 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-236-157-112.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
access-control-allow-origin
https://d2emu.com
access-control-allow-credentials
true
POST
H2
200
request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/
2 KB
2 KB
339ms
336ms
Fetch
application/json
74.119.117.12
AS-CRITEO
General
Full URL
https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.40.0&cb=31359373458&lsavail=1&bundle=YIMu9V8weVAlMkZ0a28yOXFSejNkOTRDRWVLYU8yYUVuamxGQzdMWFNRN0VsMmRWd1lvV2JwcEclMkZXV1RKbmd1Ulh0RW5yVWF1YkptdjkxaEhrNm5Qdjd6RWNGN0o2S2dlJTJGWVNidk43NmJOc3hHaWhnSmdPY3RkNlFCSWNlWXplMzhCNlU1UQ&networkId=7413
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.12 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e7d84a8f645dd09975607b798295363790a72582cc78be44b4619198f8d4c39c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
content-encoding
br
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
observe-browsing-topics
?1
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/json
vary
Accept-Encoding, Origin
server
Kestrel
POST
H/1.1
200
OK
64ad08781b504dd7d06be9f7 Show response
prebid.cootlogix.com/prebid/multi/
68 KB
43 KB
651ms
573ms
Fetch
application/json
138.197.62.132
DIGITALOCEAN-ASN
General
Full URL
https://prebid.cootlogix.com/prebid/multi/64ad08781b504dd7d06be9f7
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.62.132 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
689c2684dc773ae85f05a1c6d644b83b3561a23cf5ce853f7c0b690b7460edae

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

transfer-encoding
chunked
cache-control
max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
POST
H/1.1
204
No Content
64ad05fa1b504dd7d06babfb Show response
prebid.cootlogix.com/prebid/multi/
0
1 KB
521ms
420ms
Fetch
138.197.62.132
DIGITALOCEAN-ASN
General
Full URL
https://prebid.cootlogix.com/prebid/multi/64ad05fa1b504dd7d06babfb
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.62.132 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin
https://d2emu.com
cache-control
max-age=0, no-cache, must-revalidate, proxy-revalidate
date
Mon, 11 Aug 2025 22:12:38 GMT
vary
Accept-Encoding
access-control-allow-credentials
true
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
POST
H2
200
prebid Show response
prebid.media.net/rtb/
1 KB
882 B
231ms
228ms
Fetch
application/json
34.120.63.153
GOOGLE-CLOUD-PLAT...
General
Full URL
https://prebid.media.net/rtb/prebid?cid=8CU87559X
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
153.63.120.34.bc.googleusercontent.com
Software
envoy /
Resource Hash
e7ca36e60717fcc9a324c3a21d874ddc2124956b8b2e64acce1673526c6d54ce

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
max-age=0, no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
accept-ch
Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
x-envoy-upstream-service-time
140
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
expires
Mon, 11 Aug 2025 22:12:38 GMT
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/json;charset=utf-8
server
envoy
POST
H2
204
openrtb Show response
adx2.adform.net/adx/
0
526 B
256ms
254ms
Fetch
185.167.164.48
ADFORM Adform A/S
General
Full URL
https://adx2.adform.net/adx/openrtb
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
POST,OPTIONS
expires
-1
access-control-allow-origin
https://d2emu.com
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date
Mon, 11 Aug 2025 22:12:38 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
POST
H2
200
prebidjs Show response
rtb.openx.net/openrtbb/
53 B
222 B
204ms
201ms
Fetch
text/plain
35.186.253.211
GOOGLE-CLOUD-PLAT...
General
Full URL
https://rtb.openx.net/openrtbb/prebidjs
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
/
Resource Hash
b94172b220c873c44f70df6027fc04b4ff97e44dbd0246f438d92815201ff9d6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-forwarded-for
212.104.215.93
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
text/plain
vary
Origin
POST
H2
200
prebidjs Show response
rtb.openx.net/openrtbb/
53 B
222 B
90ms
88ms
Fetch
text/plain
35.186.253.211
GOOGLE-CLOUD-PLAT...
General
Full URL
https://rtb.openx.net/openrtbb/prebidjs
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
211.253.186.35.bc.googleusercontent.com
Software
/
Resource Hash
735ef4f1d6abe07cdc70ff53d3de1a4f5329be1e85bd76631eb116f99554193f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-forwarded-for
212.104.215.93
access-control-allow-credentials
true
observe-browsing-topics
?1
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
77
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
text/plain
vary
Origin
POST
H2
200
auction Show response
tlx.3lift.com/header/
19 B
1 KB
320ms
318ms
Fetch
application/json
3.208.175.5
AMAZON-AES
General
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=9.40.0&referrer=https%3A%2F%2Fd2emu.com%2F&tmax=1200&us_privacy=1---
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.208.175.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-208-175-5.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
accept-ch
sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width
access-control-allow-credentials
true
observe-browsing-topics
?1
expires
Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin
https://d2emu.com
x-auction-status
15
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection
0
content-type
application/json; charset=utf-8
vary
Accept-Encoding
POST
H2
204
prebid Show response
exchange.postrelease.com/
0
304 B
224ms
223ms
Fetch
34.230.249.135
AMAZON-AES
General
Full URL
https://exchange.postrelease.com/prebid?ntv_pb_eid=W3sic291cmNlIjoiY3JpdGVvLmNvbSIsInVpZHMiOlt7ImlkIjoiQXJxTUcxOW1ZV2xVTUVOdmMxRldUR1ExWjBWaVIyVTVTRGwzV0d4aFFWUXljbWxaUVU5b1EzbGlOa1l3V21Gbk5tWlhhMWg1VlU5WlYzRmlkVGxoTW1GWFZHNTZNU1V5UWpoeGFTVXlSamxMTUVSWFJWZEJVRzVFUkZWMVpWRWxNMFFsTTBRIiwiYXR5cGUiOjF9XX0seyJzb3VyY2UiOiJwdWJjaWQub3JnIiwidWlkcyI6W3siaWQiOiIzMjM4ZjZhYS02MDQzLTQyMTMtOWE5Ny1jODJmNTc1MDgwMmIiLCJhdHlwZSI6MX1dfSx7InNvdXJjZSI6ImFkc2VydmVyLm9yZyIsInVpZHMiOlt7ImlkIjoiNDZmNGFmOTEtMmJhMy00MzA1LTg5NmMtYzI1ODk2MGQyZjgyIiwiYXR5cGUiOjEsImV4dCI6eyJydGlQYXJ0bmVyIjoiVERJRCJ9fV19XQ==&us_privacy=1---&ntv_ptd=1662105&ntv_pas=eyIxNjYyMTA1IjpbWzE2MCw2MDBdLFszMDAsNjAwXSxbMzAwLDI1MF1dLCJsZW5ndGgiOjF9&ntv_ppf=eyJiYW5uZXItcmlnaHQiOnsiYmFubmVyIjp7IjE2MHg2MDAiOjAuMDEsIjMwMHg2MDAiOjAuMDEsIjMwMHgyNTAiOjAuMDEsIioiOjAuMDF9LCIqIjp7fX19&ntv_pbv=v9.40.0&ntv_pb_rid=6414ea9bfd8798e8&ntv_ppc=W3siYWRVbml0Q29kZSI6ImJhbm5lci1yaWdodCIsIm1lZGlhVHlwZXMiOnsiYmFubmVyIjp7InNpemVzIjpbWzE2MCw2MDBdLFszMDAsNjAwXSxbMzAwLDI1MF1dLCJwb3MiOjF9fX1d&ntv_dbr=eyJiYW5uZXItbGVmdCI6MCwiYmFubmVyLXJpZ2h0IjowfQ==&ntv_url=https%3A%2F%2Fd2emu.com%2F
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.230.249.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-249-135.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma
no-cache
access-control-allow-credentials
true
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
https://d2emu.com
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:38 GMT
server
nginx/1.12.2
POST
H2
200
prebid Show response
ib.adnxs.com/ut/v3/
257 B
1 KB
317ms
315ms
Fetch
application/json
68.67.181.102
ASN-APPNEX
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
a361d78943f989e9e9ed372884070d274e1885d14e2d59ac68de642ce96e1ed4
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
https://d2emu.com
an-x-request-uuid
8b955267-d4c1-4a27-8405-5f1b54cffa38
content-length
257
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:38 GMT
x-xss-protection
0
content-type
application/json; charset=utf-8
server
nginx/1.25.5
POST
H2
200
Nitro Show response
direct.adsrvr.org/bid/bidder/
0
22 B
216ms
213ms
Fetch
application/json
199.250.161.129
TTD-ASN-01
General
Full URL
https://direct.adsrvr.org/bid/bidder/Nitro
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-openrtb-version
2.3
cache-control
private
access-control-allow-credentials
true
access-control-allow-origin
https://d2emu.com
content-length
0
date
Mon, 11 Aug 2025 22:12:37 GMT
content-type
application/json
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
GET
H2
200
pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/
67 KB
22 KB
602ms
220ms
Script
application/javascript
184.24.70.89
AKAMAI-AS
General
Full URL
https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-24-70-89.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
45bc6978e281a938d9485dcbf0859159b24e2f7c9b8b0fafc120b9606e0ea8b1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=900
content-encoding
gzip
etag
"10ab4-63a0ee37f7c40-gzip"
expires
Mon, 11 Aug 2025 22:27:38 GMT
accept-ranges
bytes
content-length
21994
date
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Wed, 16 Jul 2025 17:04:41 GMT
content-type
application/javascript
server
Apache
vary
Accept-Encoding
GET
H2
200
sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/
43 KB
13 KB
614ms
253ms
Script
text/javascript
3.167.69.118
AMAZON-02
General
Full URL
https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.167.69.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-167-69-118.iad61.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0112a49b64f28c6cd08c2cf9a692d0d5455d585010329b59bf84cbf9ede8fa7a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

vary
Accept-Encoding
cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"f9c27abb935f20b032ddcea538357fad"
age
22653
via
1.1 8655f0ddb998d96b4c041ee2f039c0b2.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
vCrA4FNPmWG4W_dOyppcnqzMkwObqLUhN3CTrAAJBGNJ6SiiDkHkdg==
date
Mon, 11 Aug 2025 15:55:07 GMT
content-type
text/javascript
last-modified
Wed, 06 Aug 2025 15:21:32 GMT
server
AmazonS3
x-amz-cf-pop
IAD61-P6
x-amz-server-side-encryption
AES256
GET
H2
200
ima.js Show response
cdn-ima.33across.com/
16 KB
7 KB
329ms
91ms
Script
application/javascript
104.18.28.101
CLOUDFLARENET
General
Full URL
https://cdn-ima.33across.com/ima.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.28.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
311d797e71caa3d404a32e254fb2a7e84300858aa61ca84623281b6c68a93940

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
public, max-age=259200
content-encoding
gzip
cf-cache-status
HIT
etag
W/"6894eec2-41f2"
age
272889
cf-ray
96db135c6c111565-SEA
expires
Thu, 14 Aug 2025 22:12:38 GMT
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/javascript
last-modified
Thu, 07 Aug 2025 18:21:54 GMT
vary
Accept-Encoding
server
cloudflare
GET
H2
200
720 Show response
a.ad.gt/api/v1/u/matches/
Redirect Chain
  • https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fd2emu.com%2F&ref=&_it=amazon&partner_id=720
  • https://a.ad.gt/api/v1/u/matches/720?_it=nitro
6 KB
0
149ms
149ms
Script
application/javascript
104.20.35.150
CLOUDFLARENET
General
Full URL
https://a.ad.gt/api/v1/u/matches/720?_it=nitro
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bb11394fc8bafba35aea4c657751135177e7cc39b4c60152d1cab652e323c05

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=7200
content-encoding
gzip
cf-cache-status
HIT
age
639
cross-origin-resource-policy
cross-origin
cf-ray
96db135c1b12ec27-SEA
date
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Mon, 11 Aug 2025 20:22:12 GMT
content-type
application/javascript
vary
accept-encoding
server
cloudflare

Redirect headers

cf-ray
96db135aee07ebea-SEA
location
https://a.ad.gt/api/v1/u/matches/720?_it=nitro
date
Mon, 11 Aug 2025 22:12:38 GMT
vary
accept-encoding
server
cloudflare
GET
H2
200
id5-api.js Show response
cdn.id5-sync.com/api/1.0/
106 KB
30 KB
82ms
81ms
Script
text/javascript
104.20.23.13
CLOUDFLARENET
General
Full URL
https://cdn.id5-sync.com/api/1.0/id5-api.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.23.13 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e054e8ba11b0c11c9443970118657c6dfc43e76ae01f75246efeb1f80ebe7e6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-amz-id-2
+RHjYWM/vlbD8wFb7rfRm905JQKyGI0Am4RrTNP/ui5vN2Q40dbqkYw/RAngcXEQNpJgTaXBqnE=
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=3600
content-encoding
br
cf-cache-status
HIT
etag
W/"eea3e91e904db177468d4bef91dcdf05"
age
1284
x-amz-request-id
YRGR4E4TSSN3TKG6
cf-ray
96db135ae963eb3a-SEA
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
text/javascript;charset=utf-8
last-modified
Tue, 29 Jul 2025 12:29:41 GMT
vary
accept-encoding
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame D9ED
101 KB
28 KB
419ms
141ms
Document
text/html
192.178.218.156
GOOGLE
General
Full URL
https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.218.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadtq-in-f156.1e100.net
Software
sffe /
Resource Hash
7feb8c059403c0e1f327f3155c8179eeb04cbb50650633c201e8bf7b86cf7d9a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
2717
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000, stale-while-revalidate=3600
content-encoding
br
content-length
28946
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 21:27:21 GMT
expires
Mon, 11 Aug 2025 22:17:21 GMT
last-modified
Mon, 11 Aug 2025 19:43:01 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
esp.js Show response
oa.openxcdn.net/
24 KB
8 KB
319ms
85ms
Script
application/javascript
34.102.146.192
GOOGLE-CLOUD-PLAT...
General
Full URL
https://oa.openxcdn.net/esp.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
192.146.102.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
1
content-encoding
gzip
x-goog-hash
crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag
"df5542b88bc0e368c6999754a5b9e2ba"
age
2590051
x-goog-stored-content-encoding
gzip
expires
Sun, 12 Jul 2026 22:45:07 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
7927
date
Sat, 12 Jul 2025 22:45:07 GMT
last-modified
Thu, 27 May 2021 18:30:51 GMT
content-type
application/javascript
x-guploader-uploadid
ABgVH8-08IRPvceSNqXO1IiVjTiQqLoy4VfO6jwZliiOy2lZ24NDDq6McRuEys09PPCVgG3npmbroL8
cache-control
no-transform
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
x-goog-generation
1622140251693895
content-length
7927
server
UploadServer
GET
H2
200
publishertag.ids.js Show response
static.criteo.net/js/ld/
42 KB
13 KB
597ms
315ms
Script
text/javascript
74.119.117.47
AS-CRITEO
General
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
c0490ecc02570b13a5399298c660abe517bdee07653099b20a327cc320586396
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
max-age=86400, public
timing-allow-origin
*
content-encoding
gzip
cross-origin-resource-policy
cross-origin
expires
Tue, 12 Aug 2025 22:12:38 GMT
access-control-allow-origin
*
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
text/javascript
vary
x-geo-country
server
nginx
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
30 KB
3 KB
496ms
495ms
Fetch
text/plain
192.178.218.156
GOOGLE
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6923490710862463&correlator=3461844593333152&eid=31093718%2C31093963%2C31093999%2C83321072&output=ldjh&gdfp_req=1&vrg=202508070101&ptt=17&impl=fif&us_privacy=1---&iu_parts=308365556%3A23047622496%2Cnitro-banner%2Cnitro-banner-1773&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600%7C300x600%7C300x250%7C300x225%7C3x1&ifi=2&dids=banner-left&adfs=1226833606&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1754950358397&lmt=1754950358&adxs=53&adys=60&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fd2emu.com%2F&vis=1&psz=1600x2008&msz=266x2008&fws=4&ohw=1600&topics=9&tps=9&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDMyMzhmNmFhLTYwNDMtNDIxMy05YTk3LWM4MmY1NzUwODAyYlgBEjYKDGFkc2VydmVyLm9yZxIkNDZmNGFmOTEtMmJhMy00MzA1LTg5NmMtYzI1ODk2MGQyZjgyWAESHQoOZXNwLmNyaXRlby5jb20Y9arF2YkzSABSAghkEhQKBW9wZW54GPSqxdmJM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1754950354020&idt=3845&ppid=3238f6aa604342139a97c82f5750802b&prev_scp=refresh%3D30%26ncpm%3D0.23%26exp.floors%3Dyes%26nver%3D4%26domain%3Dd2emu.com%26hostname%3Dd2emu.com%26contax%3D680%252C687%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.23%26hb_adid%3D7276267c0bae8018%26hb_bidder%3Dsharethrough%26pos%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=2000078228&frm=20&eoidce=1&gblpids=%2Fnitro%2F1387%2F1773%2Fbanner-left&pbbce=1&td=1&egid=29660&tan=01035a1f-e623-4cc5-994b-85bd8508d806&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.218.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadtq-in-f156.1e100.net
Software
cafe /
Resource Hash
6b917ea4df0c282c1facfdcb1949b656124b6403a92d65b19ef5faeb7a7075fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
dcb
google-lineitem-id
7013947187
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138495032254
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://d2emu.com
content-length
2538
x-xss-protection
0
server
cafe
GET
H3
200
container.html Show response
257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame D409
7 KB
3 KB
431ms
142ms
Document
text/html
142.251.179.132
GOOGLE
General
Full URL
https://257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:38 GMT
expires
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
setuid
pbs.nitropay.com/
Redirect Chain
  • https://jadserve.postrelease.com/suid/101787?gdpr=&gdpr_consent=&us_privacy=1---&ntv_gpp_consent=&ntv_r=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dnativo%26gdpr%3D%26gdpr_consent%3D%26gpp%3...
  • https://pbs.nitropay.com/setuid?bidder=nativo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=348a1407-ed92-4fcf-a8e7-6746b2b37265
86 B
104 B
128ms
127ms
Image
image/png
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/setuid?bidder=nativo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=348a1407-ed92-4fcf-a8e7-6746b2b37265
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
86
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
image/png
vary
Accept-Encoding,Origin

Redirect headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
location
https://pbs.nitropay.com/setuid?bidder=nativo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=348a1407-ed92-4fcf-a8e7-6746b2b37265
pragma
no-cache
expires
Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin
*
content-length
0
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:38 GMT
server
nginx
GET
H2
200
envelope Show response
lexicon.33across.com/v1/
49 B
245 B
316ms
147ms
XHR
application/json
35.244.193.51
GOOGLE-CLOUD-PLAT...
General
Full URL
https://lexicon.33across.com/v1/envelope?pid=0010b00002VqwyFAAR&src=aps&ver=1.17.1&us_privacy=1---
Requested by
Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ima.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
51.193.244.35.bc.googleusercontent.com
Software
/
Resource Hash
d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-type
application/x-www-form-urlencoded
Referer
https://d2emu.com/

Response headers

cache-control
private, must-revalidate, max-age=28800
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
49
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/json
vary
origin
GET
H2
200
720 Show response
a.ad.gt/api/v1/u/matches/
Redirect Chain
  • https://cdn.hadronid.net/hadron.js?partner_id=720&sync=1&url=https%3A%2F%2Fd2emu.com%2F
  • https://a.ad.gt/api/v1/u/matches/720?_it=nitro
6 KB
0
1ms
1ms
Script
application/javascript
104.20.35.150
CLOUDFLARENET
General
Full URL
https://a.ad.gt/api/v1/u/matches/720?_it=nitro
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bb11394fc8bafba35aea4c657751135177e7cc39b4c60152d1cab652e323c05

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=7200
content-encoding
gzip
cf-cache-status
HIT
age
639
cross-origin-resource-policy
cross-origin
cf-ray
96db135c1b12ec27-SEA
date
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Mon, 11 Aug 2025 20:22:12 GMT
content-type
application/javascript
vary
accept-encoding
server
cloudflare

Redirect headers

cf-ray
96db135df89cebea-SEA
location
https://a.ad.gt/api/v1/u/matches/720?_it=nitro
date
Mon, 11 Aug 2025 22:12:38 GMT
vary
accept-encoding
server
cloudflare
GET
H2
200
720 Show response
p.ad.gt/api/v1/p/
39 KB
14 KB
262ms
92ms
Script
application/javascript
104.20.35.150
CLOUDFLARENET
General
Full URL
https://p.ad.gt/api/v1/p/720
Requested by
Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?partner_id=720&_it=prebid
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
91a3f7510621bde15f34cc5e6d24aaf92f4c6ee2eca186d9db240933c549dbcc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
max-age=14400
content-encoding
gzip
cf-cache-status
HIT
age
2124
cf-ray
96db135f1e47c37c-SEA
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/javascript
vary
accept-encoding
server
cloudflare
last-modified
Mon, 11 Aug 2025 21:37:14 GMT
GET
H2
200
ip_match
ids4.ad.gt/api/v1/
0
244 B
432ms
195ms
Image
text/html
54.68.43.194
AMAZON-02
General
Full URL
https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001754950359-F403QUO3-TPC1
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.68.43.194 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-68-43-194.us-west-2.compute.amazonaws.com
Software
timberwolf /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-length
0
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
text/html; charset=utf-8
server
timberwolf
POST
H2
200
v3 Show response
id5-sync.com/gm/
1 KB
2 KB
449ms
448ms
XHR
application/json
162.19.138.83
OVH OVH SAS
General
Full URL
https://id5-sync.com/gm/v3
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31532338.ip-162-19-138.eu
Software
/
Resource Hash
501020fc10e96e8078373a059779d29730ddd579d5f8834574e7fc295a2eea9e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://d2emu.com
p3p
CP="CAO PSA OUR"
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/json
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET
H2
200
esp Show response
oajs.openx.net/
Redirect Chain
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fd2emu.com%2F&rid=esp
  • https://oajs.openx.net/esp?url=https%3A%2F%2Fd2emu.com%2F&rid=esp&cc=1
85 B
193 B
128ms
124ms
Fetch
application/json
34.120.135.53
GOOGLE-CLOUD-PLAT...
General
Full URL
https://oajs.openx.net/esp?url=https%3A%2F%2Fd2emu.com%2F&rid=esp&cc=1
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
53.135.120.34.bc.googleusercontent.com
Software
/ Express
Resource Hash
c376f8a2532b0626636f0332869e2e2f7c4404609ec53483dce792b5f46c4e79

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
W/"55-2dndFVRW3pSf2PSnLIaiQK1eK/M"
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
85
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/json; charset=utf-8
x-powered-by
Express
vary
Origin

Redirect headers

location
/esp?url=https%3A%2F%2Fd2emu.com%2F&rid=esp&cc=1
access-control-allow-credentials
true
via
1.1 google
access-control-allow-origin
https://d2emu.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Mon, 11 Aug 2025 22:12:39 GMT
x-powered-by
Express
vary
Origin
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
30 KB
3 KB
489ms
489ms
Fetch
text/plain
192.178.218.156
GOOGLE
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6923490710862463&correlator=3498415411212507&eid=31093718%2C31093963%2C31093999%2C83321072&output=ldjh&gdfp_req=1&vrg=202508070101&ptt=17&impl=fif&us_privacy=1---&iu_parts=308365556%3A23047622496%2Cnitro-banner%2Cnitro-banner-1773&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=160x600%7C300x600%7C300x250%7C300x225&ifi=3&dids=banner-right&adfs=3913854250&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1754950358935&lmt=1754950358&adxs=1387&adys=60&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fd2emu.com%2F&vis=1&psz=266x2008&msz=266x250&fws=4&ohw=1600&topics=9&tps=9&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDMyMzhmNmFhLTYwNDMtNDIxMy05YTk3LWM4MmY1NzUwODAyYlgBEjYKDGFkc2VydmVyLm9yZxIkNDZmNGFmOTEtMmJhMy00MzA1LTg5NmMtYzI1ODk2MGQyZjgyWAESHQoOZXNwLmNyaXRlby5jb20Y9arF2YkzSABSAghkEhQKBW9wZW54GPSqxdmJM0gAUgIIZA..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1754950354020&idt=3845&ppid=3238f6aa604342139a97c82f5750802b&prev_scp=refresh%3D30%26ncpm%3D0.23%26exp.floors%3Dyes%26nver%3D4%26domain%3Dd2emu.com%26hostname%3Dd2emu.com%26contax%3D680%252C687%26hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.23%26hb_adid%3D74bf5af9c649c0a%26hb_bidder%3Dvidazoo%26pos%3D1&cust_params=amznbid%3D0%26amznp%3D0&adks=3580516462&frm=20&eoidce=1&gblpids=%2Fnitro%2F1387%2F1773%2Fbanner-right&pbbce=1&td=1&egid=29660&tan=01035a1f-e623-4cc5-994b-85bd8508d807&tdf=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.178.218.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadtq-in-f156.1e100.net
Software
cafe /
Resource Hash
293047fc484407aebdb02884b3798da72b844d0fb4b18f028d2a78a0ce9f4a46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
dcb
google-lineitem-id
7013947187
observe-browsing-topics
?1
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138495032278
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://d2emu.com
content-length
2539
x-xss-protection
0
server
cafe
GET
H3
200
container.html
257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame C164
0
0
0ms
0ms
Document
text/html
142.251.179.132
GOOGLE
General
Full URL
https://257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:38 GMT
expires
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
gc.js Show response
groundcontrol.rendering.sharethrough.com/ Frame CC8F
510 KB
125 KB
602ms
235ms
Script
application/javascript
108.138.64.5
AMAZON-02
General
Full URL
https://groundcontrol.rendering.sharethrough.com/gc.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.64.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-64-5.iad12.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
18ad120e85b487df131814e6c2878aaa04c8ef8eb97d38e3d32f3c87b8c1211c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
x-amz-version-id
8dqbUbH9zO7bbFbYxe342y1I8xyydApl
etag
W/"edb4355c45740889937805a2f967481c"
age
3027
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
kKdMnXxrZy-mYlGogBn4xv9adXPgHAqImaEQDy8CniJypllHJaRucg==
date
Mon, 11 Aug 2025 21:22:13 GMT
content-type
application/javascript
vary
accept-encoding
last-modified
Mon, 11 Aug 2025 20:22:02 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
x-amz-replication-status
PENDING
cache-control
public, max-age=3600
referrer-policy
strict-origin-when-cross-origin
via
1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront)
x-xss-protection
1; mode=block
x-amz-cf-pop
IAD12-P1
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
200
butler
b.sharethrough.com/ Frame CC8F
95 B
438 B
614ms
252ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=adServed&arid=9ce185cc-56b5-46ef-8993-e7b05177e48c&supplyId=WYu2BXv1&platformType=web&inventoryType=display
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1166
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
Izv2g4wK6trLgXG7s8xDiXEDb4NecvIHOMRE97rK_FojWO336FnnBA==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
340 KB
121 KB
158ms
157ms
Script
application/javascript
192.178.155.97
GOOGLE
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.178.155.97 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yuiadrs-in-f97.1e100.net
Software
Google Tag Manager /
Resource Hash
ce7ac377089f8a33de6b5b68c225ad33f7aef816a444bd85acc0c6a1e15c8bd9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
zstd
report-to
{"group":"ascgcycc:1099:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1099:0"}],}
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1099:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=ascgcycc:1099:0
content-length
123731
x-xss-protection
0
server
Google Tag Manager
OPTIONS
H2
200
match
seg.ad.gt/api/v2/ Frame
0
0
319ms
136ms
Preflight
172.66.148.159
CLOUDFLARENET
General
Full URL
https://seg.ad.gt/api/v2/match
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://d2emu.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
*
access-control-allow-methods
*
access-control-allow-origin
*
allow
POST
cf-cache-status
DYNAMIC
cf-ray
96db13613f54d801-SEA
date
Mon, 11 Aug 2025 22:12:39 GMT
server
cloudflare
vary
origin, access-control-request-method, access-control-request-headers
POST
H2
204
collect Show response
a.ad.gt/api/v1/
0
111 B
109ms
107ms
XHR
text/plain
104.20.35.150
CLOUDFLARENET
General
Full URL
https://a.ad.gt/api/v1/collect
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-type
text/plain
Referer
https://d2emu.com/

Response headers

cf-ray
96db13601e97ec27-SEA
access-control-allow-origin
https://d2emu.com
cf-cache-status
DYNAMIC
date
Mon, 11 Aug 2025 22:12:39 GMT
vary
Origin
server
cloudflare
access-control-allow-credentials
true
GET
H2
204
getpixels Show response
pixels.ad.gt/api/v1/
0
88 B
322ms
138ms
Script
text/plain
104.20.35.150
CLOUDFLARENET
General
Full URL
https://pixels.ad.gt/api/v1/getpixels?tagger_id=538d41b8df08fc759d7a67fd43225070&url=https%3A%2F%2Fd2emu.com%2F&code=%27none%27
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cf-ray
96db13613ba4eb6b-SEA
cf-cache-status
DYNAMIC
date
Mon, 11 Aug 2025 22:12:39 GMT
server
cloudflare
POST
H2
200
match Show response
seg.ad.gt/api/v2/
2 B
60 B
104ms
101ms
XHR
application/json
172.66.148.159
CLOUDFLARENET
General
Full URL
https://seg.ad.gt/api/v2/match
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-type
application/json
Referer
https://d2emu.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
DYNAMIC
cf-ray
96db136219f6d801-SEA
access-control-allow-origin
*
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/json
vary
origin, access-control-request-method, access-control-request-headers
server
cloudflare
GET
H2
200
segments Show response
seg.ad.gt/api/v2/
15 B
111 B
322ms
139ms
XHR
application/json
172.66.148.159
CLOUDFLARENET
General
Full URL
https://seg.ad.gt/api/v2/segments?url=https%253A%252F%252Fd2emu.com%252F&partner_id=720&tagger_id=538d41b8df08fc759d7a67fd43225070&au_id=AU1D-0100-001754950359-F403QUO3-TPC1
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.148.159 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf84482b9efdd9291a36643471c6e09c79a69623f87a7b61265b660e54e69eaf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
DYNAMIC
cf-ray
96db13613f58d801-SEA
access-control-allow-origin
*
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/json
vary
origin, access-control-request-method, access-control-request-headers
server
cloudflare
GET
H2
200
bounce Show response
id5-sync.com/
30 B
298 B
227ms
224ms
Fetch
text/plain
162.19.138.83
OVH OVH SAS
General
Full URL
https://id5-sync.com/bounce
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31532338.ip-162-19-138.eu
Software
/
Resource Hash
b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://d2emu.com
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/plain;charset=utf-8
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials
true
GET
H/1.1
200
OK
v1 Show response
lbs.eu-1-id5-sync.com/lbs/
54 B
224 B
230ms
229ms
Fetch
application/json
135.125.247.202
OVH OVH SAS
General
Full URL
https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
135.125.247.202 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software
/
Resource Hash
6a31dabe76a5d6688d5ffdb5cd2e37932c78c90bdf3c160a422b510b69b1d2c6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

access-control-allow-origin
https://d2emu.com
content-length
54
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/json
vary
Origin
GET
H2
200
v1 Show response
lb.eu-1-id5-sync.com/lb/
45 B
327 B
227ms
225ms
Fetch
application/json
162.19.138.118
OVH OVH SAS
General
Full URL
https://lb.eu-1-id5-sync.com/lb/v1
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31533569.ip-162-19-138.eu
Software
/
Resource Hash
5236894205ed4092819479aa76cfb6cdf42e71f7594a7756cf6dd1cfe647cf1d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-origin
https://d2emu.com
content-encoding
gzip
date
Mon, 11 Aug 2025 22:12:38 GMT
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
GET
H2
200
sync Show response
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://sync.inmobi.com/prebid?gdpr=&gdpr_consent=&us_privacy=1---&gpp=&gpp_sid=&redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D...
  • https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
  • https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
6 KB
6 KB
287ms
287ms
Document
text/html
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
9b925fbe03c3733a1c69da27f88dd6405775cbd3b37566868a7d5a47c623b1ae

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

content-length
6341
content-type
text/html;charset=UTF-8
date
Mon, 11 Aug 2025 22:12:39 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via
1.1 google

Redirect headers

content-length
0
date
Mon, 11 Aug 2025 22:12:39 GMT
location
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via
1.1 google
GET
H2
200
pd Show response
google-bidout-d.openx.net/w/1.0/ Frame EFB0
754 B
1 KB
436ms
150ms
Document
text/html
34.98.64.218
GOOGLE-CLOUD-PLAT...
General
Full URL
https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by
Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
/
Resource Hash
296f372e2c6bd7797542f6dd91fd289e7616cdce39a85d42ce0555ca77bc6e78

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0, no-cache
content-length
754
content-type
text/html
date
Mon, 11 Aug 2025 22:12:38 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
vary
Accept, Accept-Encoding
via
1.1 google
x-forwarded-for
212.104.215.93
GET
H3
200
container.html
257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 4AF6
0
0
0ms
0ms
Document
text/html
142.251.179.132
GOOGLE
General
Full URL
https://257b00b62c4bb3adf4539c4aed92d063.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202508070101/pubads_impl.js?cb=31093999
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:38 GMT
expires
Mon, 11 Aug 2025 22:12:38 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
script.js Show response
cadmus.script.ac/d3rtd2fz2u3gv4/ Frame BF97
160 KB
55 KB
252ms
96ms
Script
application/javascript
172.64.146.226
CLOUDFLARENET
General
Full URL
https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.146.226 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1c51db55b2e15a98ce35b0dcee42adb5380a4ce247ac7a922fe239c9b56d02b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
public,max-age=600,stale-while-revalidate=3600,stale-if-error=86400
content-encoding
gzip
etag
W/"ea275dfbb832a425af57986c8091c91fbea5ec9e"
age
0
cf-ray
96db136448ae6065-YVR
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/javascript
vary
Accept-Encoding
server
cloudflare
last-modified
Mon, 11 Aug 2025 20:51:24 GMT
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
437 B
143ms
142ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=adServed&arid=9a293466-ebde-4922-b20e-d3b95b4f447d&supplyId=TAEWcTBw&platformType=web&inventoryType=display
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1166
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
Hi391Ok1MlUeyrrZGY_Q-7oHPdTAk4NypErYcHywpaW3MvITnXtpjw==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
widget.serverless.js Show response
static.vidazoo.com/basev/wgt/odin/1.0.18/ Frame BF97
177 KB
49 KB
439ms
75ms
Script
application/javascript
199.232.211.52
FASTLY
General
Full URL
https://static.vidazoo.com/basev/wgt/odin/1.0.18/widget.serverless.js
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.211.52 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bd51ab7d3e7f5edceef44e01a85bcb38aec65f0293dcaedef4ea1cf2145479ec

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

access-control-expose-headers
Origin,Accept,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length,Accept-Language,Accept-Encoding,Referer,Range
content-encoding
gzip
etag
"03eacb821d76a79c8df8d1b34b6ac15a"
age
56473
access-control-allow-methods
GET,OPTIONS,HEAD
x-cache
HIT, HIT
date
Mon, 11 Aug 2025 22:12:39 GMT
last-modified
Sun, 23 Feb 2025 13:31:57 GMT
x-served-by
cache-iad-kcgs7200041-IAD, cache-yvr1525-YVR
x-cache-hits
7064, 1933
content-type
application/javascript
x-amz-id-2
2pcuB25/IwBxJ6uwKRDjo+4HoD4WUzdskp/E1d4rfWUxN4/uVYTsZUxsgwdCIwW4k2h82pMUme0=
access-control-allow-headers
Origin,Accept,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Length,Accept-Language,Accept-Encoding,Referer,Range
vary
Accept-Encoding
x-ioriver
Fastly
x-timer
S1754950360.939409,VS0,VS0,VE0
via
1.1 varnish, 1.1 varnish
x-amz-request-id
GP8N8ES2N52ZVJGX
accept-ranges
bytes
access-control-allow-origin
*
content-length
48865
server
AmazonS3
x-amz-server-side-encryption
AES256
POST
H2
200
v3 Show response
id5-sync.com/gm/
2 KB
3 KB
389ms
387ms
XHR
application/json
162.19.138.83
OVH OVH SAS
General
Full URL
https://id5-sync.com/gm/v3
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5PrebidModule.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ns31532338.ip-162-19-138.eu
Software
/
Resource Hash
3519521e45acd0321b715edea4cf894e443ca2dd1ed23d09f321b2fd65346f64
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
expires
Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin
https://d2emu.com
p3p
CP="CAO PSA OUR"
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
application/json
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
POST
H2
204
event Show response
p.ad.gt/api/v1/
0
33 B
99ms
97ms
XHR
text/plain
104.20.35.150
CLOUDFLARENET
General
Full URL
https://p.ad.gt/api/v1/event
Requested by
Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/720
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-type
application/json
Referer
https://d2emu.com/

Response headers

cf-ray
96db13654f56201d-SEA
access-control-allow-origin
https://d2emu.com
cf-cache-status
DYNAMIC
date
Mon, 11 Aug 2025 22:12:39 GMT
vary
Origin
server
cloudflare
access-control-allow-credentials
true
OPTIONS
H2
200
event
p.ad.gt/api/v1/ Frame
0
0
298ms
145ms
Preflight
text/html
104.20.35.150
CLOUDFLARENET
General
Full URL
https://p.ad.gt/api/v1/event
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.35.150 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://d2emu.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin
https://d2emu.com
allow
POST, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
96db13646d62201d-SEA
content-encoding
br
content-type
text/html; charset=utf-8
date
Mon, 11 Aug 2025 22:12:39 GMT
server
cloudflare
vary
Origin
GET
H2
200
sd
us-u.openx.net/w/1.0/ Frame EFB0
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELIx9ThBKyNZIY4VNJc4RhA&google_cver=1
43 B
97 B
90ms
85ms
Image
image/gif
34.98.64.218
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELIx9ThBKyNZIY4VNJc4RhA&google_cver=1
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
no-cache, must-revalidate
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESELIx9ThBKyNZIY4VNJc4RhA&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
295
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
pixel
cm.g.doubleclick.net/ Frame EFB0
170 B
246 B
574ms
217ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MWEzMDBlOWMtMDgyOC0yMzdmLWRiZjMtMzI5MDk1NWQxMjBh
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)
GET
H2
200
sd
us-u.openx.net/w/1.0/ Frame EFB0
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=365fdd56-c15f-7ddb-ce13-68295fbfdc6a&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=46f4af91-2ba3-4305-896c-c258960d2f82&ttd_puid=365fdd56-c15f-7ddb-ce13-68295fbfdc6a&gdpr=0&gdpr_consent=
43 B
136 B
86ms
84ms
Image
image/gif
34.98.64.218
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=46f4af91-2ba3-4305-896c-c258960d2f82&ttd_puid=365fdd56-c15f-7ddb-ce13-68295fbfdc6a&gdpr=0&gdpr_consent=
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
image/gif
vary
Accept

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=46f4af91-2ba3-4305-896c-c258960d2f82&ttd_puid=365fdd56-c15f-7ddb-ce13-68295fbfdc6a&gdpr=0&gdpr_consent=
content-length
335
date
Mon, 11 Aug 2025 22:12:39 GMT
server
Kestrel
GET
H2
200
sd
us-u.openx.net/w/1.0/ Frame EFB0
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/openx/a298bb12-51f3-ef92-ffc4-7edca0e81123?gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-HpvP6JJE2p_e6S5OpetwHNwjlXC_9_Aep.k-~A
43 B
97 B
188ms
186ms
Image
image/gif
34.98.64.218
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-HpvP6JJE2p_e6S5OpetwHNwjlXC_9_Aep.k-~A
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/gif
vary
Accept

Redirect headers

strict-transport-security
max-age=31536000
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-HpvP6JJE2p_e6S5OpetwHNwjlXC_9_Aep.k-~A
age
0
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
server
ATS
x-frame-options
DENY
GET
H2
200
ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame EFB0
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aJpq1wACzIfGmAAz
85 B
171 B
72ms
72ms
Image
image/png
151.101.130.49
FASTLY
General
Full URL
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aJpq1wACzIfGmAAz
Requested by
Host: google-bidout-d.openx.net
URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Protocol
H2
Server
151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://google-bidout-d.openx.net/

Response headers

x-robots-tag
noindex
cache-control
no-cache
x-timer
S1754950360.155929,VS0,VE0
age
3166
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
x-cache
HIT
content-length
85
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/png
x-served-by
cache-yvr1522-YVR
server
Jetty(9.4.35.v20201120)
x-cache-hits
8015

Redirect headers

x-robots-tag
noindex
cache-control
no-cache
location
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aJpq1wACzIfGmAAz
x-timer
S1754950360.941615,VS0,VE74
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
x-served-by
cache-yvr1522-YVR
server
Jetty(9.4.35.v20201120)
x-cache-hits
0
GET
H2
200
css2
fonts.googleapis.com/ Frame CC8F
66 KB
3 KB
155ms
154ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap
Requested by
Host:
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
ad998f65bf9df599f0c8afe08e662d8aa24df80cbdfa7d8a6775def773ef6e58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 21:54:20 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
css2
fonts.googleapis.com/ Frame CC8F
19 KB
2 KB
224ms
224ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@100..900&family=Roboto:wght@300;500;700&display=swap
Requested by
Host:
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
14d0b899030faadcfd32a33ccc0abd09506ad476c27b2534a80e0af6f9c9b7ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 22:02:21 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
butler
b.sharethrough.com/ Frame CC8F
95 B
437 B
143ms
142ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=impressionReceived&arid=9ce185cc-56b5-46ef-8993-e7b05177e48c&pkey=jTgUsUdJBG7teDwXK5GPmgLW&supplyId=WYu2BXv1&ckey=17CzF5ktQoN1vCLa3wP58vYU-671712343&umtime=1754950359843&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=0356b7ca-a913-4a86-9528-e4df967c8069&awid=dd78273b-711f-4ef2-b72c-e1a7d1420405&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1166
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
rK5F4MwYdSbUszIB7yFJMFfMci1R9OVM6mj8d9v3euUobXys4_QDgw==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
DATA
200
OK
truncated
/ Frame CC8F
593 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ed5ad0eec04e553eba9d52dd0ebc0dae503878399641b8ba9ef9b7e3d8efe69d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H2
200
sync Show response
ssbsync.smartadserver.com/api/ Frame EEF7
961 B
1 KB
621ms
252ms
Document
text/html
216.22.16.4
LEASEWEB-USA-WDC
General
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Requested by
Host: groundcontrol.rendering.sharethrough.com
URL: https://groundcontrol.rendering.sharethrough.com/gc.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.4 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
2e3ab89383110a24f1395c238cb9e85c05d1df5c91367874f2ee8010cf249707

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control
no-cache,no-store
content-length
961
content-type
text/html
date
Mon, 11 Aug 2025 22:12:39 GMT
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma
no-cache
GET
H2
200
usync.html Show response
eus.rubiconproject.com/ Frame 60FE
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=18694&gdpr=0&gdpr_consent=
  • https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
269 B
379 B
364ms
251ms
Document
text/html
23.3.133.134
AKAMAI-AS
General
Full URL
https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Requested by
Host: groundcontrol.rendering.sharethrough.com
URL: https://groundcontrol.rendering.sharethrough.com/gc.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.3.133.134 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-3-133-134.deploy.static.akamaitechnologies.com
Software
Apache/2.4.62 (Debian) /
Resource Hash
e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
224
content-type
text/html
date
Mon, 11 Aug 2025 22:12:40 GMT
etag
"10d-629840acea280-gzip"
last-modified
Wed, 18 Dec 2024 04:42:34 GMT
server
Apache/2.4.62 (Debian)
vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
location
https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
server
AkamaiGHost
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
68 B
301 B
639ms
255ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
content-length
323
date
Mon, 11 Aug 2025 22:12:39 GMT
server
Kestrel
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D7rkJAhPCWXbw9Lq5dZxc6TvN%26source_user_id%3D%24UID&partner=sharethrough
  • https://match.sharethrough.com/sync/v1?source_id=7rkJAhPCWXbw9Lq5dZxc6TvN&source_user_id=ua-81fd56b2-48f1-3e89-8216-09777d0f25b1
68 B
300 B
189ms
189ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=7rkJAhPCWXbw9Lq5dZxc6TvN&source_user_id=ua-81fd56b2-48f1-3e89-8216-09777d0f25b1
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

expires
0
cache-control
no-store
location
https://match.sharethrough.com/sync/v1?source_id=7rkJAhPCWXbw9Lq5dZxc6TvN&source_user_id=ua-81fd56b2-48f1-3e89-8216-09777d0f25b1
content-length
0
pragma
no-cache
GET
H2
204
sharethrough
sync.1rx.io/usersync2/ Frame 843A
0
99 B
616ms
253ms
Image
text/plain
69.194.240.13
RHYTHMONE
General
Full URL
https://sync.1rx.io/usersync2/sharethrough
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

expires
0
cache-control
no-store, no-cache, must-revalidate
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
GET
H2
200
Pug
image2.pubmatic.com/AdServer/ Frame 843A
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=&_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGRHhFN1JOTllBQUJ2MWhsQzQ2Zw&gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Cdtech%2Csas%2Cshr&bee_sync_current_partn...
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pm%2Cpp%2Cdtech%2Csas%2Cshr&bee_sync_current_partner=adx&bee_sync_initiator=shr&bee_sync_hop_count=1
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAFDxE7RNNYAABv1hlC46g&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%...
0
252 B
619ms
321ms
Image
text/html
8.28.7.83
AS-PUBMATIC
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAFDxE7RNNYAABv1hlC46g&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cdtech%252Csas%252Cshr%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
cache-control
no-store, no-cache, private
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-encoding
gzip
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
text/html; charset=utf-8
server
nginx

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAFDxE7RNNYAABv1hlC46g&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cdtech%252Csas%252Cshr%26bee_sync_current_partner%3Dpm%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2
Content-Length
0
Date
Mon, 11 Aug 2025 22:12:40 GMT
Server
gunicorn
Connection
keep-alive
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=
  • https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=&__qcmcs=1
  • https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=S_zZ4UulhLhQ8tK2S6DNuE_x0bBQodOwSaXIxgq6
68 B
300 B
207ms
180ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=S_zZ4UulhLhQ8tK2S6DNuE_x0bBQodOwSaXIxgq6
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

strict-transport-security
max-age=86400
cache-control
private, no-store, proxy-revalidate
location
https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=S_zZ4UulhLhQ8tK2S6DNuE_x0bBQodOwSaXIxgq6
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
GET

sync
ssbsync.smartadserver.com/api/ Frame 843A
0
0


GET
H2
200
ImgSync
image8.pubmatic.com/AdServer/ Frame 843A
0
69 B
526ms
211ms
Image
text/plain
8.28.7.82
AS-PUBMATIC
General
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252Fsync%252Fv1%253Fsource_id%253DuFFr5RFBYgoUJbWMAWGEZKS3%2526source_user_id%253D%2523PMUID
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

date
Mon, 11 Aug 2025 22:12:40 GMT
strict-transport-security
max-age=16070400; includeSubDomains
content-length
0
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=sharethrough
  • https://match.sharethrough.com/sync/v1?source_id=175kELn9xvfXoe3C4qjRaWS8&source_user_id=OPTOUT
68 B
300 B
199ms
199ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=175kELn9xvfXoe3C4qjRaWS8&source_user_id=OPTOUT
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://match.sharethrough.com/sync/v1?source_id=175kELn9xvfXoe3C4qjRaWS8&source_user_id=OPTOUT
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
content-type
text/html
etag
OPTOUT
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=MWQyMjcwNGEtZjg2NS00ZGRmLTliYzgtOTQ2YjM3OTc1YjNj
  • https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
68 B
300 B
250ms
249ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

cache-control
no-cache, must-revalidate
location
https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
260
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://stx-match.dotomi.com/match/bounce/current?networkId=44410&version=1&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&gdpr=0&gdpr_consent=
  • https://stx-match.dotomi.com/match/bounce/current?DotomiTest=6a2c8911d26d245a&is_secure=true&networkId=44410&version=1&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AQANl1Yt18fOLAJg1FNiAQEBAQEBAQCZmjBfhwEBAQEBAQEB&expiration=1755036760&nuid=1d22704a-f865-4ddf-9bc8-946b3797...
68 B
300 B
256ms
254ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AQANl1Yt18fOLAJg1FNiAQEBAQEBAQCZmjBfhwEBAQEBAQEB&expiration=1755036760&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&is_secure=true&gdpr_consent=&gdpr=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

expires
0
cache-control
no-cache, private, max-age=0, no-store
location
https://match.sharethrough.com/sync/v1?source_id=XXFNqX2gk1rVb6Jw3xJ26afL&source_user_id=AQANl1Yt18fOLAJg1FNiAQEBAQEBAQCZmjBfhwEBAQEBAQEB&expiration=1755036760&nuid=1d22704a-f865-4ddf-9bc8-946b37975b3c&is_secure=true&gdpr_consent=&gdpr=0
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
server
nginx
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558357&ev=1&rurl=https%3a%2f%2fmatch.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&source_user_id=%%VGUID%%
  • https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=B1s4UYBYqrm1&pid=558357
68 B
300 B
173ms
172ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=B1s4UYBYqrm1&pid=558357
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

cache-control
private, max-age=0, no-cache, no-store
location
https://match.sharethrough.com/sync/v1?source_id=790d3e0174b12a86f1cbebf4&ev=1&source_user_id=B1s4UYBYqrm1&pid=558357
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server
bh-deployment-688d45dd4f-84kzl
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-CA
server
Jetty(12.0.22)
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://ssc-cms.33across.com/ps/?ri=0013300001kQj2HAAS&ru=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DkzFyzzqXEqukMDumpVLB6Eq3%26source_user_id%3D33XUSERID33X
  • https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=212978335208556
68 B
300 B
160ms
158ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=212978335208556
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

cache-control
no-store, no-cache, must-revalidate
location
https://match.sharethrough.com/sync/v1?source_id=kzFyzzqXEqukMDumpVLB6Eq3&source_user_id=212978335208556
pragma
no-cache
referrer-policy
unsafe-url
expires
Thu, 01-Jan-70 00:00:01 GMT
x-33x-status
100000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
server
33XP018
GET
H2
200
cookiesyncredir
bttrack.com/pixel/ Frame 843A
35 B
307 B
795ms
282ms
Image
image/gif
192.132.33.68
BIDTELLECT
General
Full URL
https://bttrack.com/pixel/cookiesyncredir?rurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DFGhqNjC2WnFmmvNpTL32LMME%26source_user_id%3D%7Bglobalid%7D%26gdpr%3D0%26gdpr_consent%3D
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.132.33.68 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
NET-33-132-192.68.bidtellect.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000;
cache-control
private,no-cache
x-servername
Track002-iad
pragma
no-cache
expires
-1
content-length
35
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/gif
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/sharethrough/1d22704a-f865-4ddf-9bc8-946b37975b3c?gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=BVbSRuzbUWjBEF6bQrmLHKkX&source_user_id=y-EVuEv7FE2oPC9UqtYnNSn7p5p3V24nR_tgAznSa.cuLe~A
68 B
300 B
153ms
143ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=BVbSRuzbUWjBEF6bQrmLHKkX&source_user_id=y-EVuEv7FE2oPC9UqtYnNSn7p5p3V24nR_tgAznSa.cuLe~A
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

strict-transport-security
max-age=31536000
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location
https://match.sharethrough.com/sync/v1?source_id=BVbSRuzbUWjBEF6bQrmLHKkX&source_user_id=y-EVuEv7FE2oPC9UqtYnNSn7p5p3V24nR_tgAznSa.cuLe~A
age
0
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
server
ATS
x-frame-options
DENY
GET

cm-notify
creativecdn.com/ Frame 843A
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=sharethrough&gdpr=0&gdpr_consent=
  • https://creativecdn.com/cm-notify?pi=sharethrough&gdpr=0&gdpr_consent=&tc=1
0
0


GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-391c8d83-49a2-59f3-794f-ad0abf692754$ip$212.104.215.93&gdpr=0&gdpr_consent=
68 B
300 B
176ms
176ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-391c8d83-49a2-59f3-794f-ad0abf692754$ip$212.104.215.93&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Location
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-391c8d83-49a2-59f3-794f-ad0abf692754$ip$212.104.215.93&gdpr=0&gdpr_consent=
Content-Length
201
Date
Mon, 11 Aug 2025 22:12:41 GMT
Content-Type
text/html; charset=utf-8
Connection
keep-alive
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4T9T-1O-JASD&gdpr=0
68 B
300 B
254ms
253ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4T9T-1O-JASD&gdpr=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4T9T-1O-JASD&gdpr=0
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
ffef7c53154b04a892ce1f9531c32cb1
content-length
0
Content-Type
text/html
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://cs.admanmedia.com/c01d0246d79eba64b8a7cca07e5b7dc7.gif?puid=1d22704a-f865-4ddf-9bc8-946b37975b3c&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DqU...
  • https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=88798587-ae47-45e5-8b6c-76f0348c4a57&gdpr=0&gdpr_consent=
68 B
300 B
262ms
260ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=88798587-ae47-45e5-8b6c-76f0348c4a57&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

expires
0
cache-control
no-cache, no-store, must-revalidate
location
https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=88798587-ae47-45e5-8b6c-76f0348c4a57&gdpr=0&gdpr_consent=
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
server
nginx
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent=
  • https://c1.adform.net/serving/cookie/match?CC=1&party=1294&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=6765784818800077139&gdpr=0&gdpr_consent=
68 B
300 B
218ms
218ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=6765784818800077139&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
location
https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=6765784818800077139&gdpr=0&gdpr_consent=
pragma
no-cache
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-methods
GET
expires
-1
access-control-allow-origin
*
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
server
nginx
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1820804327581032944
68 B
300 B
146ms
145ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1820804327581032944
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

cache-control
no-store, no-cache, private
location
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1820804327581032944
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
be4069e1-480c-4343-a87d-d7bd30055014
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:41 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET

v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://match.deepintent.com/usersync/158
  • https://match.sharethrough.com/sync/v1?source_id=4rQWDMHEFSdfRbtp7Kei6UsB&source_user_id=di_ccdebe26368d40c2bcad0
0
0


GET

v1
match.sharethrough.com/sync/ Frame 843A
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=s&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DxTFJbLbs37tyhbKsPP9VC2cm%26source_user_id%3D%24UID
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=35667f21a0
0
0


GET

sharethrough
b1sync.outbrain.com/usersync/ Frame 843A
Redirect Chain
  • https://b1sync.zemanta.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D
  • https://b1sync.outbrain.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D&s=2
0
0


GET
H2
200
byN59NcB
sync-tm.everesttech.net/ct/upi/pid/ Frame 843A
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A
  • https://sync-tm.everesttech.net/ct/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A&_test=aJp...
85 B
171 B
98ms
62ms
Image
image/png
151.101.2.49
FASTLY
General
Full URL
https://sync-tm.everesttech.net/ct/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A&_test=aJpq2QAAAKSsrgAs
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

x-robots-tag
noindex
cache-control
no-cache
x-timer
S1754950362.794155,VS0,VE0
age
3168
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
x-cache
HIT
content-length
85
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
image/png
x-served-by
cache-yvr1522-YVR
server
Jetty(9.4.35.v20201120)
x-cache-hits
8018

Redirect headers

x-robots-tag
noindex
cache-control
no-cache
location
https://sync-tm.everesttech.net/ct/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A&_test=aJpq2QAAAKSsrgAs
x-timer
S1754950362.578573,VS0,VE74
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
x-served-by
cache-yvr1522-YVR
server
Jetty(9.4.35.v20201120)
x-cache-hits
0
GET

cm
u.openx.net/w/1.0/ Frame 843A
0
0


GET

c9dd71b6-fd13-4133-bf5d-b88619cef491
sid.storygize.net/ccm/ Frame 843A
0
0


GET

sync
x.bidswitch.net/ Frame 843A
0
0


GET

cksync.php
hb.yahoo.net/ Frame 843A
0
0


GET

ecm3
s.amazon-adsystem.com/ Frame 843A
0
0


GET

c.gif
c.bing.com/ Frame 843A
0
0


GET

712068.gif
idsync.rlcdn.com/ Frame 843A
0
0


GET

86645
i.liadm.com/s/ Frame 843A
0
0


GET
H3
200
pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5AAC
663 B
254 B
157ms
157ms
Document
text/html
64.233.180.154
GOOGLE
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjXiKbAAjAB&v=APEucNVLOBkYRhi_Yo87vTIF_DCeWkUitoDpkpQmS5xY9gt54ZggJO0PwtlEzsFvAifJwAnIYk3GU9Qdz4tXbTYo6mULeF95qA
Requested by
Host: groundcontrol.rendering.sharethrough.com
URL: https://groundcontrol.rendering.sharethrough.com/gc.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
on-in-f154.1e100.net
Software
cafe /
Resource Hash
962d6dea088b031cd44d33f937adb5ba241a9435aa32a8be667d57482b8bbe1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
234
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:39 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2E6F
103 KB
35 KB
155ms
154ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/dv3.js
Requested by
Host: groundcontrol.rendering.sharethrough.com
URL: https://groundcontrol.rendering.sharethrough.com/gc.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
4ff65551cf2163c775b79ffc50a64103742ba87f4faf17290db264cd0d483cc3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
8618481211254521165
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
35662
x-xss-protection
0
server
cafe
GET
H3
200
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E6F
42 B
63 B
150ms
149ms
Image
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A0xxffgOOu5Vva58Vchamz6SyOL0KzQD89uIkL7jyD0OrQJjOWTcJpuJSVewvj0Khm88CJWffx1o3TXgjn5Tj_AuFfjiRUuf0qyPNc_ipZfiQ38pM
Requested by
Host: groundcontrol.rendering.sharethrough.com
URL: https://groundcontrol.rendering.sharethrough.com/gc.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Mon, 11 Aug 2025 22:12:39 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
pandg-sdk.js Show response
pghub.io/js/ Frame CC8F
17 KB
5 KB
262ms
82ms
Script
application/javascript
35.241.45.217
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pghub.io/js/pandg-sdk.js
Requested by
Host: groundcontrol.rendering.sharethrough.com
URL: https://groundcontrol.rendering.sharethrough.com/gc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.217 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
217.45.241.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
27961ab8c37cddad89230364167c048c6377a80e38542a5ffbca600faf4098ea

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-goog-metageneration
1
access-control-expose-headers
Access-Control-Allow-Origin
content-encoding
gzip
x-goog-hash
crc32c=aHj4lg==, md5=R6iGNTBWyvM6mYxgQeIIlg==
etag
"47a886353056caf33a998c6041e20896"
age
2731
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
5009
date
Mon, 11 Aug 2025 21:27:11 GMT
last-modified
Mon, 05 Jun 2023 16:36:50 GMT
content-type
application/javascript
vary
Accept-Encoding
x-guploader-uploadid
ABgVH8-XWi3dSEZQTtDNirJHT9jqy6uyk5tmqlH7OHYu-XssoMtdCCfOXSfPuV26h4Wg0GnTL8gmqlo
cache-control
public,max-age=3600
x-goog-storage-class
MULTI_REGIONAL
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1685983010517890
content-length
5009
server
UploadServer
OPTIONS
H2
204
1a
i.clean.gg/ Frame
0
0
345ms
150ms
Preflight
text/plain
34.95.69.49
GOOGLE-CLOUD-PLAT...
General
Full URL
https://i.clean.gg/1a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.29.0 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://d2emu.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1728000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=utf-8
date
Mon, 11 Aug 2025 22:12:40 GMT
server
nginx/1.29.0
via
1.1 google
POST
H2
200
1a Show response
i.clean.gg/ Frame BF97
0
104 B
145ms
143ms
XHR
application/octet-stream
34.95.69.49
GOOGLE-CLOUD-PLAT...
General
Full URL
https://i.clean.gg/1a
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.29.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://d2emu.com/

Response headers

access-control-expose-headers
Content-Length,Content-Range
access-control-allow-methods
GET, POST, OPTIONS
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
application/octet-stream
server
nginx/1.29.0
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
437 B
144ms
144ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=s2s-win&arid=9a293466-ebde-4922-b20e-d3b95b4f447d
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1167
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
U-ZysKhFbN0mSNI97MieZH2CCMNlb9ODtnf81L7cI9cPLkvuhMtUhg==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
gc.js Show response
groundcontrol.rendering.sharethrough.com/ Frame BF97
510 KB
0
602ms
235ms
Script
application/javascript
108.138.64.5
AMAZON-02
General
Full URL
https://groundcontrol.rendering.sharethrough.com/gc.js
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.64.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-64-5.iad12.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
18ad120e85b487df131814e6c2878aaa04c8ef8eb97d38e3d32f3c87b8c1211c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
x-amz-version-id
8dqbUbH9zO7bbFbYxe342y1I8xyydApl
etag
W/"edb4355c45740889937805a2f967481c"
age
3027
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
kKdMnXxrZy-mYlGogBn4xv9adXPgHAqImaEQDy8CniJypllHJaRucg==
date
Mon, 11 Aug 2025 21:22:13 GMT
content-type
application/javascript
vary
accept-encoding
last-modified
Mon, 11 Aug 2025 20:22:02 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
x-amz-replication-status
PENDING
cache-control
public, max-age=3600
referrer-policy
strict-origin-when-cross-origin
via
1.1 086e2cd5d94fa729de58c51b5666e0e4.cloudfront.net (CloudFront)
x-xss-protection
1; mode=block
x-amz-cf-pop
IAD12-P1
server
AmazonS3
x-amz-server-side-encryption
AES256
POST
H/1.1
204
No Content
bid_won
prebid.cootlogix.com/api/v1/ Frame BF97
0
432 B
211ms
209ms
Ping
text/plain
138.197.62.132
DIGITALOCEAN-ASN
General
Full URL
https://prebid.cootlogix.com/api/v1/bid_won
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.62.132 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://d2emu.com/

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin
https://d2emu.com
cache-control
max-age=0, no-cache, must-revalidate, proxy-revalidate
date
Mon, 11 Aug 2025 22:12:42 GMT
vary
Accept-Encoding
access-control-allow-credentials
true
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
POST
H2
200
aggregate_beacon
bisrtb.cootlogix.com/ Frame BF97
0
183 B
674ms
313ms
Ping
text/plain
167.71.26.251
DIGITALOCEAN-ASN
General
Full URL
https://bisrtb.cootlogix.com/aggregate_beacon
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
167.71.26.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://d2emu.com/

Response headers

access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
text/plain
access-control-allow-headers
*
GET
H2
200
UCookieSetPug
image6.pubmatic.com/AdServer/
Redirect Chain
  • https://id5-sync.com/i/1528/8.gif?o=api&id5id=ID5*ESG_VeiFtRvXzmvpS9-jfwX1znfhpTLUa4v6OAsRPCs8H6H9kimRfaF5J12lGy6j&gdpr_consent=undefined&gdpr=false
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_co...
  • https://pixel.tapad.com/idsync/ex/push/check?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&g...
  • https://id5-sync.com/c/1528/108/7/2.gif?puid=872f1004-f090-468e-85e1-7f0850cb1387&gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F429%2F6%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D...
0
193 B
601ms
239ms
Image
text/html
207.65.37.181
AS-PUBMATIC
General
Full URL
https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F429%2F6%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=16070400; includeSubDomains
content-length
0
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
text/html; charset=UTF-8

Redirect headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
location
https://image6.pubmatic.com/AdServer/UCookieSetPug?p=50935&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&rd=https%3A%2F%2Fid5-sync.com%2Fc%2F1528%2F429%2F6%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D
p3p
CP="CAO PSA OUR"
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
GET
H2
200
css2
fonts.googleapis.com/ Frame BF97
66 KB
0
0ms
0ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap
Requested by
Host:
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
ad998f65bf9df599f0c8afe08e662d8aa24df80cbdfa7d8a6775def773ef6e58
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 21:54:20 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
css2
fonts.googleapis.com/ Frame BF97
19 KB
0
60ms
60ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@100..900&family=Roboto:wght@300;500;700&display=swap
Requested by
Host:
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
14d0b899030faadcfd32a33ccc0abd09506ad476c27b2534a80e0af6f9c9b7ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 22:02:21 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
438 B
153ms
152ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=impressionReceived&arid=9a293466-ebde-4922-b20e-d3b95b4f447d&pkey=8C6umsP4Dr3ovU4hRbXWA8RZ&supplyId=TAEWcTBw&ckey=17CzF5ktQoN1vCLa3wP58vYU-663606091&umtime=1754950360024&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=5f894e28-87cb-45b5-8401-41571a0a8902&awid=4e7da93f-d1e9-49fc-8c69-38eb7eba98c8&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1167
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
0scRJJhGzwpQFT-fmFPtu3jFbqw38tfZ4unBlWyD_1ZKxYIQZvlu2w==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
POST
H2
204
collect
www.google-analytics.com/g/
0
0
149ms
147ms
Fetch
text/plain
142.251.179.113
GOOGLE
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-1DNME47EKC&gtm=45je5870v9167816017za200zd9167816017&_p=1754950354050&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~105033766~105033768~105103161~105103163~105135708~105135710&cid=472573402.1754950355&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1754950354&sct=1&seg=0&dl=https%3A%2F%2Fd2emu.com%2F&dt=D2Emu&en=scroll&epn.percent_scrolled=90&_et=14&tfd=6457
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-1DNME47EKC
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.113 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f113.1e100.net
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to
{"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://d2emu.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:102:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
text/plain
server
Golfe2
GET
H2
200
syncframe Show response
gum.criteo.com/ Frame 97D5
15 KB
6 KB
661ms
316ms
Document
text/html
74.119.117.17
AS-CRITEO
General
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=d2emu.com&gpp=&gpp_sid=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
0b96855e780057f73465081f56971f30c152233048e4af1bc2b1437b07d8b597
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:39 GMT
server
Kestrel
server-processing-duration-in-ticks
553445
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
x-robots-tag
noindex
GET

sync
ssbsync.smartadserver.com/api/ Frame BF97
0
0


GET

v1
match.sharethrough.com/sync/ Frame BF97
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
0
0


GET

sync
sync.srv.stackadapt.com/ Frame BF97
0
0


GET

sharethrough
sync.1rx.io/usersync2/ Frame BF97
0
0


GET

rmpssp
sync.1rx.io/usersync2/ Frame BF97
0
0


GET

ImgSync
image8.pubmatic.com/AdServer/ Frame BF97
0
0


GET

sync.php
pixel.rubiconproject.com/exchange/ Frame BF97
0
0


GET

match
c1.adform.net/serving/cookie/ Frame BF97
0
0


GET

shr
match.prod.bidr.io/cookie-sync/ Frame BF97
0
0


GET

byN59NcB
sync-tm.everesttech.net/upi/pid/ Frame BF97
0
0


GET

cookiesyncredir
bttrack.com/pixel/ Frame BF97
0
0


GET

cm
u.openx.net/w/1.0/ Frame BF97
0
0


GET

getuid
secure.adnxs.com/ Frame BF97
0
0


GET

/
s.ad.smaato.net/c/ Frame BF97
0
0


GET

p-_jQ037pSmtjhN.gif
cms.quantserve.com/pixel/ Frame BF97
0
0


GET

sharethrough
b1sync.zemanta.com/usersync/ Frame BF97
0
0


GET

cm-notify
creativecdn.com/ Frame BF97
0
0


GET

sync
ssbsync.smartadserver.com/api/ Frame 1744
0
0


GET
H2
200
v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
68 B
300 B
513ms
254ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=
content-length
323
date
Mon, 11 Aug 2025 22:12:40 GMT
server
Kestrel
GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=15&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-391c8d83-49a2-59f3-794f-ad0abf692754$ip$212.104.215.93&gdpr=0&gdpr_consent=
0
0


GET
H2
204
sharethrough
sync.1rx.io/usersync2/ Frame 1744
0
98 B
157ms
138ms
Image
text/plain
69.194.240.13
RHYTHMONE
General
Full URL
https://sync.1rx.io/usersync2/sharethrough
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.194.240.13 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

expires
0
cache-control
no-store, no-cache, must-revalidate
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
GET

rmpssp
sync.1rx.io/usersync2/ Frame 1744
0
0


GET
H2
200
ImgSync
image8.pubmatic.com/AdServer/ Frame 1744
0
40 B
161ms
142ms
Image
text/plain
8.28.7.82
AS-PUBMATIC
General
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252Fsync%252Fv1%253Fsource_id%253DuFFr5RFBYgoUJbWMAWGEZKS3%2526source_user_id%253D%2523PMUID
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

date
Mon, 11 Aug 2025 22:12:41 GMT
strict-transport-security
max-age=16070400; includeSubDomains
content-length
0
GET

sync.php
pixel.rubiconproject.com/exchange/ Frame 1744
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=1294&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=tYyXe2fcCnEgDUj176HQNZKu&source_user_id=6765784818800077139&gdpr=0&gdpr_consent=
0
0


GET

rtset
bh.contextweb.com/bh/ Frame 1744
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/shr?gdpr=0&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?ev=AAFDxE7RNNYAABv1hlC46g&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Ddtech%252Csas%2...
0
0


GET

byN59NcB
sync-tm.everesttech.net/ct/upi/pid/ Frame 1744
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A
  • https://sync-tm.everesttech.net/ct/upi/pid/byN59NcB?redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DSvWuQHUbMWnhsCDYjeaq81U2%26source_user_id%3D%24%7BTM_USER_ID%7D%0A&_test=aJp...
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://bttrack.com/pixel/cookiesyncredir?rurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DFGhqNjC2WnFmmvNpTL32LMME%26source_user_id%3D%7Bglobalid%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://match.sharethrough.com/sync/v1?source_id=FGhqNjC2WnFmmvNpTL32LMME&source_user_id=45f8f828-bb98-4aa4-953b-2f569a26479c&gdpr=0&gdpr_consent=
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=7ead435e-a2cd-4cbf-8876-adb66822613f&ph=c6b01e12-aa62-4ae6-9e10-71346e597c31&r=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DF2...
  • https://match.sharethrough.com/sync/v1?source_id=F2Stothm3wg5g6opTuaPadz9&source_user_id=f83c286b-731b-4036-8bb8-4e6355747e02
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1820804327581032944
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=s&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DxTFJbLbs37tyhbKsPP9VC2cm%26source_user_id%3D%24UID
  • https://match.sharethrough.com/sync/v1?source_id=xTFJbLbs37tyhbKsPP9VC2cm&source_user_id=35667f21a0
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=S_zZ4UulhLhQ8tK2S6DNuE_x0bBQodOwSaXIxgq6
0
0


GET

sharethrough
b1sync.outbrain.com/usersync/ Frame 1744
Redirect Chain
  • https://b1sync.zemanta.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D
  • https://b1sync.outbrain.com/usersync/sharethrough?cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_user_id%3D__ZUID__%26gdpr%3D%7BGDPR%7D%26gdpr_consent%3D%7BGDPR_CONSENT_80%7D&s=2
0
0


GET

cm-notify
creativecdn.com/ Frame 1744
0
0


GET
H2
200
sync Show response
ssbsync.smartadserver.com/api/ Frame 1789
881 B
1 KB
621ms
217ms
Document
text/html
216.22.16.4
LEASEWEB-USA-WDC
General
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.4 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
91524d9afaefd3933893215642a2b7e30a755af1dd7c153a310ae55fd2723635

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control
no-cache,no-store
content-length
881
content-type
text/html
date
Mon, 11 Aug 2025 22:12:39 GMT
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma
no-cache
GET
H2
200
usync.html Show response
eus.rubiconproject.com/ Frame 0F71
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=18694&gdpr=0&gdpr_consent=
  • https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
269 B
0
365ms
365ms
Document
text/html
23.3.133.134
AKAMAI-AS
General
Full URL
https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.3.133.134 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-3-133-134.deploy.static.akamaitechnologies.com
Software
Apache/2.4.62 (Debian) /
Resource Hash
e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
224
content-type
text/html
date
Mon, 11 Aug 2025 22:12:40 GMT
etag
"10d-629840acea280-gzip"
last-modified
Wed, 18 Dec 2024 04:42:34 GMT
server
Apache/2.4.62 (Debian)
vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
location
https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
server
AkamaiGHost
GET

pixelSync
pixel-sync.sitescout.com/dmp/ Frame 1744
0
0


GET

sync
x.bidswitch.net/ Frame 1744
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&gdpr=0&gdpr_consent=&google_hm=NTlhN2Q1NzQtMWUzZS00ODYzLTlhNDEtOWYxOThhYmNlZGU0
  • https://match.sharethrough.com/sync/v1?gdpr=0&gdpr_consent=
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://cs.admanmedia.com/c01d0246d79eba64b8a7cca07e5b7dc7.gif?puid=59a7d574-1e3e-4863-9a41-9f198abcede4&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DqU...
  • https://match.sharethrough.com/sync/v1?source_id=qUVJTHutDLcyGRS8xfsW2M4g&source_user_id=88798587-ae47-45e5-8b6c-76f0348c4a57&gdpr=0&gdpr_consent=
0
0


GET

current
stx-match.dotomi.com/match/bounce/ Frame 1744
Redirect Chain
  • https://stx-match.dotomi.com/match/bounce/current?networkId=44410&version=1&nuid=59a7d574-1e3e-4863-9a41-9f198abcede4&gdpr=0&gdpr_consent=
  • https://stx-match.dotomi.com/match/bounce/current?DotomiTest=aa728c0eac807c7&is_secure=true&networkId=44410&version=1&nuid=59a7d574-1e3e-4863-9a41-9f198abcede4&gdpr=0&gdpr_consent=
0
0


GET

v1
match.sharethrough.com/sync/ Frame 1744
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/sharethrough/59a7d574-1e3e-4863-9a41-9f198abcede4?gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=BVbSRuzbUWjBEF6bQrmLHKkX&source_user_id=y-EVuEv7FE2oPC9UqtYnNSn7p5p3V24nR_tgAznSa.cuLe~A
0
0


GET

cookie
sync.cootlogix.com/api/ Frame 1744
0
0


GET

cksync.php
hb.yahoo.net/ Frame 1744
0
0


GET

ecm3
s.amazon-adsystem.com/ Frame 1744
0
0


GET

c.gif
c.bing.com/ Frame 1744
0
0


GET

86645
i.liadm.com/s/ Frame 1744
0
0


GET
DATA
200
OK
truncated
/ Frame BF97
593 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ed5ad0eec04e553eba9d52dd0ebc0dae503878399641b8ba9ef9b7e3d8efe69d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
POST
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E6F
0
20 B
150ms
149ms
Ping
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=4011620346479&version=m202507280101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E6F
0
20 B
148ms
148ms
Ping
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=4011620346479&version=m202507280101&ct=76&x=101&cor=8484344304476709000
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2E6F
125 KB
48 KB
466ms
182ms
Script
text/javascript
64.233.180.154
GOOGLE
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BbSRjgiZOk0fIyrV6m0Cq-zM5v3Ar-MlRerdRcFr3lcXDkx-HAPmLMSate4CBgfImMZFWPnq7lBTKYWUMSKIX6UOBTfYSKLSnwShgw3mDT0OR1HE-xRq6jFb-3qgNkKPjN-86B3e-ac-gT8bBjM8uCAajZ0Wcj8Vb09JtAgonpyt19c3R5x11JXL4XOCyWwaMVFAbHmRXXPgbVK7YIF4dKz3Mp8yQdICFDN8-qlBBNR6L3zBdEuhYb0RNikKYZGM5Sm8J3O962Rl2a4ayXR5tQ1wrPtkM1HbebzhdIxXCmD9rZE0Y&dbm_d=AKAmf-DTn00rtWls5CMWfq3gYcUHTAYPIiO0X-nJG1MXne_yfw5q_V3E1H0U-Por37DkjQ89FywK8jKQznKBUegSNAcM0RD7H4V8kpskeMgRvlIcg-sscSIYMgsi2VV-0uKXuVLlydesPtlBVQtBD1b-WPrIyHf3-JLKAdZ0i-dC_rSd9c27ZEMvpIxTKRoj_koF4B2dmLzS5xpFDs9-t15-UCyB3iVxPkKq9gMLvOw3ennN0tdU7LJsQtyk_GUuwUSh6WzVU-C1fuswqUEdLd0mqngqAanGZhkWvRxI1AumCoiajqDyLVJJ0Qpi8B3leV70wgc5of3yFoGaUjylM9OxquPruK0Eyi6Ai1br9dteQYf3vUTKTeKsE-1FIkFajoVvFPWpwVWtnK-W1G2nUey7nLblsyBwv8HkIYDHFDItHZH15WAyGAQDWwr_AwOc0iwrJ0tQy2vbU40EehezAWwa9qtSKDxNkosjAnWejLF2UNSXucpEnsvlgZQ2etNU-nwwd6run8UO6l1n76ihn8l3fYgfYPeMmRvRjQr4FBO54D2aSk2T9h9BhkBBo2FIj45o6CxcZnLffEYT433zNfJKM3yda45RQw6fSBohB1Bmam1ESrKaP8YuPfwl1l_VUCDRkRuh017tROYWr76AE8uAnCoLiNfsi2duhqw-_C4Uf_qJQh1zhiorw4-CnqnaEfUkeyQ_mmZVhy6oW5xDcx5gf6g2k5BSeN9UaO31loDeHkwJPTTO06UJi7_ibrxQQxaaGr4TJHZzJIxtH7FoTzhR3bAonZNF79hT7uafhUXUhRd_-HiB5mAxZC-WP2FQpygKGEO_31qYKZ4Hm3fJmgn53dZgiu-5dktVegQCNawHpzjv4aSwrnc29tVkVfzR5xGYkmeQ1DYXIJ1G5RQfLTTMnv2Y4nqc3R2OWJW2wevyzp6izUM_0x_0oSw5gJSXEMOwRXB6cHQ7nhIsiNfir10jNlB9Y56CTSPyp6bsMy4wTbNSLtR1_KUfeo3-onysHy4s4lP_KnonZCOBrNpqPreiE4aSjZwq95yH_ArkV2uBFTQQ0T8_gZ_-fb__2S8w7zzHHXw_9c3-7j6X8qzxYixKkAJma3lMZrVTgNkpKYsxPeR2dbZQGYsiJ9dNKpTUrlZgMZO5zytVPepVYXU7JktDK5ivtueJvNc992Bm3PnJYsK-vt_T75qa1u0XZnvjCXFR2Awve7VAgRBxYcfZhLMp5w-X-4crxSPQ3YlKsJb-ozbxUIWaSlpxRUrDs-ujlW0JwqYBmqVPpP0T5h2fw4uqkmtPr4eMEatX2XuidyM9URDRSCuf6UuVdwvvCDFrX9VacnC4WovS2gf8CrXyqKsQej07PdP29yGMei5YC9WaES4S1VXR0PEeybLBuXbGYnWZUz8Cu3up-bYNq5tD0DhUjCdkijj722DRxS2sRI-QRAjfsx2WOYO-MTunk0HFZe2uPmA9Z4j7KAQAzAvdGctyxuEo5WoxAww-Rnmll1QCSrW3kt30WIGu4ezAaR4RG3b-z7Clk6JkrLpvTtwlYQaMcJhVsJ1CGc_hyOiC525seC9MKUfP8oFtYvztStZURrBRJVa3LRPjUoXpvdUkjypRdgrFuJSsG4SbvG1Fi1egBs--i9TCAW95niO6AYOxDM-BTu3mNEqPEGImSbB94jGT_k5-7cowiIX8tVTEXqAtGNZWb08H-88EQYBhvZPj26jvv5OvasNafHRiPf3RYbgHb7adiA6tgmWy-IIzmS92eGLzdZcqQ_LzXqXeLL1dF2uLlsIUgUuWp60sGmKPTXJ0uVA8wGXn6Xcjkk2G1OokR0fb1nO250wccj0dMiIi0J7Xury_ntyy8Tmrh8z4smzRCP98FHLF-Wmb-8QjDMRyuw8cxLPw0KFt7f4QADfZL5lfC8prBlUKrmYIDwqymjP_T1dDq94T0LCcl5LYFuzGjyWLYvfgvWFGNNPugal9mBSFRZ2RO5dmAAiSXdmnBZ03H7O-1M2ZrI1M52wFy6Xmw11L_GC1quLrXtyLQszVT_BJYV34w09XAjyKJ1-ZyrivavB2oh-mJnaFf5Tr8DKSB4jaK_KBwSQENcvaYyU2mbjnxZzf5aEW0saSTvl2ZVx1wrayvsEN5oTxVQKlrxy8ZNrTpS1vxjqxOQ_kxLRAcrDK9s9o8xHwbmCsJfxl9IfgHD3QZ6diNrhkq7yAHRjdhMZ83C_4Tt78PJqO03pIe7m23M6BljtF4XWDJXQ18vRiQm01u6X4JSMT9VFx7Pn-0dIhlH9Lb1LCY6qX_lHErImc343FGYTwXA1e9kkbjxrbOJqLIciv6PY_6j2Km9XlDrLia-M6-LbBwTJQJsD7CTy6ZR3t1Yzpwd3o4xUpH4FF0qFnDzfRkviUgPVirO8K5Rahwywm16wt7eVlVOuxJNQ_mW--25OCP56nV8yEZlj3pPafoYkOECopufulRZPcYOInnAN6klUovjY5rAn2Xry5ekIueU139Wl_byQN0U-KBhOb4wIWQkkvSCnKp8UUeAZFto2s2VGVreGLWszON9-8rQgT1C2tIrVebOcQXwpXa8q5bjLEnNVhXr6LOMN_Z8BhwjLJMO7JDV9Gzw8rMsfQb0AWWBQ2OzGZcsjd_vsOvoebSrLmoOO-2XeOOGt5rYOG8L3XYXvrrW6zHWfmSFP7IScHkIRucd_Mf2N_uPfkx1i1vKcrKG-nE3e3tX0K9OX9IEDR9G-XdWk4ZEnxG12C_cfxb8tmcNIPf7nRkxUKx8iacS_F1-96gbzfvsPzcL4owdIWpwstXjVww59jLFY7fEaRNKqp1UYvfl6BfyM0MWg5gqFm7En3NmPqOVKTVB4mL3RNX15_WQ0BW-vUit0m1kienuWDGUoBnqWZH5hSWIkpO0iLDQoB6xZ9NBaHyXXJad7HwpH4L0hU2FXJ7o8RwERmIaL6DsgfJ3tmoTL5q6Y8V8R4XHbE8wzuMTnambzV7WAVGbpiW51vxKDxGVXFEOkAuDxxROkzZKoSwEOYI6oedjsV0ztV-r7B4N6GdoYqXM23NLhuKSZehvkl3n2cNQopbcf7SvROKz15DhX2_Gqr7b0u-pF9lQJUqbfbI1YA-qhUdoXplHjkBbIPYX5huwFQWfWXj5rZRJRIo5zFWDtNYmtdDe2YmGJvnQgW8V8JXU0cY9yO6kSplV6nE-cDKWo19rPCHorogdM_TfcYBLcyDvljgNYKOc4BqLx5if7g26apfZbi9XEuYOuEcqg5gvcpAaZojCNwiKvi8pcpgQP9W7PIEEbcwrgs0CUqFH9nvvlKcJHwuoNcSUSe_mOTYhP8YcR55TYdageKidAEgqk-3lv6OtwBvRFRi_eGgbFfe2RB24rj1fbKmgBCfd91biIaGsUAZRfQWbbVSqV-w1QBI8HtaaccPyXVMdyromHVtZyWGiTJWOmnP4rmkiK7W1R1PpfgnD4GPkQVIAwBUs0im3CrRd6m9kQzVxIGGvAZxL57hRJWPv8L3Z8XT5NNMgyQdXAT7Wk9ZroOJe87zLLU_FrNQPIsUcg6K6u0ZC-OaPk0MsZUQ-3CpZug7L1Jceryp6Jtt4HlXOLzhhS61NCjx60JINQd_OqIV1F_tiGyfFcpZgACxpfULDpplIGYf221jrao1nfZSHSXWrJ6PlSHpdJY4cxaJU5LZHtzsjmS7r_Fkn5XP2Bxp7mOLSnOAfgQdGAzH9ILn8I6_KxfRbJZkPMOdv1Yy2EyqAVJl87jU7G6QVr13emA7-qFOiI9xWVPkiOR65gUDuPElL3cK2WpYkBzBgSyZkDwxX1zn9AGnER8y-NJtMNvLQrHa9dh5JL3Ww5WltVP-_B87yQH__fLtFAqtDKCfT7qI40WXy_CvFxt2LYVfBIZBRF47_Cjq4gtSCVVv9NuHeNo_153eAZK8uuMd2pMxoQQYIcs1zTl_UGI41c2Ow6TEFSN4xuLkovVJ3pIbG-6q_5QGB88N9wvfPsLprfypvExXhyMSbBEYOoBehchVeWb-IfLRtuUzipUoJbiiMndkSarFjPqQ7MGmVzhVN_425yxy8owDkX7AkyKExzBpDBe2x5DzmGeNscu9Ko3pexkY3a7SI-B41iNkdAui2JR2AH4gCMwHgZYrSufAlY&pr=101%3A0.33&cid=CAQS2AEA2abssyYLb_xMhByE26aiLUkKABXdcgpAOmrG_cyeYP1NDNJytQu_zFczGXnqnOkjUo3EziDgtE202M3QZdaJzEYbDxwE7YTr1kEfFazIu_Ux_mFbs46IktREyUXb7krPgXsYsbpNe3uKZ7ibhFbdLqC_cnJZry1IXIM1qZ6IJ22hLqvKjaja-CsFhbSxYOA0JpOji5RtmwhU3hmQEwR2-_wsAYl-DI09gkjYqPcjYSinskiVzZLRjK4DAqJNbaNexPcLSzvdBiMFYU28wXF0ZOtsjuaODTUYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202507280101&nel=1&rfl=https%3A%2F%2Fd2emu.com%2F&ds=l&xdt=0&ct=76&iif=1&cor=8484344304476709000&adk=1009124102&idt=173&cac=0&dtd=47
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
on-in-f154.1e100.net
Software
cafe /
Resource Hash
34524b281b568e2d7417d3e5bcb0f8b091f9a727ff7d843b966f06e20a4411e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
49064
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
GET

cs
cs.lkqd.net/ Frame 5AAC
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=lkqd_dbm&google_cm
  • https://cs.lkqd.net/cs?partnerId=59&partnerUserId=CAESEF-1kxQFgYLbbfGb50g4NGI&google_cver=1
0
0


GET

cs
cs.lkqd.net/ Frame 5AAC
0
0


GET
H3
200
rum
dsum-sec.casalemedia.com/ Frame 5AAC
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1&C=1
43 B
762 B
127ms
126ms
Image
image/gif
104.18.27.193
CLOUDFLARENET
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1&C=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjXiKbAAjAB&v=APEucNVLOBkYRhi_Yo87vTIF_DCeWkUitoDpkpQmS5xY9gt54ZggJO0PwtlEzsFvAifJwAnIYk3GU9Qdz4tXbTYo6mULeF95qA
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h00fWKtiOjPpH4tR8pzxjc6QCjhiUdSKE73pJfJ5HEUkvvvf7GdydksdEhDybTmqZjV6nKHCUW95f7D4MqLNyeaiWjZYsR%2FPARSG%2F2GtZB6xEpV8MBF32B9FSEj2iVnv4OpbTjVEHZkX4w%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/gif
vary
Accept-Encoding
priority
u=2,i
cache-control
no-cache
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
cf-ray
96db136a3b81393b-YVR
content-length
43
server
cloudflare

Redirect headers

cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6V9vWc8G0fffcyK3EorCc1t2KIRewHwg4Wcfjnquo5lBkDuuQctGdZYaa4OpPTlWIBsxioGQ%2FTd71kof99UvsmSWADStpr0WtWsoxveCNMKCTT2Qp0ILvMoUK6ZX4ElTbHRY4LQCTMxuFw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
no-cache
location
/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1&C=1
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
cf-ray
96db1369682f393b-YVR
content-length
0
server
cloudflare
GET
H3
200
rum
dsum-sec.casalemedia.com/ Frame 5AAC
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aJpq2NHM7G4AM-0mAASYIgAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1
43 B
773 B
117ms
116ms
Image
image/gif
104.18.27.193
CLOUDFLARENET
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjXiKbAAjAB&v=APEucNVLOBkYRhi_Yo87vTIF_DCeWkUitoDpkpQmS5xY9gt54ZggJO0PwtlEzsFvAifJwAnIYk3GU9Qdz4tXbTYo6mULeF95qA
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fnlHk673qklHJuNdrTWBPQzKv5L4Wsu5%2Fakap8%2FT8IFbIlgVR%2Fnd3C0m%2BqhUnQd5xM1w0QqPWwj%2Fml2yKJUb2mbXpwJFG4lwcB%2Br6dv%2Fxajq%2BgAEXUZOzvpv5%2FfGjJ8bEMNzBMQcLLKmwA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/gif
vary
Accept-Encoding
priority
u=2,i
cache-control
no-cache
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
cf-ray
96db136b6f4a393b-YVR
content-length
43
server
cloudflare

Redirect headers

cache-control
no-cache, must-revalidate
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGkhgAZ2AxSfxgQO5vhSA_0&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
313
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H3
200
pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0FAB
518 B
196 B
175ms
161ms
Document
text/html
64.233.180.154
GOOGLE
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjLpre8AjAB&v=APEucNU33tvchzlj0din_ukxzFtkAWRUoNCkmwdy6kMNqLvrJL72TlrcuFsDg66iZLLqtqAHlFZahLF7zKB0_MneBc5Il9PK3LLTEtUgcoyfQ1n6SWSniPY
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
on-in-f154.1e100.net
Software
cafe /
Resource Hash
89f619f74c3a78103aa921330f5b92d405a663e122e068aba20cf3e556f78f13
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
176
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:40 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F0B6
103 KB
0
155ms
154ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/dv3.js
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
4ff65551cf2163c775b79ffc50a64103742ba87f4faf17290db264cd0d483cc3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
8618481211254521165
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 22:12:39 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
35662
x-xss-protection
0
server
cafe
POST
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame F0B6
0
20 B
148ms
148ms
Ping
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8614275727378&version=m202507280101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame F0B6
0
20 B
149ms
148ms
Ping
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8614275727378&version=m202507280101&ct=76&x=101&cor=11940159056347038000
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
ad Show response
googleads.g.doubleclick.net/dbm/ Frame F0B6
126 KB
48 KB
401ms
247ms
Script
text/javascript
64.233.180.154
GOOGLE
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D9C0Iuwc4UjC2lMj2_QKeR4aYvtfkyxZXNBnRdRwlPXdgRxXDLvmfVD4Lh3w0edB-kwRqF7yWnfWd8ST7l_qQKK4YcAfue5hB1xcDKUBDvo-QGJlitPG1W5yoISvbR1qRSqRlmjjLorG28jxnX94_Uk-N5HYiJEFp6288sgQ4z1JUyC3WJR26v3LaJvp-EkpQ2FJ9S7ZpbU2EZhMwiJ8i48-_DV363uvj1x3BT6fKfIUxMf8IPyO4GwLDU9EvKx7uoEuH8YRdmgLz9Z1zKvn5sTGtFUzM_0FAXTA8JZc_bPhiMETE&dbm_d=AKAmf-BLYCZXzDludFoOv5J5dsjQJ886M-c1xwDw0B-_B2vA6oPoiAfpf6h1LxGMnyJOarcXD1lCiQLzufNCSKnLg4H0BX8hdco8aarm1mTqZXXpbznEWo1tvdz5iWx1viUMz8D_eH4LYpZ9kaGe4RPPpY7RhksX0fnXB4eSVdapyeIZd4j7iJ0syQNmjcXGmDU-Xw1ualTT9zw461JXq3iz6PzFYNrT8qmG6-CfAf4uT4kkWAK8ZwIixTwzuxkmNHCFudcmMPdP3jkBDRXD1iqdcP9G_XkWCnoGawwqj96Ssgs3a5tXmJXzJtkmmqQU1ilql0CG5-SemxQrW2t90KcSdqyjFzeHkXzpwtMk-RxvI6z55kv_52X9GpuQsQ9325IWILunBUOJi7HGQw8GpcNhn_coMojnvAKg4a2u4mj0mu6SbucRg9FLpr1avZ2LEJh8JU-IMPWMH-PhIsizhRVWpF3zGt5oSPRKNz3_TsdZ6nzP-ktWE3zJ4MRC8HNHFOdWRpgActYA-NI5FOO0LFGMN7R7oHb3DnnVbHyCeWkyrOS6jrj4ONXFQMgcIKFpf5t19GgEK0osIDftLCopaw4aKDHNEGojyEIlP-815LspLMF8CBJNrxu-xLYNk44djIB7qV0n2ucErY78EA_GsEWPd36H-M57UoX_twbMcc1EknA64Y-aKm5v2gGkasm1x-BbsWEmB_Dr_YRTpmHD8SEKvPib4WXaWA8VEJg3WjngsG2Mh99lezZiRlZaZb-fCeQcIUwPa6GUR-XZbC9DFNrhLu8QtpH8tOyl148B0SfCzHPkaR2LwEQrbX5ejd3fXlYY7vBULqkov5qsBmGhRHY0-OxN9gZi4REMQUwUoOoYg9N_t5RgKB7311Om13xToZLfQih6IYQansIkoZh09ALBQwdvbE0DXLM5O5iNbMWB7Z7vHGr78ZaN8N65KtR3F3kaTmvYV11zzOBATyzpjE9WXTzqWkSEWDzDNNT1PJCWMGExwTciMX1RAGootELcLjxDHt-9iUigSOgkl5D-MA026LRRlQZL9BNuLtwcGlIFZVVqGCyM_FqfxCnj_LXxqsCDkgnyru3MNQhfoI2DkYeToBBOihBEfr9qfumkQ5QKad8DkSxmX76HAXQd_teYNck86_Si9gGAiCzcmsGGPpO4ms5Ax5k2h70lE1Ri591nBg_i-2i2o0ZQSJgbbtJnk-UaR-K-LB_4sYaZqrDXmMIhGNVpQoDx5Fr61swe14q4qUKUSHD4S8nx6Q6yLXLV0u_mBi18G_jQj5CHNXKFLd5X2kj1cmMaxK2qBjvHEJ25LMPYCMtha3J06BTQDcMD4KVDYBVfXxrAVXzDzAwgVFaJ5t0C5W1W923ZkQzBUN4wAWUKt5Fv0PKOEa4tU9pK2UenRGFqpLOQ_0T69m3LRrOD-_A0wwR0PlgjAm5-UPqPMKM8m2N-wGY1nBTG7PCC5outiwL9H-pJZzf2bp9umxgjAdluZh8YclYsoAYJupojol7X_HjdF_-NLycelgs7nhCkWq_ZL-3BU_WGaZF3T51v2kDmYq381CYYWQqi9-W7LbrmKrLBPzBRf9ismpooH3pCZAuiKs8crN8YA_5QMPF5u0rp6xeQBi5M_ojBrwDdNJHD1y76lhEW2IIBg-YbeUZokt6nw8A2E8T1q09F_j0AnQTDiP0lca5Kl9oXyvk7s3IPHrrVcjUUekR8TI7tYL850lsWB8nWE0kSRisQqR77psB-pw45_DuYwSvpUuR3ZBZ6-NnrDKC0-6OfRBnQqb9Ha_xz6fHL396cL0Y8Yy4OK_hJmXehNKTRWRsRAht3RFYpdniqcNnzQN0U8B9JH19Vbag832p_INWspombCPJ63Sfw12buvThQFF9O_QLCiKA_gh5OHCvIKA_GOL-hwiD_HIulIn9154nghCfn_WMyAuGNsVcmXWIjE3yKlYdzpW2_RrNwMkEH1FqV7HZ4u74iuWVRd0jlfMQhcGdmenEin_QFCiwx5TmkdwJ--EPsWbxw6weNoy_GOrx5fuB0zzfdYwXlBL3FOF4T2QNXiPOHdW6ObWv5ehoaEdH5l5gk9S_DPCZu0UOI6Egn3ZfoyaJmedMNSwTxajxt1kPytzMw2omXL3h-NpU7BwiPGtSA9JedR2oMLKhHmG3kptdkriC44pmjmX1F4XBrclniKleG8xeG3nUycv_NMFNP_bRJ5socnrAnTscnGvgmG0uNt_G9ZTu4iew8iPwsDaf02DhYCxdjrzMvzhpCv9sssSyPi0q5_K0UPAtaXCj_k3VkuJuFSTptKwbhsno_tHiPA3XQNSIm6nsIF2Nb0nGYyfFjplsh_t7GOAoazVi57AIgzbaV3BkO7utr_lZZlWUAGeynqobH45Ef-CewOV1FZgaw0N4e_ZWMKfPmPwCvnJYt9yge7aXAkHDjvX-7tkLGfpm-tBwV5lxBOv1gheMs6PJlNblSRrbTUxWGaunCa6pprs_w_4m-F7s_BRxXe37Snj14yPwr6ejm9Qh6ycxov8VrIEt3w4y7dnv_qrvaozmsZ6WIuyR0Ua8UlkHxq1cX1cF58fwGUqRB4fYLCeZKMZR8nNfGE3Qmj3to8lpgDkQPoAxWxguOprd5_lLyLzxnKXfJmuLoYP7y25YeL4fStMsgESYw2oKQ8jXFTHhNZpainj9Y_KmGG9qOQKMhyoyt_4rXCtmvrOysl-p06kBfKWw5KfwEJJ9Z3GtDGwUy2j2wZVP11yYOJu9ZRGL0uHrTejXeBxKMdU9cvVflrlP96h8AGFcAtWT0MvfCadIFiIfVDNH4lF7baeLpER8yTVYY76ZS6zkL8PgGmYmOPz4F9mQ2RrXUlwflLCHRIlzjNYsKC5VUX1ASZPDtdlBe5ibluahHKYiE9JvgAMGtFTWJLKtdJJD5UZ9yZ0VW66XBC1yQB3bVtCyvId_eo1e0JNfbQQYZTogULgmGnEO1cr8Qo83iA6Ex_yOAjX2n3pit_eZ2TShnPrZZmP3-LfXaN8zqKNYACJ_Xp42p2H0vsyRLnn8RZwoZXDvSFQEJhdEu39heGGa9NrFFEbKfrcJEVV4qc8EAmBOmPAPeJzheOSQ8aDyvmK5W83CTGh4cP9PtZ2xyCewdHvvA5MWQ1nybDb4zljhYT7UfVZQpPrdnHMrZzvGCLL_7NU01zrueYAA1w2d6R4jmThFU0P3rsFoU6PkhUJjwybE3zOaAfiZk-lxcVM4X3ogLMvsQoN5q2xgo7KRkO8UajmKtFoz3SCuC7PKvW5Mg8YpxMOKQsrX-nAakWXWaqMP6SXEcyqcOoyxpaRZNEUykwO1or2g7mg2Fgap8o40pUhHjfu0AVRTzm7hSZeYIeWViA14pIbUaB6X0jeJ8jBQakmMDw8aS9d2CeYV8VZwGNODlk1It3YkRgEZl4ney7PqxTAml1kWaDVS9XWaR48_xdsfjE7wGcEPwKC80cxcOVZ9tedzUd8JO6ec_O80ZFogkuRm0lYmvzxi1SK-I1FUaVjcWotUvqHkXl11rUVARiNRbhzCLIhdvkZR63d0F7v3D0aVIVnwWx9lbKtg40YP8Ggeh0cYvGR5grNF7jN7VbUUZy8KJX3EFcxNyrbz20KkvUDTUuZfeUXh2txuvPp3IAD8LjDEUnhNG5As7V1ldJkm_KQDzY1MAYKQBzzb3benOwI8IgaZvGo_PBxMKHgZ0kYE94dnkSJcMfKYd9tK3HcdztLEigBBKyAiUELGD53tTSfKMeBcPRfTZi2TR9ZPpmoW-73hpgGHCV6Ua35Hvu8lIgkuv3asFc1wBF4PkzdWTdedTIKFBKPwvThD68zevRtXIgt8y1PJJJ01Hgk4jiNpM8-o4u7fcrLugAPTcg0rj9q6a4jtqPR-2AyEevdhDYa4jOYujsJ9kgJDwSQP2IfKWqEA8e59NVNTS816g5E8a_L8jq4nMHnj0JsE3wpVJYfoFxdK6B3bIqspQLhZFfl6wgPMn-BlZChHMY3mi_I5BAhlIedf4Kd76my9ArtuDPnCJGfR-_Xm4jseaF7JKPX3Bne1hrOh7cGkamxyTwnUj95_pz35__W-8yd7hm2mLT9ssk0-4Uny2i5-uU37d3s5jugQ_iZMTRCamWLIgOX7xWJkZOIQ&pr=101%3A0.45&cid=CAQS2AEA2abss2p2uCo029NZI4eeIShovJ3JYuWPd2YlegDYI6dtXMelJYcbLmkAqOIatX8Z-QBDeJQXTHjFC6Lhu6zi4DyWF5oqHSoByLq1IDRQ5Xk4tZdrgMgb-OlRoaidC6q1B14Tvdd0ZAOsybQKcfpOY_omWt3buENCxl15TRwYKdSZeQ6lAiERzv8fT8xl82AOnOCXLjwkO8h6balDkkDnyr8Q-CFrWP2nNrb1R4BIRHWUE0IXqPQWIl_pjwGteMPL2LZUJ5S61BgmnHpOmdGL0WDVg_BvWXIYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202507280101&nel=1&rfl=https%3A%2F%2Fd2emu.com%2F&ds=l&xdt=0&ct=76&iif=1&cor=11940159056347038000&adk=2369114990&dtd=41
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
on-in-f154.1e100.net
Software
cafe /
Resource Hash
0f5af31d9725ce0d2590a10f95bb16ddc6c0b9e27278c838df60e5133e9516da
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
49120
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
GET
H3
200
gen_204
pagead2.googlesyndication.com/pagead/ Frame F0B6
42 B
63 B
149ms
148ms
Image
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BDp82GNfoAUO8PshEL9SxV6IORINpnvKJC80DperwEMeDluDuXKey5PUrX-xRUKjDrSHqCll1upZJLNbHREZ9uz3HT8LysA0UVVjQQ34PjSosUzWA
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
setuid
pbs.nitropay.com/
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-nitro&gdpr=&gdpr_consent=&us_privacy=1---
  • https://pbs.nitropay.com/setuid?bidder=rubicon&uid=ME7O4T9T-1O-JASD&us_privacy=1---
86 B
104 B
128ms
127ms
Image
image/png
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/setuid?bidder=rubicon&uid=ME7O4T9T-1O-JASD&us_privacy=1---
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
86
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/png
vary
Accept-Encoding,Origin

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://pbs.nitropay.com/setuid?bidder=rubicon&uid=ME7O4T9T-1O-JASD&us_privacy=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
e1bddfc34a927e97bda010c0d8a62b62
content-length
0
Content-Type
text/html
GET
H2
200
setuid
pbs.nitropay.com/ Frame 29E7
0
549 B
309ms
143ms
Image
text/html
35.244.144.25
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pbs.nitropay.com/setuid?bidder=inmobi&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.144.25 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
25.144.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
text/html
vary
Accept-Encoding,Origin
GET
H/1.1
200
dcm
s.amazon-adsystem.com/ Frame 29E7
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=eea9dd1e-d48b-4df9-9291-35dc5c187623&id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
  • https://s.amazon-adsystem.com/dcm?pid=eea9dd1e-d48b-4df9-9291-35dc5c187623&id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&dcc=t
43 B
853 B
168ms
168ms
Image
image/gif
98.82.158.241
AMAZON-AES
General
Full URL
https://s.amazon-adsystem.com/dcm?pid=eea9dd1e-d48b-4df9-9291-35dc5c187623&id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&dcc=t
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-98-82-158-241.compute-1.amazonaws.com
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
27969J94GB57TGM0TDAJ
Content-Length
43
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:41 GMT
Content-Type
image/gif
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server

Redirect headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location
https://s.amazon-adsystem.com/dcm?pid=eea9dd1e-d48b-4df9-9291-35dc5c187623&id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&dcc=t
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
3CSV3TVRH40WXKSW0701
Content-Length
0
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:40 GMT
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server
GET
H2
200
setuid
s2s.t13.io/ Frame 29E7
86 B
489 B
344ms
147ms
Image
image/png
34.107.140.113
GOOGLE-CLOUD-PLAT...
General
Full URL
https://s2s.t13.io/setuid?bidder=inmobi&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&f=i&uid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.140.113 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
113.140.107.34.bc.googleusercontent.com
Software
/
Resource Hash
c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

strict-transport-security
max-age=31536000
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/png
GET
H2
200
pixel
cm.g.doubleclick.net/ Frame 29E7
170 B
235 B
218ms
206ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_hm=NFuTDGaON6wxcVMgDqxV&gdpr_consent=&gdpr=0&google_nid=inmobi_dbm
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame 29E7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_cm
  • https://sync.inmobi.com/gob?google_gid=CAESEAwvIeS78AsS2NtPa_gICyM&google_cver=1
  • https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=&retry=
  • https://cm.g.doubleclick.net/pixel?google_hm=NFuTDGaON6wxcVMgDqxV&google_push=&google_nid=inmobi_new_eb
170 B
191 B
154ms
153ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_hm=NFuTDGaON6wxcVMgDqxV&google_push=&google_nid=inmobi_new_eb
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

via
1.1 google
location
https://cm.g.doubleclick.net/pixel?google_hm=NFuTDGaON6wxcVMgDqxV&google_push=&google_nid=inmobi_new_eb
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
GET
H/1.1
200
dcm
s.amazon-adsystem.com/ Frame 29E7
Redirect Chain
  • https://s.ad.smaato.net/c/?dspInit=1001980&dspCookie=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&gdpr=0&gdpr_consent=
  • https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=35667f21a0&gdpr=0&gdpr_consent=
43 B
853 B
285ms
153ms
Image
image/gif
98.82.158.241
AMAZON-AES
General
Full URL
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=35667f21a0&gdpr=0&gdpr_consent=
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-98-82-158-241.compute-1.amazonaws.com
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
TG1GFF5DPB203HTWEMJY
Content-Length
43
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:41 GMT
Content-Type
image/gif
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server

Redirect headers

via
1.1 google
cache-control
no-cache, must-revalidate
location
https://s.amazon-adsystem.com/dcm?pid=6c6fd2c8-c9f3-4a37-9a77-029dc3cc98b3&id=35667f21a0&gdpr=0&gdpr_consent=
content-length
5
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
text/plain; charset=utf-8
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=g6nxmp9&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://sync.inmobi.com/setuid?bidderID=21&dspUserId=46f4af91-2ba3-4305-896c-c258960d2f82
0
40 B
144ms
143ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=21&dspUserId=46f4af91-2ba3-4305-896c-c258960d2f82
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

location
https://sync.inmobi.com/setuid?bidderID=21&dspUserId=46f4af91-2ba3-4305-896c-c258960d2f82
content-length
209
date
Mon, 11 Aug 2025 22:12:40 GMT
server
Kestrel
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3535&partner_device_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26dspUserI...
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3535&partner_device_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26ds...
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%252Chttps%25253A%25252F%25252Fsync.inmobi.com%25252Fsetuid%25253FbidderID%25253D877%...
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=46f4af91-2ba3-4305-896c-c258960d2f82&ttd_puid=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2%2Chttps%253A%252F%252Fsync.inmobi.com%...
  • https://sync.inmobi.com/setuid?bidderID=877&dspUserId=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2
0
17 B
156ms
156ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=877&dspUserId=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

strict-transport-security
max-age=31536000
location
https://sync.inmobi.com/setuid?bidderID=877&dspUserId=5110acd6-08a1-4b2b-87f7-229fe8d8f8d2
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
server
Jetty(11.0.25)
GET
H2
200
159
match.deepintent.com/usersync/ Frame 29E7
0
337 B
624ms
325ms
Image
image/gif
8.18.47.7
DEEPINTENT
General
Full URL
https://match.deepintent.com/usersync/159
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.18.47.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
image/gif
server
b
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=aerserv&user_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&gdpr=0&gdpr_pd=&gdpr_consent=&us_privacy=&expires=30
  • https://x.bidswitch.net/ul_cb/sync?ssp=aerserv&user_id=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&gdpr=0&gdpr_pd=&gdpr_consent=&us_privacy=&expires=30
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=aerserv
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=6765784818800077139&ssp=aerserv
  • https://sync.inmobi.com/setuid?bidderID=128&dspUserId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=&gdpr_consent=&us_privacy=
0
17 B
305ms
304ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=128&dspUserId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//sync.inmobi.com/setuid?bidderID=128&dspUserId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=&gdpr_consent=&us_privacy=
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:42 GMT
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://b1sync.zemanta.com/usersync/inmobi/?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=0&gdpr_consent=&us...
  • https://b1sync.outbrain.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=0&gdpr_consent=&puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&s...
  • https://b1sync.zemanta.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=0&gdpr_consent=&obuid=77d863ca-bfff-42bb-bef2-b31e4a21b32e&puid=ID...
  • https://sync.inmobi.com/setuid?bidderID=210&dspUserId=__ZUID__&gdpr=0
0
17 B
212ms
211ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=210&dspUserId=__ZUID__&gdpr=0
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, no-store, must-revalidate
location
https://sync.inmobi.com/setuid?bidderID=210&dspUserId=__ZUID__&gdpr=0
pragma
no-cache
expires
Thu, 01 Dec 1994 16:00:00 GMT
p3p
CP="We do not support P3P header."
content-length
100
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
text/html; charset=utf-8
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://sync.e-volution.ai/a184e2218ea9f18e32c70fb304405e72.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D957%26dspUserId%3D%5BUID%5D...
  • https://sync.inmobi.com/setuid?bidderID=957&dspUserId=6229211d-0d72-4f2b-9961-12e744f31ad2
0
17 B
222ms
221ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=957&dspUserId=6229211d-0d72-4f2b-9961-12e744f31ad2
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Location
https://sync.inmobi.com/setuid?bidderID=957&dspUserId=6229211d-0d72-4f2b-9961-12e744f31ad2
Pragma
no-cache
Connection
keep-alive
Expires
0
Content-Length
0
Date
Mon, 11 Aug 2025 22:12:41 GMT
Server
nginx
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://inmobi-match.dotomi.com/match/bounce/current?networkId=98193&version=1&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
  • https://inmobi-match.dotomi.com/match/bounce/current?DotomiTest=88cf87774452482&is_secure=true&networkId=98193&version=1&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
  • https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQAN-WQ7mAlNOAIisdm-AQEBAQEBAQCZmjBhcAEBAQEBAQEB&expiration=1755036761&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&is_secure=true
0
40 B
144ms
144ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQAN-WQ7mAlNOAIisdm-AQEBAQEBAQCZmjBhcAEBAQEBAQEB&expiration=1755036761&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&is_secure=true
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

expires
0
cache-control
no-cache, private, max-age=0, no-store
location
https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQAN-WQ7mAlNOAIisdm-AQEBAQEBAQCZmjBhcAEBAQEBAQEB&expiration=1755036761&nuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&is_secure=true
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
server
nginx
GET
H2
500
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://id.rlcdn.com/713074.gif?
  • https://id.rlcdn.com/1000.gif?memo=CPLCKxoNCNnV6cQGEgUI6AcQAEIASgA
  • https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
60 B
60 B
221ms
220ms
Image
image/avif
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
a6642f816880217435423f2ae3bc4af4cdfb0ef852c20563e304eff8b79f025a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
60
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
image/avif;charset=UTF-8
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://ib.adnxs.com/getuid?https://sync.inmobi.com/setuid?bidderID=32&dspUserId=$UID
  • https://sync.inmobi.com/setuid?bidderID=32&dspUserId=1820804327581032944
0
17 B
153ms
153ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=32&dspUserId=1820804327581032944
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control
no-store, no-cache, private
location
https://sync.inmobi.com/setuid?bidderID=32&dspUserId=1820804327581032944
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
eb1a6300-72ac-40a4-a0a8-83fd563c35d7
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
200
ImgSync
image8.pubmatic.com/AdServer/ Frame 29E7
0
69 B
592ms
239ms
Image
text/plain
8.28.7.82
AS-PUBMATIC
General
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=157097&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D157097%26mpc%3D4%26fp%3D1%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync.inmobi.com%252Fsetuid%253FbidderID%253D76%2526dspUserId%253D%2523PMUID
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

date
Mon, 11 Aug 2025 22:12:41 GMT
strict-transport-security
max-age=16070400; includeSubDomains
content-length
0
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D13%26dspUserId%3D%24UID
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D13%26dspUserId%3D%24UID&sovrn_retry=true
  • https://sync.inmobi.com/setuid?bidderID=13&dspUserId=LJpUALZH0jc6F_obRdi4dmiK
0
17 B
143ms
143ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=13&dspUserId=LJpUALZH0jc6F_obRdi4dmiK
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

location
https://sync.inmobi.com/setuid?bidderID=13&dspUserId=LJpUALZH0jc6F_obRdi4dmiK
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, DELETE, PUT
access-control-allow-origin
*
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Accept-Encoding
access-control-allow-headers
X-Requested-With, Content-Type
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://csync.loopme.me/?pubid=9724&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D109%26dspUserId%3D%7Bviewer_token%7D
  • https://sync.inmobi.com/setuid?bidderID=109&dspUserId=5ea36180-cebc-480b-bcb4-3a31720da973&gdpr_consent=null&gdpr=0
0
17 B
163ms
136ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=109&dspUserId=5ea36180-cebc-480b-bcb4-3a31720da973&gdpr_consent=null&gdpr=0
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

location
https://sync.inmobi.com/setuid?bidderID=109&dspUserId=5ea36180-cebc-480b-bcb4-3a31720da973&gdpr_consent=null&gdpr=0
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
server
_
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://us.ck-ie.com/inmslw82.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-893%26dspUserId%3D%7B%24PARTNER_UID%7D
  • https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=695a1446c371f7aca17ed314b8fb32c5d1edf8c1b244151f7b215022f82da6fb
0
17 B
150ms
139ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=695a1446c371f7aca17ed314b8fb32c5d1edf8c1b244151f7b215022f82da6fb
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Transfer-Encoding
chunked
Cache-Control
no-cache, no-store, must-revalidate
Location
https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=695a1446c371f7aca17ed314b8fb32c5d1edf8c1b244151f7b215022f82da6fb
Pragma
no-cache
Connection
keep-alive
Expires
0
Date
Mon, 11 Aug 2025 22:12:41 GMT
Server
nginx
GET
H2
204
inmobi
tr.blismedia.com/v1/api/sync/ Frame 29E7
0
171 B
450ms
227ms
Image
text/plain
34.96.105.8
GOOGLE-CLOUD-PLAT...
General
Full URL
https://tr.blismedia.com/v1/api/sync/inmobi?gdpr_consent=&gdpr=0
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
date
Mon, 11 Aug 2025 22:12:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=inmobi&gdpr=0&gdpr_consent=
  • https://sync.inmobi.com/setuid?bidderID=82&dspUserId=35667f21a0
0
17 B
225ms
225ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=82&dspUserId=35667f21a0
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:40 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

via
1.1 google
cache-control
no-cache, must-revalidate
location
https://sync.inmobi.com/setuid?bidderID=82&dspUserId=35667f21a0
content-length
5
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
text/plain; charset=utf-8
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://sync.1rx.io/usersync2/inmobi&gdpr=0&gdpr_consent=
  • https://sync.inmobi.com/setuid?bidderID=23&dspUserId=OPTOUT
0
17 B
225ms
225ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=23&dspUserId=OPTOUT
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://sync.inmobi.com/setuid?bidderID=23&dspUserId=OPTOUT
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
content-type
text/html
etag
OPTOUT
GET
H/1.1
200
OK
redirect
sync.clearnview.com/ Frame 29E7
0
364 B
606ms
234ms
Image
text/plain
204.62.12.198
NATCOWEB
General
Full URL
https://sync.clearnview.com/redirect?gdpr=0&gdpr_consent=&usp_consent=&pubid=17&pubuid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D869%26dspUserId%3D%24UID
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
204.62.12.198 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

Transfer-Encoding
chunked
Access-Control-Allow-Origin
https://sync.inmobi.com
Keep-Alive
timeout=5
Date
Mon, 11 Aug 2025 22:12:41 GMT
Connection
keep-alive
Access-Control-Allow-Credentials
true
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=138&gdpr=0&gdpr_consent=
  • https://sync.inmobi.com/setuid?bidderID=238&dspUserId=ORyNg0miWfN5T60Kv2knVNRo110
0
17 B
194ms
194ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=238&dspUserId=ORyNg0miWfN5T60Kv2knVNRo110
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Location
https://sync.inmobi.com/setuid?bidderID=238&dspUserId=ORyNg0miWfN5T60Kv2knVNRo110
Content-Length
108
Date
Mon, 11 Aug 2025 22:12:42 GMT
Content-Type
text/html; charset=utf-8
Connection
keep-alive
GET

user-sync
sync.adkernel.com/ Frame 29E7
0
0


GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://cs.playdigo.com/dd3f91b3168664e47ebd1aec9512abd4.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1302%26dspUserId%3D%5BUID%5D&g...
  • https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=3de35a0e-0366-47b1-8d74-03e4d468c2ac
0
40 B
184ms
181ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=3de35a0e-0366-47b1-8d74-03e4d468c2ac
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Location
https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=3de35a0e-0366-47b1-8d74-03e4d468c2ac
Pragma
no-cache
Connection
keep-alive
Expires
0
Content-Length
0
Date
Mon, 11 Aug 2025 22:12:42 GMT
Server
nginx
GET
H/1.1
200
OK
inm
match.prod.bidr.io/cookie-sync/ Frame 29E7
43 B
433 B
573ms
146ms
Image
image/gif
34.198.47.23
AMAZON-AES
General
Full URL
https://match.prod.bidr.io/cookie-sync/inm
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.47.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-47-23.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
cache-control
no-cache, must-revalidate
pragma
no-cache
Connection
keep-alive
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length
43
Date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/gif
Server
gunicorn
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=inmobi&gdpr=0&gdpr_consent=
  • https://sync.inmobi.com/setuid?bidderID=16&dspUserId=C_pgKG0SJyaTO2kRskKQqfAgRR42lsxfV5mM_0IMmTI&pi=inmobi&gdpr=0&gdpr_consent=
0
17 B
171ms
170ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=16&dspUserId=C_pgKG0SJyaTO2kRskKQqfAgRR42lsxfV5mM_0IMmTI&pi=inmobi&gdpr=0&gdpr_consent=
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

expires
Thu, 01 Jan 1970 00:00:00 GMT
cache-control
no-cache, no-store, must-revalidate, private, max-age=0
location
https://sync.inmobi.com/setuid?bidderID=16&dspUserId=C_pgKG0SJyaTO2kRskKQqfAgRR42lsxfV5mM_0IMmTI&pi=inmobi&gdpr=0&gdpr_consent=
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT, Mon, 11 Aug 2025 22:12:42 GMT
pragma
no-cache
vary
Accept-Encoding
GET
H2
404
4831fbf13dd518a56346a6e0ec8ba9d5.gif
cs.krushmedia.com/ Frame 29E7
9 B
321 B
617ms
256ms
Image
text/plain
80.77.82.130
NATCOWEB
General
Full URL
https://cs.krushmedia.com/4831fbf13dd518a56346a6e0ec8ba9d5.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1315%26dspUserId%3D%5BUID%5D&gdpr=0&gdpr_consent=
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
80.77.82.130 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

expires
0
cache-control
no-cache, no-store, must-revalidate
date
Mon, 11 Aug 2025 22:12:42 GMT
pragma
no-cache
content-type
text/plain
server
nginx
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://tracker-shr.ortb.net/sync?id=1&uid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
  • https://sync.inmobi.com/setuid?bidderID=276&dspUserId=35243110-c923-213f-a837-46529640c5a0
0
17 B
144ms
142ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=276&dspUserId=35243110-c923-213f-a837-46529640c5a0
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

access-control-allow-methods
GET, DELETE, OPTIONS, POST, PUT, PATCH
permissions-policy
browsing-topics=()
location
https://sync.inmobi.com/setuid?bidderID=276&dspUserId=35243110-c923-213f-a837-46529640c5a0
content-length
106
content-type
text/plain; charset=utf-8
access-control-allow-headers
*
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://ittpx.eskimi.com/sync?sp_id=64&gdpr=0&gdpr_consent=&us_privacy=
  • https://ittpx.eskimi.com/sync?gdpr=0&gdpr_consent=&sp_id=64&us_privacy=&er=true
  • https://sync.inmobi.com/setuid?bidderID=814&dspUserId=54c8201b-19af-4941-aed7-0719576a8192
0
17 B
143ms
142ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=814&dspUserId=54c8201b-19af-4941-aed7-0719576a8192
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control
no-cache
location
https://sync.inmobi.com/setuid?bidderID=814&dspUserId=54c8201b-19af-4941-aed7-0719576a8192
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
text/html; charset=UTF-8
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://t.adx.opera.com/pub/sync?pubid=pub6871903319744&gdpr=0&consent=&us_privacy=
  • https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=d900db5100c47272&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub6871903319744
  • https://t.adx.opera.com/sync?vendor=60369&pubid=pub6871903319744
  • https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU162408b591a6480d9e8c41fd2e71c520
0
40 B
144ms
141ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU162408b591a6480d9e8c41fd2e71c520
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Location
https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU162408b591a6480d9e8c41fd2e71c520
Pragma
no-cache
Connection
keep-alive
Access-Control-Allow-Credentials
true
Access-Control-Allow-Methods
POST, GET, OPTIONS
Expires
Mon, 01 Jan 1990 00:00:00 GMT
Access-Control-Allow-Origin
*
Content-Length
117
Date
Mon, 11 Aug 2025 22:12:43 GMT
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
GET
H2
200
setuid
sync.inmobi.com/ Frame 29E7
Redirect Chain
  • https://cs.admanmedia.com/e03deca3316b700a1ce99c41e324fd03.gif?puid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D149%26dspUserId%3D%5BUID%5D&...
  • https://sync.inmobi.com/setuid?bidderID=149&dspUserId=88798587-ae47-45e5-8b6c-76f0348c4a57
0
17 B
143ms
142ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=149&dspUserId=88798587-ae47-45e5-8b6c-76f0348c4a57
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

expires
0
cache-control
no-cache, no-store, must-revalidate
location
https://sync.inmobi.com/setuid?bidderID=149&dspUserId=88798587-ae47-45e5-8b6c-76f0348c4a57
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
pragma
no-cache
server
nginx
GET
H2
200
sync
pippio.com/api/ Frame 29E7
Redirect Chain
  • https://idsync.rlcdn.com/713113.gif?partner_uid=ID5-2-ed7d308a-42f8-4224-8636-97ac5ecf0b41
  • https://pippio.com/api/sync?pid=5324&it=1&iv=13fc8101735d79d229ecc42073f5fc7620c9d4d4ab563c51bca28431c680543f791426b5417dce21&_=2
42 B
569 B
395ms
152ms
Image
image/gif
107.178.254.65
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pippio.com/api/sync?pid=5324&it=1&iv=13fc8101735d79d229ecc42073f5fc7620c9d4d4ab563c51bca28431c680543f791426b5417dce21&_=2
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
107.178.254.65 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
65.254.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.inmobi.com/

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
42
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://pippio.com/api/sync?pid=5324&it=1&iv=13fc8101735d79d229ecc42073f5fc7620c9d4d4ab563c51bca28431c680543f791426b5417dce21&_=2
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
GET
H2
200
usync.html Show response
eus.rubiconproject.com/ Frame DC62
269 B
379 B
543ms
250ms
Document
text/html
23.3.133.134
AKAMAI-AS
General
Full URL
https://eus.rubiconproject.com/usync.html?p=inmobi&endpoint=us-east
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.3.133.134 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-3-133-134.deploy.static.akamaitechnologies.com
Software
Apache/2.4.62 (Debian) /
Resource Hash
e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer
https://sync.inmobi.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
224
content-type
text/html
date
Mon, 11 Aug 2025 22:12:40 GMT
etag
"10d-629840acea280-gzip"
last-modified
Wed, 18 Dec 2024 04:42:34 GMT
server
Apache/2.4.62 (Debian)
vary
Accept-Encoding
GET
H2
200
user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 2162
20 KB
7 KB
578ms
206ms
Document
text/html
23.221.241.44
AKAMAI-AS
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159035&gdpr=0&gdpr_consent=&userIdMacro=(PM_UID)&predirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-SEA-76%26dspUserId%3D(PM_UID)
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-221-241-44.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer
https://sync.inmobi.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=55342
content-encoding
gzip
content-length
6694
content-type
text/html
date
Mon, 11 Aug 2025 22:12:40 GMT
expires
Tue, 12 Aug 2025 13:35:02 GMT
last-modified
Wed, 13 Nov 2024 05:14:24 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
GET
H2
200
butler
b.sharethrough.com/ Frame CC8F
95 B
437 B
144ms
142ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=groundControlPresent&arid=9ce185cc-56b5-46ef-8993-e7b05177e48c&pkey=jTgUsUdJBG7teDwXK5GPmgLW&supplyId=WYu2BXv1&ckey=17CzF5ktQoN1vCLa3wP58vYU-671712343&umtime=1754950359845&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=0356b7ca-a913-4a86-9528-e4df967c8069&awid=dd78273b-711f-4ef2-b72c-e1a7d1420405&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0&pwidth=160&pxoff=0&pyoff=0&twidth=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1167
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
KhqV4NGwa_T1oy_fgBXCxPzN6qR06ZJinkiEF3toKej1NyyYICxbBg==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
butler
b.sharethrough.com/ Frame CC8F
95 B
438 B
214ms
212ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=impression&arid=9ce185cc-56b5-46ef-8993-e7b05177e48c&pkey=jTgUsUdJBG7teDwXK5GPmgLW&supplyId=WYu2BXv1&ckey=17CzF5ktQoN1vCLa3wP58vYU-671712343&umtime=1754950359887&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=0356b7ca-a913-4a86-9528-e4df967c8069&evid=&browser=Chrome&platform=desktop&url=https%3A%2F%2Fd2emu.com&referrer=https%3A%2F%2Fd2emu.com%2F&pwidth=160&pxoff=0&pyoff=0&twidth=160&trueTemplateEnabled=false&awid=dd78273b-711f-4ef2-b72c-e1a7d1420405&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0&measureMode=standard
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1167
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
KQkyN3_iLkdeGqn8xAxkTUi_9ZJk3sBbknsy8BnzfDJXPDAjKHEtrw==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
setuid
ib.adnxs.com/ Frame 0FAB
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
  • https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESECWS8E5JJYGfBKWejEDvxdM&google_cver=1
43 B
1 KB
248ms
199ms
Image
image/gif
68.67.181.103
ASN-APPNEX
General
Full URL
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESECWS8E5JJYGfBKWejEDvxdM&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjLpre8AjAB&v=APEucNU33tvchzlj0din_ukxzFtkAWRUoNCkmwdy6kMNqLvrJL72TlrcuFsDg66iZLLqtqAHlFZahLF7zKB0_MneBc5Il9PK3LLTEtUgcoyfQ1n6SWSniPY
Protocol
H2
Server
68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
212.104.215.93; 212.104.215.93; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
bcee547a-66bf-4423-abcc-a189bc230e32
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5

Redirect headers

cache-control
no-cache, must-revalidate
location
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESECWS8E5JJYGfBKWejEDvxdM&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
301
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame 0FAB
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMDgwNDMyNzU4MTAzMjk0NA%3D%3D&gdpr=0
170 B
191 B
160ms
158ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMDgwNDMyNzU4MTAzMjk0NA%3D%3D&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjLpre8AjAB&v=APEucNU33tvchzlj0din_ukxzFtkAWRUoNCkmwdy6kMNqLvrJL72TlrcuFsDg66iZLLqtqAHlFZahLF7zKB0_MneBc5Il9PK3LLTEtUgcoyfQ1n6SWSniPY
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:41 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

cache-control
no-store, no-cache, private
location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgyMDgwNDMyNzU4MTAzMjk0NA%3D%3D&gdpr=0
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
9b530aa0-5c25-4d30-8995-b2dc30c54082
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame 0FAB
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_dbm&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
42 B
1 KB
684ms
215ms
Image
image/gif
69.173.151.100
RUBICONPROJECT
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjLpre8AjAB&v=APEucNU33tvchzlj0din_ukxzFtkAWRUoNCkmwdy6kMNqLvrJL72TlrcuFsDg66iZLLqtqAHlFZahLF7zKB0_MneBc5Il9PK3LLTEtUgcoyfQ1n6SWSniPY
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
ffef7c53154b04a892ce1f9531c32cb1
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

cache-control
no-cache, must-revalidate
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
337
date
Mon, 11 Aug 2025 22:12:40 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame 0FAB
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=&gdpr=0
170 B
191 B
156ms
151ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=&gdpr=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COwCEMTyCBjLpre8AjAB&v=APEucNU33tvchzlj0din_ukxzFtkAWRUoNCkmwdy6kMNqLvrJL72TlrcuFsDg66iZLLqtqAHlFZahLF7zKB0_MneBc5Il9PK3LLTEtUgcoyfQ1n6SWSniPY
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://googleads.g.doubleclick.net/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:41 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=&gdpr=0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
c1df09169f58a071f2a391dff1b3307b
Pragma
no-cache
content-length
0
GET
H2
200
v1
match.sharethrough.com/sync/ Frame EEF7
68 B
323 B
623ms
254ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&gdpr=0&gdpr_consent=&source_user_id=1468877905454617683
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame EEF7
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=equativ&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D162%26partneruserid%3D%5BRX_UUID%5D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=162&partneruserid=OPTOUT
43 B
317 B
232ms
226ms
Image
image/gif
23.105.12.173
LEASEWEB-USA-WDC
General
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=162&partneruserid=OPTOUT
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
content-type
image/gif

Redirect headers

expires
0
cache-control
no-store, no-cache, must-revalidate
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=162&partneruserid=OPTOUT
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
content-type
text/html
etag
OPTOUT
GET
H2
200
v1
match.sharethrough.com/sync/ Frame EEF7
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3212965387357049904&gdpr=0&gdpr_consent=
68 B
323 B
182ms
181ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3212965387357049904&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

cache-control
no-cache,no-store
location
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=3212965387357049904&gdpr=0&gdpr_consent=
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame EEF7
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
43 B
348 B
192ms
186ms
Image
image/gif
23.105.12.173
LEASEWEB-USA-WDC
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
content-type
image/gif

Redirect headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
location
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
content-length
0
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame EEF7
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzIxMjk2NTM4NzM1NzA0OTkwNA==&gdpr=0&gdpr_consent=
170 B
191 B
180ms
179ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzIxMjk2NTM4NzM1NzA0OTkwNA==&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:41 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

cache-control
no-cache,no-store
location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MzIxMjk2NTM4NzM1NzA0OTkwNA==&gdpr=0&gdpr_consent=
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:40 GMT
pragma
no-cache
GET
H/1.1
200
OK
14333 Show response
check.analytics.rlcdn.com/check/
25 B
636 B
644ms
254ms
Fetch
application/json
18.160.10.109
AMAZON-02
General
Full URL
https://check.analytics.rlcdn.com/check/14333
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.160.10.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-160-10-109.iad12.r.cloudfront.net
Software
/
Resource Hash
8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-amz-apigw-id
PIJ0WFFTDoEEQWQ=
Age
57636
Connection
keep-alive
X-Amzn-Trace-Id
Root=1-689989b5-64e486c56a7e74e175a9ec5f
x-amzn-RequestId
352947e4-c713-4768-a6a2-67ffaa91e422
Via
1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront), 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
Access-Control-Allow-Origin
*
X-Cache
Hit from cloudfront
Content-Length
25
X-Amz-Cf-Id
pEb1TT-eJ5ZZ5w8q_lCFkCkrQqprAVReyYgZw4ItjwWXYBAUtD_HiA==
Date
Mon, 11 Aug 2025 06:12:05 GMT
Content-Type
application/json
X-Amz-Cf-Pop
IAD89-P1, IAD12-P3
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
436 B
175ms
172ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=groundControlPresent&arid=9a293466-ebde-4922-b20e-d3b95b4f447d&pkey=8C6umsP4Dr3ovU4hRbXWA8RZ&supplyId=TAEWcTBw&ckey=17CzF5ktQoN1vCLa3wP58vYU-663606091&umtime=1754950360025&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=5f894e28-87cb-45b5-8401-41571a0a8902&awid=4e7da93f-d1e9-49fc-8c69-38eb7eba98c8&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0&pwidth=300&pxoff=0&pyoff=0&twidth=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1167
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
avHhniAuULrgs1o2e1aAydQP-oKEGnq4CCntKbanHm4A93CFIMpHHQ==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
436 B
214ms
212ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=impression&arid=9a293466-ebde-4922-b20e-d3b95b4f447d&pkey=8C6umsP4Dr3ovU4hRbXWA8RZ&supplyId=TAEWcTBw&ckey=17CzF5ktQoN1vCLa3wP58vYU-663606091&umtime=1754950360357&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=5f894e28-87cb-45b5-8401-41571a0a8902&evid=&browser=Chrome&platform=desktop&url=https%3A%2F%2Fd2emu.com&referrer=https%3A%2F%2Fd2emu.com%2F&pwidth=300&pxoff=0&pyoff=0&twidth=300&trueTemplateEnabled=false&awid=4e7da93f-d1e9-49fc-8c69-38eb7eba98c8&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0&measureMode=standard
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1167
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
0hf15cxVLvviGQag89LxK2bsYQSXyaoh-MX33avGI-gKa_NLuPgaOQ==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 1789
68 B
323 B
397ms
217ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&gdpr=0&gdpr_consent=&source_user_id=2645470314859517024
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 1789
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
43 B
348 B
185ms
184ms
Image
image/gif
23.105.12.173
LEASEWEB-USA-WDC
General
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
content-type
image/gif

Redirect headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
location
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=ae8c427e-58eb-4a23-b875-39b0891b4fff&gdpr=0
content-length
0
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 1789
Redirect Chain
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7bcba429-649b-4b69-8a63-804b304b8743&gdpr_consent=null&gdpr=0
43 B
405 B
166ms
144ms
Image
image/gif
23.105.12.173
LEASEWEB-USA-WDC
General
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7bcba429-649b-4b69-8a63-804b304b8743&gdpr_consent=null&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
content-type
image/gif

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=7bcba429-649b-4b69-8a63-804b304b8743&gdpr_consent=null&gdpr=0
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
server
_
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 1789
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=B1s4UYBYqrm1&ev=1&pid=560288&gdpr_consent=&gdpr=0
43 B
364 B
300ms
300ms
Image
image/gif
23.105.12.173
LEASEWEB-USA-WDC
General
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=B1s4UYBYqrm1&ev=1&pid=560288&gdpr_consent=&gdpr=0
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
content-type
image/gif

Redirect headers

cache-control
private, max-age=0, no-cache, no-store
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=B1s4UYBYqrm1&ev=1&pid=560288&gdpr_consent=&gdpr=0
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server
bh-deployment-688d45dd4f-84kzl
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-CA
server
Jetty(12.0.22)
GET
H2
200
/
rtb-csync.smartadserver.com/redir/ Frame 1789
Redirect Chain
  • https://dsp.360yield.com/dsp_match/275?ssp=45&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D85%26partneruserid%3D$%7BDSP_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://dsp.360yield.com/ul_cb/dsp_match/275?ssp=45&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D85%26partneruserid%3D$%7BDSP_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=85&partneruserid=ad12ddb7-6beb-4883-b852-29574b3c9423&gdpr=0&gdpr_consent=
43 B
404 B
151ms
132ms
Image
image/gif
23.105.12.173
LEASEWEB-USA-WDC
General
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=85&partneruserid=ad12ddb7-6beb-4883-b852-29574b3c9423&gdpr=0&gdpr_consent=
Requested by
Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=47&gdpr=0&gdpr_consent=
Protocol
H2
Server
23.105.12.173 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ssbsync.smartadserver.com/

Response headers

cache-control
no-cache,no-store
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Mon, 11 Aug 2025 22:12:41 GMT
pragma
no-cache
content-type
image/gif

Redirect headers

access-control-allow-origin
*
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=85&partneruserid=ad12ddb7-6beb-4883-b852-29574b3c9423&gdpr=0&gdpr_consent=
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date
Mon, 11 Aug 2025 22:12:41 GMT
content-type
text/plain
GET
H2
200
json Show response
gum.criteo.com/sid/ Frame 97D5
438 B
905 B
155ms
155ms
Fetch
application/json
74.119.117.17
AS-CRITEO
General
Full URL
https://gum.criteo.com/sid/json?origin=publishertagids&domain=d2emu.com&sn=ChromeSyncframe&so=3&topUrl=d2emu.com&bundle=YIMu9V8weVAlMkZ0a28yOXFSejNkOTRDRWVLYU8yYUVuamxGQzdMWFNRN0VsMmRWd1lvV2JwcEclMkZXV1RKbmd1Ulh0RW5yVWF1YkptdjkxaEhrNm5Qdjd6RWNGN0o2S2dlJTJGWVNidk43NmJOc3hHaWhnSmdPY3RkNlFCSWNlWXplMzhCNlU1UQ&topicsavail=1&fledgeavail=1
Requested by
Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=d2emu.com&gpp=&gpp_sid=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
4d5b66020e8c4191255cc108cfee570e37f2044168648754c38ad23438ce4465
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=d2emu.com&gpp=&gpp_sid=

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
server-processing-duration-in-ticks
951583
expires
0
date
Mon, 11 Aug 2025 22:12:40 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel
GET
H2
200
skeleton.js Show response
fw.adsafeprotected.com/rjss/st/2572523/88821676/ Frame 2E6F
63 KB
15 KB
670ms
298ms
Script
application/javascript
23.23.116.71
AMAZON-AES
General
Full URL
https://fw.adsafeprotected.com/rjss/st/2572523/88821676/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022230610&ias_pubId=83fd1714&ias_chanId=101&ias_placementId=22855463669&bidurl=https://d2emu.com/&ias_dealId=mBGaf&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0ijnOYgIbmVkHASs11T9I8a
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.23.116.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-23-116-71.compute-1.amazonaws.com
Software
/
Resource Hash
f4229155ce98b2c4386128d42ce2b3ff3315264c78de788b2a5083947683e7b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
expires
Wed, 31 Dec 1969 23:59:59 GMT
access-control-allow-origin
fw.adsafeprotected.com
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
application/javascript;charset=utf-8
vary
accept-encoding
GET
H2
200
express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame 2E6F
117 KB
41 KB
565ms
208ms
Script
text/javascript
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
age
34973
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 12 Aug 2025 12:29:49 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 12:29:49 GMT
last-modified
Tue, 29 Oct 2024 21:00:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=86400
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
41319
x-xss-protection
0
server
sffe
GET
H3
200
omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/elements/html/ Frame 2E6F
12 KB
4 KB
140ms
140ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BbSRjgiZOk0fIyrV6m0Cq-zM5v3Ar-MlRerdRcFr3lcXDkx-HAPmLMSate4CBgfImMZFWPnq7lBTKYWUMSKIX6UOBTfYSKLSnwShgw3mDT0OR1HE-xRq6jFb-3qgNkKPjN-86B3e-ac-gT8bBjM8uCAajZ0Wcj8Vb09JtAgonpyt19c3R5x11JXL4XOCyWwaMVFAbHmRXXPgbVK7YIF4dKz3Mp8yQdICFDN8-qlBBNR6L3zBdEuhYb0RNikKYZGM5Sm8J3O962Rl2a4ayXR5tQ1wrPtkM1HbebzhdIxXCmD9rZE0Y&dbm_d=AKAmf-DTn00rtWls5CMWfq3gYcUHTAYPIiO0X-nJG1MXne_yfw5q_V3E1H0U-Por37DkjQ89FywK8jKQznKBUegSNAcM0RD7H4V8kpskeMgRvlIcg-sscSIYMgsi2VV-0uKXuVLlydesPtlBVQtBD1b-WPrIyHf3-JLKAdZ0i-dC_rSd9c27ZEMvpIxTKRoj_koF4B2dmLzS5xpFDs9-t15-UCyB3iVxPkKq9gMLvOw3ennN0tdU7LJsQtyk_GUuwUSh6WzVU-C1fuswqUEdLd0mqngqAanGZhkWvRxI1AumCoiajqDyLVJJ0Qpi8B3leV70wgc5of3yFoGaUjylM9OxquPruK0Eyi6Ai1br9dteQYf3vUTKTeKsE-1FIkFajoVvFPWpwVWtnK-W1G2nUey7nLblsyBwv8HkIYDHFDItHZH15WAyGAQDWwr_AwOc0iwrJ0tQy2vbU40EehezAWwa9qtSKDxNkosjAnWejLF2UNSXucpEnsvlgZQ2etNU-nwwd6run8UO6l1n76ihn8l3fYgfYPeMmRvRjQr4FBO54D2aSk2T9h9BhkBBo2FIj45o6CxcZnLffEYT433zNfJKM3yda45RQw6fSBohB1Bmam1ESrKaP8YuPfwl1l_VUCDRkRuh017tROYWr76AE8uAnCoLiNfsi2duhqw-_C4Uf_qJQh1zhiorw4-CnqnaEfUkeyQ_mmZVhy6oW5xDcx5gf6g2k5BSeN9UaO31loDeHkwJPTTO06UJi7_ibrxQQxaaGr4TJHZzJIxtH7FoTzhR3bAonZNF79hT7uafhUXUhRd_-HiB5mAxZC-WP2FQpygKGEO_31qYKZ4Hm3fJmgn53dZgiu-5dktVegQCNawHpzjv4aSwrnc29tVkVfzR5xGYkmeQ1DYXIJ1G5RQfLTTMnv2Y4nqc3R2OWJW2wevyzp6izUM_0x_0oSw5gJSXEMOwRXB6cHQ7nhIsiNfir10jNlB9Y56CTSPyp6bsMy4wTbNSLtR1_KUfeo3-onysHy4s4lP_KnonZCOBrNpqPreiE4aSjZwq95yH_ArkV2uBFTQQ0T8_gZ_-fb__2S8w7zzHHXw_9c3-7j6X8qzxYixKkAJma3lMZrVTgNkpKYsxPeR2dbZQGYsiJ9dNKpTUrlZgMZO5zytVPepVYXU7JktDK5ivtueJvNc992Bm3PnJYsK-vt_T75qa1u0XZnvjCXFR2Awve7VAgRBxYcfZhLMp5w-X-4crxSPQ3YlKsJb-ozbxUIWaSlpxRUrDs-ujlW0JwqYBmqVPpP0T5h2fw4uqkmtPr4eMEatX2XuidyM9URDRSCuf6UuVdwvvCDFrX9VacnC4WovS2gf8CrXyqKsQej07PdP29yGMei5YC9WaES4S1VXR0PEeybLBuXbGYnWZUz8Cu3up-bYNq5tD0DhUjCdkijj722DRxS2sRI-QRAjfsx2WOYO-MTunk0HFZe2uPmA9Z4j7KAQAzAvdGctyxuEo5WoxAww-Rnmll1QCSrW3kt30WIGu4ezAaR4RG3b-z7Clk6JkrLpvTtwlYQaMcJhVsJ1CGc_hyOiC525seC9MKUfP8oFtYvztStZURrBRJVa3LRPjUoXpvdUkjypRdgrFuJSsG4SbvG1Fi1egBs--i9TCAW95niO6AYOxDM-BTu3mNEqPEGImSbB94jGT_k5-7cowiIX8tVTEXqAtGNZWb08H-88EQYBhvZPj26jvv5OvasNafHRiPf3RYbgHb7adiA6tgmWy-IIzmS92eGLzdZcqQ_LzXqXeLL1dF2uLlsIUgUuWp60sGmKPTXJ0uVA8wGXn6Xcjkk2G1OokR0fb1nO250wccj0dMiIi0J7Xury_ntyy8Tmrh8z4smzRCP98FHLF-Wmb-8QjDMRyuw8cxLPw0KFt7f4QADfZL5lfC8prBlUKrmYIDwqymjP_T1dDq94T0LCcl5LYFuzGjyWLYvfgvWFGNNPugal9mBSFRZ2RO5dmAAiSXdmnBZ03H7O-1M2ZrI1M52wFy6Xmw11L_GC1quLrXtyLQszVT_BJYV34w09XAjyKJ1-ZyrivavB2oh-mJnaFf5Tr8DKSB4jaK_KBwSQENcvaYyU2mbjnxZzf5aEW0saSTvl2ZVx1wrayvsEN5oTxVQKlrxy8ZNrTpS1vxjqxOQ_kxLRAcrDK9s9o8xHwbmCsJfxl9IfgHD3QZ6diNrhkq7yAHRjdhMZ83C_4Tt78PJqO03pIe7m23M6BljtF4XWDJXQ18vRiQm01u6X4JSMT9VFx7Pn-0dIhlH9Lb1LCY6qX_lHErImc343FGYTwXA1e9kkbjxrbOJqLIciv6PY_6j2Km9XlDrLia-M6-LbBwTJQJsD7CTy6ZR3t1Yzpwd3o4xUpH4FF0qFnDzfRkviUgPVirO8K5Rahwywm16wt7eVlVOuxJNQ_mW--25OCP56nV8yEZlj3pPafoYkOECopufulRZPcYOInnAN6klUovjY5rAn2Xry5ekIueU139Wl_byQN0U-KBhOb4wIWQkkvSCnKp8UUeAZFto2s2VGVreGLWszON9-8rQgT1C2tIrVebOcQXwpXa8q5bjLEnNVhXr6LOMN_Z8BhwjLJMO7JDV9Gzw8rMsfQb0AWWBQ2OzGZcsjd_vsOvoebSrLmoOO-2XeOOGt5rYOG8L3XYXvrrW6zHWfmSFP7IScHkIRucd_Mf2N_uPfkx1i1vKcrKG-nE3e3tX0K9OX9IEDR9G-XdWk4ZEnxG12C_cfxb8tmcNIPf7nRkxUKx8iacS_F1-96gbzfvsPzcL4owdIWpwstXjVww59jLFY7fEaRNKqp1UYvfl6BfyM0MWg5gqFm7En3NmPqOVKTVB4mL3RNX15_WQ0BW-vUit0m1kienuWDGUoBnqWZH5hSWIkpO0iLDQoB6xZ9NBaHyXXJad7HwpH4L0hU2FXJ7o8RwERmIaL6DsgfJ3tmoTL5q6Y8V8R4XHbE8wzuMTnambzV7WAVGbpiW51vxKDxGVXFEOkAuDxxROkzZKoSwEOYI6oedjsV0ztV-r7B4N6GdoYqXM23NLhuKSZehvkl3n2cNQopbcf7SvROKz15DhX2_Gqr7b0u-pF9lQJUqbfbI1YA-qhUdoXplHjkBbIPYX5huwFQWfWXj5rZRJRIo5zFWDtNYmtdDe2YmGJvnQgW8V8JXU0cY9yO6kSplV6nE-cDKWo19rPCHorogdM_TfcYBLcyDvljgNYKOc4BqLx5if7g26apfZbi9XEuYOuEcqg5gvcpAaZojCNwiKvi8pcpgQP9W7PIEEbcwrgs0CUqFH9nvvlKcJHwuoNcSUSe_mOTYhP8YcR55TYdageKidAEgqk-3lv6OtwBvRFRi_eGgbFfe2RB24rj1fbKmgBCfd91biIaGsUAZRfQWbbVSqV-w1QBI8HtaaccPyXVMdyromHVtZyWGiTJWOmnP4rmkiK7W1R1PpfgnD4GPkQVIAwBUs0im3CrRd6m9kQzVxIGGvAZxL57hRJWPv8L3Z8XT5NNMgyQdXAT7Wk9ZroOJe87zLLU_FrNQPIsUcg6K6u0ZC-OaPk0MsZUQ-3CpZug7L1Jceryp6Jtt4HlXOLzhhS61NCjx60JINQd_OqIV1F_tiGyfFcpZgACxpfULDpplIGYf221jrao1nfZSHSXWrJ6PlSHpdJY4cxaJU5LZHtzsjmS7r_Fkn5XP2Bxp7mOLSnOAfgQdGAzH9ILn8I6_KxfRbJZkPMOdv1Yy2EyqAVJl87jU7G6QVr13emA7-qFOiI9xWVPkiOR65gUDuPElL3cK2WpYkBzBgSyZkDwxX1zn9AGnER8y-NJtMNvLQrHa9dh5JL3Ww5WltVP-_B87yQH__fLtFAqtDKCfT7qI40WXy_CvFxt2LYVfBIZBRF47_Cjq4gtSCVVv9NuHeNo_153eAZK8uuMd2pMxoQQYIcs1zTl_UGI41c2Ow6TEFSN4xuLkovVJ3pIbG-6q_5QGB88N9wvfPsLprfypvExXhyMSbBEYOoBehchVeWb-IfLRtuUzipUoJbiiMndkSarFjPqQ7MGmVzhVN_425yxy8owDkX7AkyKExzBpDBe2x5DzmGeNscu9Ko3pexkY3a7SI-B41iNkdAui2JR2AH4gCMwHgZYrSufAlY&pr=101%3A0.33&cid=CAQS2AEA2abssyYLb_xMhByE26aiLUkKABXdcgpAOmrG_cyeYP1NDNJytQu_zFczGXnqnOkjUo3EziDgtE202M3QZdaJzEYbDxwE7YTr1kEfFazIu_Ux_mFbs46IktREyUXb7krPgXsYsbpNe3uKZ7ibhFbdLqC_cnJZry1IXIM1qZ6IJ22hLqvKjaja-CsFhbSxYOA0JpOji5RtmwhU3hmQEwR2-_wsAYl-DI09gkjYqPcjYSinskiVzZLRjK4DAqJNbaNexPcLSzvdBiMFYU28wXF0ZOtsjuaODTUYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202507280101&nel=1&rfl=https%3A%2F%2Fd2emu.com%2F&ds=l&xdt=0&ct=76&iif=1&cor=8484344304476709000&adk=1009124102&idt=173&cac=0&dtd=47
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
d35d817e45bb28c1b3cd9a1b957db65906db684a8fb3ef5530a50a4f5383ec1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
8717597507341199514
age
6941
x-content-type-options
nosniff
expires
Mon, 25 Aug 2025 20:16:59 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 20:16:59 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
4400
x-xss-protection
0
server
cafe
GET
H3
200
abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/ Frame 2E6F
29 KB
11 KB
142ms
141ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BbSRjgiZOk0fIyrV6m0Cq-zM5v3Ar-MlRerdRcFr3lcXDkx-HAPmLMSate4CBgfImMZFWPnq7lBTKYWUMSKIX6UOBTfYSKLSnwShgw3mDT0OR1HE-xRq6jFb-3qgNkKPjN-86B3e-ac-gT8bBjM8uCAajZ0Wcj8Vb09JtAgonpyt19c3R5x11JXL4XOCyWwaMVFAbHmRXXPgbVK7YIF4dKz3Mp8yQdICFDN8-qlBBNR6L3zBdEuhYb0RNikKYZGM5Sm8J3O962Rl2a4ayXR5tQ1wrPtkM1HbebzhdIxXCmD9rZE0Y&dbm_d=AKAmf-DTn00rtWls5CMWfq3gYcUHTAYPIiO0X-nJG1MXne_yfw5q_V3E1H0U-Por37DkjQ89FywK8jKQznKBUegSNAcM0RD7H4V8kpskeMgRvlIcg-sscSIYMgsi2VV-0uKXuVLlydesPtlBVQtBD1b-WPrIyHf3-JLKAdZ0i-dC_rSd9c27ZEMvpIxTKRoj_koF4B2dmLzS5xpFDs9-t15-UCyB3iVxPkKq9gMLvOw3ennN0tdU7LJsQtyk_GUuwUSh6WzVU-C1fuswqUEdLd0mqngqAanGZhkWvRxI1AumCoiajqDyLVJJ0Qpi8B3leV70wgc5of3yFoGaUjylM9OxquPruK0Eyi6Ai1br9dteQYf3vUTKTeKsE-1FIkFajoVvFPWpwVWtnK-W1G2nUey7nLblsyBwv8HkIYDHFDItHZH15WAyGAQDWwr_AwOc0iwrJ0tQy2vbU40EehezAWwa9qtSKDxNkosjAnWejLF2UNSXucpEnsvlgZQ2etNU-nwwd6run8UO6l1n76ihn8l3fYgfYPeMmRvRjQr4FBO54D2aSk2T9h9BhkBBo2FIj45o6CxcZnLffEYT433zNfJKM3yda45RQw6fSBohB1Bmam1ESrKaP8YuPfwl1l_VUCDRkRuh017tROYWr76AE8uAnCoLiNfsi2duhqw-_C4Uf_qJQh1zhiorw4-CnqnaEfUkeyQ_mmZVhy6oW5xDcx5gf6g2k5BSeN9UaO31loDeHkwJPTTO06UJi7_ibrxQQxaaGr4TJHZzJIxtH7FoTzhR3bAonZNF79hT7uafhUXUhRd_-HiB5mAxZC-WP2FQpygKGEO_31qYKZ4Hm3fJmgn53dZgiu-5dktVegQCNawHpzjv4aSwrnc29tVkVfzR5xGYkmeQ1DYXIJ1G5RQfLTTMnv2Y4nqc3R2OWJW2wevyzp6izUM_0x_0oSw5gJSXEMOwRXB6cHQ7nhIsiNfir10jNlB9Y56CTSPyp6bsMy4wTbNSLtR1_KUfeo3-onysHy4s4lP_KnonZCOBrNpqPreiE4aSjZwq95yH_ArkV2uBFTQQ0T8_gZ_-fb__2S8w7zzHHXw_9c3-7j6X8qzxYixKkAJma3lMZrVTgNkpKYsxPeR2dbZQGYsiJ9dNKpTUrlZgMZO5zytVPepVYXU7JktDK5ivtueJvNc992Bm3PnJYsK-vt_T75qa1u0XZnvjCXFR2Awve7VAgRBxYcfZhLMp5w-X-4crxSPQ3YlKsJb-ozbxUIWaSlpxRUrDs-ujlW0JwqYBmqVPpP0T5h2fw4uqkmtPr4eMEatX2XuidyM9URDRSCuf6UuVdwvvCDFrX9VacnC4WovS2gf8CrXyqKsQej07PdP29yGMei5YC9WaES4S1VXR0PEeybLBuXbGYnWZUz8Cu3up-bYNq5tD0DhUjCdkijj722DRxS2sRI-QRAjfsx2WOYO-MTunk0HFZe2uPmA9Z4j7KAQAzAvdGctyxuEo5WoxAww-Rnmll1QCSrW3kt30WIGu4ezAaR4RG3b-z7Clk6JkrLpvTtwlYQaMcJhVsJ1CGc_hyOiC525seC9MKUfP8oFtYvztStZURrBRJVa3LRPjUoXpvdUkjypRdgrFuJSsG4SbvG1Fi1egBs--i9TCAW95niO6AYOxDM-BTu3mNEqPEGImSbB94jGT_k5-7cowiIX8tVTEXqAtGNZWb08H-88EQYBhvZPj26jvv5OvasNafHRiPf3RYbgHb7adiA6tgmWy-IIzmS92eGLzdZcqQ_LzXqXeLL1dF2uLlsIUgUuWp60sGmKPTXJ0uVA8wGXn6Xcjkk2G1OokR0fb1nO250wccj0dMiIi0J7Xury_ntyy8Tmrh8z4smzRCP98FHLF-Wmb-8QjDMRyuw8cxLPw0KFt7f4QADfZL5lfC8prBlUKrmYIDwqymjP_T1dDq94T0LCcl5LYFuzGjyWLYvfgvWFGNNPugal9mBSFRZ2RO5dmAAiSXdmnBZ03H7O-1M2ZrI1M52wFy6Xmw11L_GC1quLrXtyLQszVT_BJYV34w09XAjyKJ1-ZyrivavB2oh-mJnaFf5Tr8DKSB4jaK_KBwSQENcvaYyU2mbjnxZzf5aEW0saSTvl2ZVx1wrayvsEN5oTxVQKlrxy8ZNrTpS1vxjqxOQ_kxLRAcrDK9s9o8xHwbmCsJfxl9IfgHD3QZ6diNrhkq7yAHRjdhMZ83C_4Tt78PJqO03pIe7m23M6BljtF4XWDJXQ18vRiQm01u6X4JSMT9VFx7Pn-0dIhlH9Lb1LCY6qX_lHErImc343FGYTwXA1e9kkbjxrbOJqLIciv6PY_6j2Km9XlDrLia-M6-LbBwTJQJsD7CTy6ZR3t1Yzpwd3o4xUpH4FF0qFnDzfRkviUgPVirO8K5Rahwywm16wt7eVlVOuxJNQ_mW--25OCP56nV8yEZlj3pPafoYkOECopufulRZPcYOInnAN6klUovjY5rAn2Xry5ekIueU139Wl_byQN0U-KBhOb4wIWQkkvSCnKp8UUeAZFto2s2VGVreGLWszON9-8rQgT1C2tIrVebOcQXwpXa8q5bjLEnNVhXr6LOMN_Z8BhwjLJMO7JDV9Gzw8rMsfQb0AWWBQ2OzGZcsjd_vsOvoebSrLmoOO-2XeOOGt5rYOG8L3XYXvrrW6zHWfmSFP7IScHkIRucd_Mf2N_uPfkx1i1vKcrKG-nE3e3tX0K9OX9IEDR9G-XdWk4ZEnxG12C_cfxb8tmcNIPf7nRkxUKx8iacS_F1-96gbzfvsPzcL4owdIWpwstXjVww59jLFY7fEaRNKqp1UYvfl6BfyM0MWg5gqFm7En3NmPqOVKTVB4mL3RNX15_WQ0BW-vUit0m1kienuWDGUoBnqWZH5hSWIkpO0iLDQoB6xZ9NBaHyXXJad7HwpH4L0hU2FXJ7o8RwERmIaL6DsgfJ3tmoTL5q6Y8V8R4XHbE8wzuMTnambzV7WAVGbpiW51vxKDxGVXFEOkAuDxxROkzZKoSwEOYI6oedjsV0ztV-r7B4N6GdoYqXM23NLhuKSZehvkl3n2cNQopbcf7SvROKz15DhX2_Gqr7b0u-pF9lQJUqbfbI1YA-qhUdoXplHjkBbIPYX5huwFQWfWXj5rZRJRIo5zFWDtNYmtdDe2YmGJvnQgW8V8JXU0cY9yO6kSplV6nE-cDKWo19rPCHorogdM_TfcYBLcyDvljgNYKOc4BqLx5if7g26apfZbi9XEuYOuEcqg5gvcpAaZojCNwiKvi8pcpgQP9W7PIEEbcwrgs0CUqFH9nvvlKcJHwuoNcSUSe_mOTYhP8YcR55TYdageKidAEgqk-3lv6OtwBvRFRi_eGgbFfe2RB24rj1fbKmgBCfd91biIaGsUAZRfQWbbVSqV-w1QBI8HtaaccPyXVMdyromHVtZyWGiTJWOmnP4rmkiK7W1R1PpfgnD4GPkQVIAwBUs0im3CrRd6m9kQzVxIGGvAZxL57hRJWPv8L3Z8XT5NNMgyQdXAT7Wk9ZroOJe87zLLU_FrNQPIsUcg6K6u0ZC-OaPk0MsZUQ-3CpZug7L1Jceryp6Jtt4HlXOLzhhS61NCjx60JINQd_OqIV1F_tiGyfFcpZgACxpfULDpplIGYf221jrao1nfZSHSXWrJ6PlSHpdJY4cxaJU5LZHtzsjmS7r_Fkn5XP2Bxp7mOLSnOAfgQdGAzH9ILn8I6_KxfRbJZkPMOdv1Yy2EyqAVJl87jU7G6QVr13emA7-qFOiI9xWVPkiOR65gUDuPElL3cK2WpYkBzBgSyZkDwxX1zn9AGnER8y-NJtMNvLQrHa9dh5JL3Ww5WltVP-_B87yQH__fLtFAqtDKCfT7qI40WXy_CvFxt2LYVfBIZBRF47_Cjq4gtSCVVv9NuHeNo_153eAZK8uuMd2pMxoQQYIcs1zTl_UGI41c2Ow6TEFSN4xuLkovVJ3pIbG-6q_5QGB88N9wvfPsLprfypvExXhyMSbBEYOoBehchVeWb-IfLRtuUzipUoJbiiMndkSarFjPqQ7MGmVzhVN_425yxy8owDkX7AkyKExzBpDBe2x5DzmGeNscu9Ko3pexkY3a7SI-B41iNkdAui2JR2AH4gCMwHgZYrSufAlY&pr=101%3A0.33&cid=CAQS2AEA2abssyYLb_xMhByE26aiLUkKABXdcgpAOmrG_cyeYP1NDNJytQu_zFczGXnqnOkjUo3EziDgtE202M3QZdaJzEYbDxwE7YTr1kEfFazIu_Ux_mFbs46IktREyUXb7krPgXsYsbpNe3uKZ7ibhFbdLqC_cnJZry1IXIM1qZ6IJ22hLqvKjaja-CsFhbSxYOA0JpOji5RtmwhU3hmQEwR2-_wsAYl-DI09gkjYqPcjYSinskiVzZLRjK4DAqJNbaNexPcLSzvdBiMFYU28wXF0ZOtsjuaODTUYAQ&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&dv3_ver=m202507280101&nel=1&rfl=https%3A%2F%2Fd2emu.com%2F&ds=l&xdt=0&ct=76&iif=1&cor=8484344304476709000&adk=1009124102&idt=173&cac=0&dtd=47
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
b143ba18781aa1f7e56a4bb160ecbc28669eb523bf3a54aa516c1a80b786c19e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
17507550973388929053
age
34252
x-content-type-options
nosniff
expires
Mon, 25 Aug 2025 12:41:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 12:41:48 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
10976
x-xss-protection
0
server
cafe
GET
H2
200
Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2E6F
41 KB
14 KB
567ms
207ms
Script
text/javascript
142.251.179.132
GOOGLE
General
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
age
841
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:48:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 21:58:41 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=3000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
13937
x-xss-protection
0
server
sffe
GET
H2
200
skeleton.js Show response
fw.adsafeprotected.com/rjss/st/2527642/88099442/ Frame F0B6
63 KB
15 KB
594ms
223ms
Script
application/javascript
23.23.116.71
AMAZON-AES
General
Full URL
https://fw.adsafeprotected.com/rjss/st/2527642/88099442/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022032771&ias_pubId=S2rESyUH&ias_chanId=101&ias_placementId=22699554197&bidurl=https://d2emu.com/&ias_dealId=mBGaf&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0iRePawfMAH8SjiNp46nuaJ
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.23.116.71 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-23-116-71.compute-1.amazonaws.com
Software
/
Resource Hash
6f7d73957bda1787f154240ae8d09b08b9e66f9594917d96163f17d6b2fbca7a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
expires
Wed, 31 Dec 1969 23:59:59 GMT
access-control-allow-origin
fw.adsafeprotected.com
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
application/javascript;charset=utf-8
vary
accept-encoding
GET
H2
200
express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame F0B6
117 KB
0
564ms
564ms
Script
text/javascript
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://d2emu.com
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
age
34973
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 12 Aug 2025 12:29:49 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 12:29:49 GMT
last-modified
Tue, 29 Oct 2024 21:00:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=86400
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
41319
x-xss-protection
0
server
sffe
GET
H3
200
omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/elements/html/ Frame F0B6
12 KB
0
105ms
105ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/elements/html/omrhp.js
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
d35d817e45bb28c1b3cd9a1b957db65906db684a8fb3ef5530a50a4f5383ec1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
8717597507341199514
age
6941
x-content-type-options
nosniff
expires
Mon, 25 Aug 2025 20:16:59 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 20:16:59 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
4400
x-xss-protection
0
server
cafe
GET
H3
200
abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/ Frame F0B6
29 KB
0
112ms
112ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20250805/r20110914/abg_lite.js
Requested by
Host: cadmus.script.ac
URL: https://cadmus.script.ac/d3rtd2fz2u3gv4/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
b143ba18781aa1f7e56a4bb160ecbc28669eb523bf3a54aa516c1a80b786c19e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
17507550973388929053
age
34252
x-content-type-options
nosniff
expires
Mon, 25 Aug 2025 12:41:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 12:41:48 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
10976
x-xss-protection
0
server
cafe
GET
H2
200
Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F0B6
41 KB
0
568ms
567ms
Script
text/javascript
142.251.179.132
GOOGLE
General
Full URL
https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
age
841
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:48:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 21:58:41 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=3000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
13937
x-xss-protection
0
server
sffe
GET
H2
200
butler
b.sharethrough.com/ Frame CC8F
95 B
438 B
153ms
153ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=visible&arid=9ce185cc-56b5-46ef-8993-e7b05177e48c&pkey=jTgUsUdJBG7teDwXK5GPmgLW&supplyId=WYu2BXv1&ckey=17CzF5ktQoN1vCLa3wP58vYU-671712343&umtime=1754950360951&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=0356b7ca-a913-4a86-9528-e4df967c8069&awid=dd78273b-711f-4ef2-b72c-e1a7d1420405&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1168
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
6_JQdb7A_krLp-pmVKuyU_PQy3MeyAjPd4CzOgDxRI5G9NRV8TFhjQ==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
usync.js Show response
eus.rubiconproject.com/ Frame DC62
44 KB
11 KB
172ms
168ms
Script
text/html
23.3.133.134
AKAMAI-AS
General
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=inmobi&endpoint=us-east
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.3.133.134 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-3-133-134.deploy.static.akamaitechnologies.com
Software
Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash
ebaeb01ed757310996d54e3e55d9c6ee7bdbe8bd0535d81acacd99d01299fa17

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/usync.html?p=inmobi&endpoint=us-east

Response headers

cache-control
max-age=62338
content-encoding
gzip
expires
Tue, 12 Aug 2025 15:31:39 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length
11461
date
Mon, 11 Aug 2025 22:12:41 GMT
last-modified
Mon, 11 Aug 2025 15:31:39 GMT
x-powered-by
PHP/8.3.13
server
Apache/2.4.62 (Debian)
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
GET
H2
200
usync.js Show response
eus.rubiconproject.com/ Frame 60FE
44 KB
0
173ms
173ms
Script
text/html
23.3.133.134
AKAMAI-AS
General
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.3.133.134 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-3-133-134.deploy.static.akamaitechnologies.com
Software
Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash
ebaeb01ed757310996d54e3e55d9c6ee7bdbe8bd0535d81acacd99d01299fa17

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=

Response headers

cache-control
max-age=62338
content-encoding
gzip
expires
Tue, 12 Aug 2025 15:31:39 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length
11461
date
Mon, 11 Aug 2025 22:12:41 GMT
last-modified
Mon, 11 Aug 2025 15:31:39 GMT
x-powered-by
PHP/8.3.13
server
Apache/2.4.62 (Debian)
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
GET
H2
200
usync.js Show response
eus.rubiconproject.com/ Frame 0F71
44 KB
0
170ms
170ms
Script
text/html
23.3.133.134
AKAMAI-AS
General
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.3.133.134 Sterling, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-3-133-134.deploy.static.akamaitechnologies.com
Software
Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash
ebaeb01ed757310996d54e3e55d9c6ee7bdbe8bd0535d81acacd99d01299fa17

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/usync.html?p=18694&gdpr=0&gdpr_consent=

Response headers

cache-control
max-age=62338
content-encoding
gzip
expires
Tue, 12 Aug 2025 15:31:39 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length
11461
date
Mon, 11 Aug 2025 22:12:41 GMT
last-modified
Mon, 11 Aug 2025 15:31:39 GMT
x-powered-by
PHP/8.3.13
server
Apache/2.4.62 (Debian)
content-type
text/html;charset=UTF-8
vary
Accept-Encoding
GET
H/1.1
200
OK
14333 Show response
check.analytics.rlcdn.com/check/
25 B
636 B
339ms
142ms
Fetch
application/json
18.160.10.109
AMAZON-02
General
Full URL
https://check.analytics.rlcdn.com/check/14333
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.160.10.109 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-160-10-109.iad12.r.cloudfront.net
Software
/
Resource Hash
8a9ba7bbc88ec23d81a2d63845638a3b6603de473261872f301803cef84ef335

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
content-type
text/plain
Referer
https://d2emu.com/

Response headers

x-amz-apigw-id
PIJ0WFFTDoEEQWQ=
Age
57636
Connection
keep-alive
X-Amzn-Trace-Id
Root=1-689989b5-64e486c56a7e74e175a9ec5f
x-amzn-RequestId
352947e4-c713-4768-a6a2-67ffaa91e422
Via
1.1 4a050b98a443ca2d3af477f9b4dc39ae.cloudfront.net (CloudFront), 1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
Access-Control-Allow-Origin
*
X-Cache
Hit from cloudfront
Content-Length
25
X-Amz-Cf-Id
xKvWueV1UKakNFdaHPaSycNVguZ41xkrWI7BIz1frUN1rE_23bljOg==
Date
Mon, 11 Aug 2025 06:12:05 GMT
Content-Type
application/json
X-Amz-Cf-Pop
IAD89-P1, IAD12-P3
GET
H2
200
PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 2162
0
69 B
480ms
207ms
Script
text/plain
207.65.37.181
AS-PUBMATIC
General
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=89056243&p=159035&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159035&gdpr=0&gdpr_consent=&userIdMacro=(PM_UID)&predirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-SEA-76%26dspUserId%3D(PM_UID)
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ads.pubmatic.com/

Response headers

date
Mon, 11 Aug 2025 22:12:41 GMT
strict-transport-security
max-age=16070400; includeSubDomains
content-length
0
GET
H/1.1
200
OK
khaos.json Show response
token.rubiconproject.com/ Frame DC62
7 B
1 KB
146ms
143ms
XHR
application/json
69.173.151.100
RUBICONPROJECT
General
Full URL
https://token.rubiconproject.com/khaos.json?gdpr_consent=1---
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Cache-Control
no-cache,no-store,must-revalidate
Pragma
no-cache
access-control-allow-credentials
true
Expires
0
access-control-allow-origin
https://eus.rubiconproject.com
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
e71ccbe96f42d70fa40603ada4c96b28
content-length
7
content-type
application/json; charset=UTF-8
GET
H/1.1
200
OK
khaos.json Show response
token.rubiconproject.com/ Frame 60FE
7 B
1 KB
291ms
143ms
XHR
application/json
69.173.151.100
RUBICONPROJECT
General
Full URL
https://token.rubiconproject.com/khaos.json?gdpr_consent=1---&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Cache-Control
no-cache,no-store,must-revalidate
Pragma
no-cache
access-control-allow-credentials
true
Expires
0
access-control-allow-origin
https://eus.rubiconproject.com
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
2fcb300b847bad3e7dd1184ec8a1c2f5
content-length
7
content-type
application/json; charset=UTF-8
GET
H/1.1
200
OK
khaos.json Show response
token.rubiconproject.com/ Frame 0F71
7 B
1 KB
442ms
150ms
XHR
application/json
69.173.151.100
RUBICONPROJECT
General
Full URL
https://token.rubiconproject.com/khaos.json?gdpr_consent=1---&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Cache-Control
no-cache,no-store,must-revalidate
Pragma
no-cache
access-control-allow-credentials
true
Expires
0
access-control-allow-origin
https://eus.rubiconproject.com
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
f69a50991384d09413b97a37bb74928b
content-length
7
content-type
application/json; charset=UTF-8
GET
H2
200
user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame BEAA
20 KB
7 KB
143ms
142ms
Document
text/html
23.221.241.44
AKAMAI-AS
General
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1---&predirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-221-241-44.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
max-age=55341
content-encoding
gzip
content-length
6694
content-type
text/html
date
Mon, 11 Aug 2025 22:12:41 GMT
expires
Tue, 12 Aug 2025 13:35:02 GMT
last-modified
Wed, 13 Nov 2024 05:14:24 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
437 B
155ms
153ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=visible&arid=9a293466-ebde-4922-b20e-d3b95b4f447d&pkey=8C6umsP4Dr3ovU4hRbXWA8RZ&supplyId=TAEWcTBw&ckey=17CzF5ktQoN1vCLa3wP58vYU-663606091&umtime=1754950361363&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=5f894e28-87cb-45b5-8401-41571a0a8902&awid=4e7da93f-d1e9-49fc-8c69-38eb7eba98c8&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1168
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
0C3xIVvyhZLheOh4cWfuiJqMB48y4agUYhV0h-PruIWTE8v7IlpB6w==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H2
200
setuid
sync.inmobi.com/ Frame DC62
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=inmobi&gdpr_consent=1---&khaos=ME7O4SXT-16-H440
  • https://sync.inmobi.com/setuid?bidderID=52&dspUserId=ME7O4SXT-16-H440&gdpr_consent=1---
0
17 B
195ms
191ms
Image
text/plain
35.212.59.62
GOOGLE
General
Full URL
https://sync.inmobi.com/setuid?bidderID=52&dspUserId=ME7O4SXT-16-H440&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
35.212.59.62 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
62.59.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

via
1.1 google
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://sync.inmobi.com/setuid?bidderID=52&dspUserId=ME7O4SXT-16-H440&gdpr_consent=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
5b6c391ede0c9b3c7eab11a335db29fb
content-length
0
Content-Type
text/html
GET
H2
200
butler
b.sharethrough.com/ Frame CC8F
95 B
437 B
163ms
162ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=pixelVisibleInApp&arid=9ce185cc-56b5-46ef-8993-e7b05177e48c&pkey=jTgUsUdJBG7teDwXK5GPmgLW&supplyId=WYu2BXv1&ckey=17CzF5ktQoN1vCLa3wP58vYU-671712343&umtime=1754950360951&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=0356b7ca-a913-4a86-9528-e4df967c8069&awid=dd78273b-711f-4ef2-b72c-e1a7d1420405&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1168
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
mURGWDlzNs-tAbW8l5hCg1jyj-p5uu3BSlNb88bdErXd30gEOmhMuw==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
GET
H/1.1
200
dcm
s.amazon-adsystem.com/ Frame DC62
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr_consent=1---
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr_consent=1---&dcc=t
43 B
566 B
174ms
167ms
Image
image/gif
98.82.158.241
AMAZON-AES
General
Full URL
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr_consent=1---&dcc=t
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-98-82-158-241.compute-1.amazonaws.com
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
766HSX8NKW1ATH51KW6S
Content-Length
43
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:41 GMT
Content-Type
image/gif
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server

Redirect headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr_consent=1---&dcc=t
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
HMGNH09DP0VZY5SQJYZB
Content-Length
0
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:41 GMT
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame DC62
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr_consent=1---
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTJkYmU1NWQ2ZjFhZjVkNTg4NGMxODA1M2E4ODNhYWNjNDc0NGVmNQ&gdpr_consent=1---
170 B
191 B
160ms
153ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTJkYmU1NWQ2ZjFhZjVkNTg4NGMxODA1M2E4ODNhYWNjNDc0NGVmNQ&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:41 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NTJkYmU1NWQ2ZjFhZjVkNTg4NGMxODA1M2E4ODNhYWNjNDc0NGVmNQ&gdpr_consent=1---
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
e1bddfc34a927e97bda010c0d8a62b62
Pragma
no-cache
content-length
0
GET
H/1.1
200
dcm
aax-eu.amazon-adsystem.com/s/ Frame DC62
Redirect Chain
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr_consent=1---
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr_consent=1---&dcc=t
43 B
566 B
219ms
218ms
Image
image/gif
67.220.228.203
AMAZON-02
General
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr_consent=1---&dcc=t
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
67.220.228.203 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
JKF092JNZGC5Q5GEEJ74
Content-Length
43
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:42 GMT
Content-Type
image/gif
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server

Redirect headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr_consent=1---&dcc=t
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
VVNRS59VPXXBTQDG3MMV
Content-Length
0
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date
Mon, 11 Aug 2025 22:12:42 GMT
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server
GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame DC62
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr_consent=1---
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&expires=30
42 B
1 KB
554ms
254ms
Image
image/gif
69.173.151.100
RUBICONPROJECT
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
b08c627b67f10e75995ce6908d3f9f7b
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&expires=30
content-length
289
date
Mon, 11 Aug 2025 22:12:41 GMT
server
Kestrel
GET
H/1.1
200
ecm3
s.amazon-adsystem.com/ Frame DC62
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr_consent=1---
  • https://s.amazon-adsystem.com/ecm3?id=ME7O4T9T-1O-JASD&ex=d-rubiconproject.com&status=ok&gdpr_consent=1---
43 B
477 B
163ms
152ms
Image
image/gif
98.82.158.241
AMAZON-AES
General
Full URL
https://s.amazon-adsystem.com/ecm3?id=ME7O4T9T-1O-JASD&ex=d-rubiconproject.com&status=ok&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-98-82-158-241.compute-1.amazonaws.com
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma
no-cache
Connection
keep-alive
Expires
Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid
DB57WNEETYZR8F763AAN
Content-Length
43
Date
Mon, 11 Aug 2025 22:12:41 GMT
Content-Type
image/gif
Vary
Content-Type,Accept-Encoding,User-Agent
Server
Server

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://s.amazon-adsystem.com/ecm3?id=ME7O4T9T-1O-JASD&ex=d-rubiconproject.com&status=ok&gdpr_consent=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
d67ad46d58ddbab9fb03c088eabaaff8
content-length
0
Content-Type
text/html
GET
H2
200
setuid
px.ads.linkedin.com/ Frame DC62
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584&gdpr_consent=1---
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=ME7O4T9T-1O-JASD&gdpr_consent=1---
0
754 B
436ms
192ms
Image
text/plain
150.171.22.12
MICROSOFT-CORP-MS...
General
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=ME7O4T9T-1O-JASD&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref
Ref A: 17F426296CF14D16BF2927204A94EBA1 Ref B: PDX31EDGE0119 Ref C: 2025-08-11T22:12:42Z
x-li-fabric
prod-ltx1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid
AAY8HjjwtaqoHeDHYQIXMg==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
x-cache
CONFIG_NOCACHE
content-length
0
date
Mon, 11 Aug 2025 22:12:41 GMT

Redirect headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=ME7O4T9T-1O-JASD&gdpr_consent=1---
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
0b388c490ecfef74be7d13328a4f3ac3
Pragma
no-cache
content-length
0
GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame DC62
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&gdpr_consent=1---
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr_consent=1---&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
42 B
1 KB
552ms
259ms
Image
image/gif
69.173.151.100
RUBICONPROJECT
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr_consent=1---&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
af308bb17a856a105b8c87aaae7d7f8c
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

cache-control
no-cache, must-revalidate
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr_consent=1---&put=CAESEFhMyxhGqblUfEGf0ybzzBk&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
348
date
Mon, 11 Aug 2025 22:12:41 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame DC62
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr_consent=1---
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/9jCc04tyo1t-2Hu-tO__7cn5EUdSAgOZEtemQ7w0kco?csrc=&gdpr_consent=1---
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-xm3e0n1E2oL3X.6_nphDQqoMrKfbEBtWgUi8Tw--~A&gdpr=0&gdpr_consent=1---
42 B
1 KB
145ms
144ms
Image
image/gif
69.173.151.100
RUBICONPROJECT
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-xm3e0n1E2oL3X.6_nphDQqoMrKfbEBtWgUi8Tw--~A&gdpr=0&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
0190a17a18f2299b1b85aeb1793e601c
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

strict-transport-security
max-age=31536000
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-xm3e0n1E2oL3X.6_nphDQqoMrKfbEBtWgUi8Tw--~A&gdpr=0&gdpr_consent=1---
age
0
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
server
ATS
x-frame-options
DENY
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame DC62
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470&gdpr_consent=1---
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUU3TzRUOVQtMU8tSkFTRA==&gdpr_consent=1---
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr_consent=1---&google_gid=CAESEOWGtAcfbY1AYqbIpo4EgnQ&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUU3TzRTWFQtMTYtSDQ0MA==&google_push=&gdpr_consent=1---
170 B
191 B
152ms
152ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUU3TzRTWFQtMTYtSDQ0MA==&google_push=&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:42 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUU3TzRTWFQtMTYtSDQ0MA==&google_push=&gdpr_consent=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
ffef7c53154b04a892ce1f9531c32cb1
content-length
0
Content-Type
text/html
GET
H/1.1
200
OK
rp
match.prod.bidr.io/cookie-sync/ Frame DC62
43 B
433 B
670ms
151ms
Image
image/gif
34.198.47.23
AMAZON-AES
General
Full URL
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.198.47.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-198-47-23.compute-1.amazonaws.com
Software
gunicorn /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
cache-control
no-cache, must-revalidate
pragma
no-cache
Connection
keep-alive
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length
43
Date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/gif
Server
gunicorn
GET
H2
200
merge
ce.lijit.com/ Frame DC62
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr_consent=1---
  • https://ce.lijit.com/merge?pid=80&3pid=ME7O4T9T-1O-JASD&gdpr_consent=1---
43 B
500 B
633ms
256ms
Image
image/gif
3.94.137.152
AMAZON-AES
General
Full URL
https://ce.lijit.com/merge?pid=80&3pid=ME7O4T9T-1O-JASD&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
3.94.137.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-137-152.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

cache-control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma
no-cache
expires
Fri, 20 Mar 2009 00:00:00 GMT
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/gif
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://ce.lijit.com/merge?pid=80&3pid=ME7O4T9T-1O-JASD&gdpr_consent=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
382e2818ca015d35b02cd449aa60881d
content-length
0
Content-Type
text/html
GET
H2
204
magnite
sync.a-mo.net/setuid/ Frame DC62
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&gdpr_consent=1---
  • https://sync.a-mo.net/setuid/magnite?uid=ME7O4T9T-1O-JASD&gdpr_consent=1---
0
720 B
697ms
322ms
Image
text/plain
125.253.89.173
SS-ASH
General
Full URL
https://sync.a-mo.net/setuid/magnite?uid=ME7O4T9T-1O-JASD&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
125.253.89.173 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

cache-control
max-age=0, private, must-revalidate
date
Mon, 11 Aug 2025 22:12:42 GMT
x-envoy-upstream-service-time
2
vary
accept-encoding, Accept-Encoding
server
envoy

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://sync.a-mo.net/setuid/magnite?uid=ME7O4T9T-1O-JASD&gdpr_consent=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
0b388c490ecfef74be7d13328a4f3ac3
content-length
0
Content-Type
text/html
GET
H2
200
ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/ Frame DC62
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=primis&gdpr_consent=1---
  • https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=ME7O4T9T-1O-JASD&gdpr_consent=1---
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=ME7O4T9T-1O-JASD
  • https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=ME7O4T9T-1O-JASD&ckls=true&ci=auws5KNEEy&nc=false&trid=1420422248
43 B
1 KB
268ms
259ms
Image
image/gif
52.85.132.68
AMAZON-02
General
Full URL
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=ME7O4T9T-1O-JASD&ckls=true&ci=auws5KNEEy&nc=false&trid=1420422248
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
52.85.132.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-132-68.iad50.r.cloudfront.net
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront)
expires
Thu, 01 Jan 1970 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-length
43
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/gif
x-amz-cf-pop
IAD50-C2
x-amz-cf-id
Tm3GjNFY8McUrDMvexVNVlvxSqBiLSUhIbdszXVn-gumOwUbdLVs7w==

Redirect headers

patent
https://www.almondnet.com/ip
cache-control
no-cache, no-store, must-revalidate
location
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=ME7O4T9T-1O-JASD&ckls=true&ci=auws5KNEEy&nc=false&trid=1420422248
pragma
no-cache
via
1.1 929cbb64d024a9973633b197e2a23482.cloudfront.net (CloudFront)
expires
Thu, 01 Jan 1970 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
43
p3p
CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/gif
x-amz-cf-pop
IAD50-C2
x-amz-cf-id
dGF4JjhWrTxCAumnxITElYmB4WlyV68lu-mvFsQRmpxPGqGLhwgyRg==
GET

setuid
pbs.yahoo.com/ Frame DC62
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange&gdpr_consent=1---
  • https://pbs.yahoo.com/setuid?bidder=rubicon&uid=ME7O4SXT-16-H440&gdpr_consent=1---
0
0


GET
H2
200
v1
match.sharethrough.com/sync/ Frame DC62
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr_consent=1---
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr_consent=1---
68 B
323 B
146ms
145ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr_consent=1---
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
19ea072139d67f7022c6e463249c998e
content-length
0
Content-Type
text/html
GET
H/1.1
200
OK
tap.php
pixel.rubiconproject.com/ Frame DC62
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&gdpr_consent=1---
  • https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=76dce58b-a78d-4622-a204-0c7f55995773&expires=30&gdpr_consent=1---
42 B
1 KB
145ms
144ms
Image
image/gif
69.173.151.100
RUBICONPROJECT
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=76dce58b-a78d-4622-a204-0c7f55995773&expires=30&gdpr_consent=1---
Requested by
Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fpbs.nitropay.com%2Fsetuid%3Fbidder%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=1---&gdpr_pd=&source=2&google_push=&retry=true
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
d67ad46d58ddbab9fb03c088eabaaff8
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

X-CI-RTID
3c995ec3-2cf8-43d2-8701-e882f0647f7f
Location
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=76dce58b-a78d-4622-a204-0c7f55995773&expires=30&gdpr_consent=1---
Content-Length
166
Date
Mon, 11 Aug 2025 22:12:42 GMT
Content-Type
text/html; charset=utf-8
Connection
keep-alive
GET
H2
200
v1
match.sharethrough.com/sync/ Frame 60FE
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=18694&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=1---&khaos=ME7O4SXT-16-H440
  • https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr=0
68 B
323 B
147ms
146ms
Image
image/png
54.172.66.51
AMAZON-AES
General
Full URL
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
54.172.66.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-66-51.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
Security Headers
Name Value
Strict-Transport-Security max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eus.rubiconproject.com/

Response headers

strict-transport-security
max-age=16000000; includeSubDomains; preload;
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Location
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=ME7O4SXT-16-H440&gdpr=0
Pragma
no-cache
Expires
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
0b388c490ecfef74be7d13328a4f3ac3
content-length
0
Content-Type
text/html
GET
H2
200
butler
b.sharethrough.com/ Frame BF97
95 B
437 B
146ms
140ms
Image
image/png
18.67.76.121
AMAZON-02
General
Full URL
https://b.sharethrough.com/butler?type=pixelVisibleInApp&arid=9a293466-ebde-4922-b20e-d3b95b4f447d&pkey=8C6umsP4Dr3ovU4hRbXWA8RZ&supplyId=TAEWcTBw&ckey=17CzF5ktQoN1vCLa3wP58vYU-663606091&umtime=1754950361364&renderEnv=friendly-iframe&version=gc-stx-default-0.3.76&gcid=5f894e28-87cb-45b5-8401-41571a0a8902&awid=4e7da93f-d1e9-49fc-8c69-38eb7eba98c8&action=banner&sourceId=17CzF5ktQoN1vCLa3wP58vYU&deal_id=mBGaf&shouldEnhance=0
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.67.76.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-67-76-121.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"71a50dbba44c78128b221b7df7bb51f1"
age
1168
via
1.1 adb1632aa800f446f3f4e7b45c9dfd3e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
95
x-amz-cf-id
80_whQFhvGlas_WLedVgewoGW9X71zLe8UMwXswbTvXRcDmS-3KXQQ==
date
Mon, 11 Aug 2025 21:53:14 GMT
content-type
image/png
last-modified
Fri, 12 May 2023 13:28:48 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-P2
x-amz-server-side-encryption
AES256
POST
H/1.1
200
OK
aggregate Show response
bis4.vidazoo.com/ Frame BF97
0
258 B
570ms
205ms
XHR
text/plain
138.197.252.137
DIGITALOCEAN-ASN
General
Full URL
https://bis4.vidazoo.com/aggregate
Requested by
Host: static.vidazoo.com
URL: https://static.vidazoo.com/basev/wgt/odin/1.0.18/widget.serverless.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
138.197.252.137 Secaucus, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://d2emu.com/

Response headers

access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
text/plain
access-control-allow-headers
*
GET
H2
200
62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame CBAC
38 KB
13 KB
557ms
205ms
Document
text/html
142.251.179.132
GOOGLE
General
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:04:34 GMT
expires
Mon, 11 Aug 2025 22:54:34 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F2BB
38 KB
0
550ms
550ms
Document
text/html
142.251.179.132
GOOGLE
General
Full URL
https://tpc.googlesyndication.com/sodar/62bHydCX.html
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f132.1e100.net
Software
sffe /
Resource Hash
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
489
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000
content-encoding
br
content-length
13045
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:04:34 GMT
expires
Mon, 11 Aug 2025 22:54:34 GMT
last-modified
Fri, 25 Aug 2023 23:48:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2E6F
222 KB
68 KB
140ms
139ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
236c34aed623ea7a65d75d7e3e0bac4bfcd6dc070ea1abbdb3db3ea5be4a1061
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
5776204965252557975
age
3302
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:17:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 21:17:40 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
69782
x-xss-protection
0
server
cafe
GET
H2
200
LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html Show response
s0.2mdn.net/sadbundle/7021369239909610418/ Frame 4E95
8 KB
3 KB
488ms
209ms
Document
text/html
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
e7ac8bf39bddbb37ec0424e440caacb9442ece91c64d7e2f67f2c6a944cded07
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
allow-fenced-frame-automatic-beacons
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
2886
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:43 GMT
expires
Tue, 11 Aug 2026 22:12:43 GMT
last-modified
Tue, 29 Jul 2025 17:57:11 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
GET
H3
200
view
ad.doubleclick.net/pcs/ Frame 2E6F
0
0
163ms
163ms
Fetch
image/png
142.251.111.148
GOOGLE
General
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjssISgvsNor4S2Fntv1WezYbcHvK_yJ6hkJWw0Z2JzCyAiLMPiMm-5NK9gJ7iXce4EkFxBbPx9M1fvRp2-0eg5h4GqQbeme_pWZ6MlpOoSTIbENd4wu2tJFVRDPFBuEiZ3wc2Gn4_LGRVAU-qCZAvw23NWfA1Xl3UmVYOPhkDK99YaWTK-J2V-P_bfaM2GliHjGG2AdXVk77gFnxznqU8lnKfXumUMFyhhU8TtLAeCh33r3p2E1807KuZNFLQP2FrNVNg3S1naO-FNP_SIv3LTDDyGfBoH5qdaLgDeLKWy14EljEqC4h4hAAVwudy0BI_8NmJWMRAk5rIun7J8yvUd1hfAaPnzvpvwzLNPfO5WjxoiXalJfnc3w0uzVsrf9E1_NscU0SfnxLUAUYj-RsIfHB5SfgbUZr9appTMcBCoeacbSo2wJJayPj4p-MJPvI6R5aQgRkxtvdRghoFbw6Dgc7xLtQ8zEvqbtl1xhPIzWTrCEHXLXELUycQ2UTtA55tAGJlPgE1twKnMBMQed51dH0O2zfXaPVKZJ-qayUnYXG145_wT4ljWiXNP50hiq6cm-dL1j1RR254T6iII84OcbBVbioUI8S9fgI_tF-oCaokDa5FBBHpdcgrn7cTaapqj5wBdz75rtAAc0GfKyycC5rOLDyUmS5RtsoCAlhkE1sjmEKc50L7ccgkudgT-xHssLu_teeGUGeypGT8CMTJHp6W1RklID7SHmq_7WvwXXbdOrwcp0IVEerY7oTTwKUj-Au86rGc9wHkUhLQvbG647CH7VawypoT337Y0hvPsu-eoGgi_Rdqtq-TgqGn1oDm8fqcuHjFT_kB08m9VwmrsuwwKlwIXBxMoXhQfqe1neftIZ6QaMy1xC4kfVEaxBeeQ2Cmck8GqBeHa3e4QIpnWp0Ixg7ZZSh92mnnIQ3_TkSmhRPTlHwuFYmPQy41hzQpl6UXewuPQXWSguKpreWWsoxs-fNds3aBEpgGnb9mShxbydVCzgfMP6o-uJLceP-m58WDhZ0wF3pyk4Zs1wRMYzK6SEMzM_CvUnZIjuXNrJbHL2UyiETnxGDk6rdmnrCAeVrzHAcTokk-U1jeDP61P7S-EhFVOGn9uMqCaUBFF3raxOnLNvp6Pd_KLeHpHOjsL9J-q-EWdtukgAhcuOWY13fy7DIB6DprquUnFn5xXba5YO_Z3NohVZ1PRafs8zZoQ3Q4MwihXiYWYJDSu21cYeiKXBMTvYwMKmanaUrMVUY53FXKJCV9y4JsUTvyLhmxsPipH8Nwff63_aIHEIp5OLMBNX9f6sBbKuY5zA19zMTB5QGgZHsrBo6_e6wZhNkysZtmlbP_YEnvIr1klwVyhLPqjtVaGwBwnxsj03ijrULvGlb6IAKuuF3Rfx-YvZwBGDiXJNOJOh_Fg-nTyPsLyL_E4xYvGYfvpdqZJT-jqYEc6NDE1NaNE4Uj_NjfSIdE98zeDtrcAaInRDUXg4s-jk7gGXSmG-XYM46oI08tp_YO7EBlIrvjUe1jqXQxKJ0gX8DCLsTCYAv79fWqhMH1VR6HLU&sai=AMfl-YSXmaES06h4qM_X5unihS-qlAXGZkgyDev3Ln_YQ62b5bHZz4T1tZqZjv7li-3q2FYb-Q_7a4TtArbQ0MgYXIEsmJi306_9Yiu-uwjZI8sj98j6U4BiXahacl8HKlFYRXBFr1vGN_kf9l2ttwzf-ahECwuKgrgTKLm720q6jNn77POlmS16sGs9nA2rT30fRTUkyiwrr6rPYJ3ifX95qvoXHCqc5WWRLXDx31tlTO_IZ0Wg1519aJBXzy3951w-dUXDCKCWBB_JXNxad1SCStCuQG8cTDYpGSszpwVqVdFbKt2F49e7898FACVtUcWjZH3E-2Q77GlODBULuCNwmaEgB7DEm2Io8bPS8AzvDpB1UWK_fL_3BKEVCfeMTHaTVZHY6Rz-cQR5xnFMeANTgV6Z5M6GaCgLzo6Z86h8A38IJc6kD2qO09xQywaMYKY-sBmmYyIV1iIGlgTrVOaehS366_JUpv4_2sb8six206s2gpwLGyG-g4Ue9unCe0UsuI046JAZ_sKsIlQgGlpyA9MJzLwPjQAfSewJ9x05bOP0zw3kBbDEwh65ts_qDfd1bYzOWDYINIWbORISQdwcS8y0R44I2iC4AE-83Z2juBUNY3fFej9XLTNuTJ9X32Wfwr-eQIPs7H166rmDkb7R7P3bTc3Lc6QPB8tF1hnY5AHgGyderFlMS8Cefft6UAnRBtjSLio4eYa_pNJqkMkLx7RckkhImknTF2Q_4qv4OH1bj9ezesJczdJmNeArQQw-Fr4zl5G95FZBbXYAmvYPwe7uJyxkwlXfLA&sig=Cg0ArKJSzLUvdYBL45sREAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9yYmNyb3lhbGJhbmsuY29tLGh0dHBzOi8vcmJjLmNvbQ&pr=101:0.33&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1892&cbvp=1&cstd=1889&cisv=r20250805.41929&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.111.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bk-in-f148.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/png
content-security-policy
script-src 'none'; object-src 'none'
cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
x-xss-protection
0
attribution-reporting-register-source
{"aggregation_keys":{"39641748":"0xcee7a90a7b7882670000000000000000","39641749":"0x78f5ce81248ac7da0000000000000000","39641750":"0xbdca999e3fca4b040000000000000000"},"debug_key":"13134729409743509977","debug_reporting":true,"destination":["https://rbcgam.com","https://rbcroyalbank.com","https://houseful.ca"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"691200","filter_data":{"14":["145532126","145531493"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["3755243"]},"max_event_level_reports":2,"priority":"0","source_event_id":"5517928671410245613"}
server
cafe
GET
H2
200
main.19.8.605.js Show response
static.adsafeprotected.com/ Frame F0B6
264 KB
80 KB
597ms
233ms
Script
application/javascript
3.171.85.59
AMAZON-02
General
Full URL
https://static.adsafeprotected.com/main.19.8.605.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.85.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-85-59.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6dcc938319b723d0d5c25216428462994400e34f8c1466bdb36e6a9de78cdf79

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-amz-version-id
5Kbm9svbbbhmSDjM.sHIlgcSiXVfz7Ck
etag
W/"126ce5e89c733af2a9e37aec9a7a1a09"
age
2248961
x-cache
Hit from cloudfront
x-amz-cf-id
70ZFfuCnm1e5lg4HsV4SdnEAPy8FeNRwri4NWOEPAzBknsbEhnlJnA==
date
Wed, 16 Jul 2025 21:30:03 GMT
content-type
application/javascript
vary
Accept-Encoding
last-modified
Wed, 16 Jul 2025 20:47:58 GMT
x-amz-replication-status
COMPLETED
cache-control
public, max-age=315360000, immutable
via
1.1 415ae3c766005c5c7c6a16e45f13745c.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame F0B6
222 KB
0
117ms
117ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
236c34aed623ea7a65d75d7e3e0bac4bfcd6dc070ea1abbdb3db3ea5be4a1061
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
br
etag
5776204965252557975
age
3302
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:17:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Mon, 11 Aug 2025 21:17:40 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
69782
x-xss-protection
0
server
cafe
GET
H2
200
index.html Show response
s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/ Frame 57F4
10 KB
4 KB
460ms
207ms
Document
text/html
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
c899788451576cbb352feb73808830fdb5bbc16d73c76ccaa9227e5faac60c53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
allow-fenced-frame-automatic-beacons
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
3099
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:43 GMT
expires
Tue, 11 Aug 2026 22:12:43 GMT
last-modified
Tue, 17 Jun 2025 20:52:36 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
GET
H3
200
view
ad.doubleclick.net/pcs/ Frame F0B6
0
0
165ms
165ms
Fetch
image/png
142.251.111.148
GOOGLE
General
Full URL
https://ad.doubleclick.net/pcs/view?xai=AKAOjsvValYsgyvlLU1B45aJFYXVitfNLSE1larNflgn9Ism7FODmf5jT3ab8lt-dmnyRqSRwdeSREWKu5YmtrZB6SawnQKcjJbGQAc2Z8hEA9LDmz9ZNy0XWYJREgCTNl3jvScqjYk5OH60cWGKxTuiNhuzX0LTGqqT-WVxzFgiKo9AcZQdTmNUZeYuMLQmRHXqLY1bWBEKHuE05Ftqw9mFxUjeflrfHKvsd_44BqndXcFSQWI0S_Q7TzfoFf2aGRAhuqvHFpJAcpP_sUE5_Rw5tHHPCLXMrwAXRl1B7ldJtV8sPUPGHbRKbX6PXbjwKTldvQMBy-e_4wDzlL2tG1Zc2hGwD9CCGWF4KRjzPYbmyghC0JZBULuAYnz6iXIkhVHp8CCHTjkFX24HagwdCP8muPyy8Y-SnWvPPyaEzzATpZ_js8pVRnVwbzgAbvJKO4yQ0a5bLYH4L5RvF0UBnpu3AJ97tNOr0dLLc6n7Xjvd6pJhEZdBOjDzRwx2EphXfMi5q63pp0WkETKcO0WCfN-3svUxk2z1F7dhfdU-lBlkUdFkvSmZhwNeL16LQVsBtHg1Q5B0JdjMgvJQmGNBUpUX_PR-0HJGCafNVBNmWZZrzMdqNURUsppJw4eBzwlbPCMc8ftgWq4rGYnaK5ZmCZkPmll-G_pkgcAaYrGrg36CQ-LGsHabUMjo7hVZxqA4wqq2jb9bZTK6zBjk2uA-3APwFuoNPzZF8GGq3OYmcqig_aVYny2VXEjeXsiM_npKwldXcDrIn5iaDXAl16-3ERed0q2qY_mZiajBgXLopephKsL-Zhl6-EI_-MyMTpcJhaLPyS6Y72qMeJCi-PhoiB4sNyrifL6O84wd0Pp8q3fe5YLJb_opSn5PiIYmVRd9ALjjyS8T_mD6zV81uuB-26CDKsk7Mvq_3xnlRFL2e4ZyHtblZPvqLosSM6LfIlhMmks6GPQWKETu7BA3PGkh-szbR50kZk0WmUZMHnHElc3U-vPnLxLJ8H83utCJIG3p5J1xXeQxU2TcjW2fwdtjbq_cDYX0F4hnfLi-np1Txj6oyrvG94187xugmCfDqkAAJ2uJ-HKw8zISlvduLX0KzayCS16tTi05Kx_l6hv-lg6fn34pzlPFulbrLN0c7nPPEowNmsCDCdsXAdLhrpgY8T6kAidRrRco7jaEoyFnJaAo25lznuy-X8-9AWY2hQjBT-s9mnEWGfgcdyr5oviE1Z0sxZkst6q4u39kvxKutr25x4phgakMSASNNrui-4YRyaTXReFGTUNkeg3W0u-fI1MXjZRBWnYRoY52JWnF8DW9bfKIaKasmLOJqdKPsp9En6GgV255GqiNv7e-71lPJ2WSEj9CuixcIPlRIUwxKRyRAQsV_IrgcpczRRqKNlMsQFKluMyDjbL_tXC50xu1J9D0kTrp3HdZJFA6TAo4f52GK1WPcQUc94j-ek-tABk3Hth47SBYiLLvXcTL47Gfe6Uq2_1Lmw9WlHCZhP3Ehsosasvi2NlcazZSwHGmMkk-Tik9HKGfZtCEGPA_Gk22QyapGaQ1CbaO_1nR_28VOfoljRQdTTANLQ&sai=AMfl-YSv2GwWMZIGy6c12bIlMSTLY1qvn2jXHUioo5fHcdnwcUL2jR92uSwD3BIjUA5ZIFOjEZP1xeQqB-ETYBahWhcqE6XhGpkV18QttgKM81eLe9L8qekxmpqg0bSQGos_slB0ojyOk0aHYZ1qZ0ouCqH4LQehEcXHlSy5An5liGpaU3h1stGJojYYynzhC02asBox59GR7v8Do9K3ii3k2LZKGHqgay4Y2gqYHEovdrJdTMS4ugoM1sR6XSQq_6u6qiWN_axy2-y4SdHm51aFzRSt_uZR22ES5i7CB8kHtwk-M87EYwm9VLRits2qiCSM9pdFo7iB8SKHStEn7qjfI5ohzLvc3R-woTxQIZvuKEszTm34oyt4J7PoG8QK2MJ5cCU1Ie45Il4opdiqu3d6UDon6DSLjfZcdEyjRfu12tMN9Q0FaEr3l5lmeQ_aEv-nhSuIO0s755Xc8FuCzvM-LkawEycKdJbwzztdILus3CC8BCRE0BqGkwwR5GlQn7Il4CnVY_PLR1GVJNmdmQpm3R_ZQdGEGfW8OsJHgPOKepRzZK0Lf2Qvo1v4bcAlX0JSb__Agyq-_jPXXXWU7iBAr3dVy4icf2cmgIA_NeCaPmlpqBCmSPiX0BJWU7fLZ73D94pUhalRp48eR2eQzDrXn3HxZdJnTeBng5YaypRLBg1dkBL3Q0bV0AA9_UbVNwWKY1K97be8uXHueAy_9HxwvJObhWfphHy_cyiHtpwJWZsuyJeewYH4Ro4yKjotqXz34C8I8MIagQs_sPHVbWvdtWuUymmO9zg_uQ&sig=Cg0ArKJSzHB_rtWpWterEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9yYmNyb3lhbGJhbmsuY29t&pr=101:0.45&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1882&cbvp=1&cstd=1878&cisv=r20250805.14482&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.111.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bk-in-f148.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:42 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Mon, 11 Aug 2025 22:12:42 GMT
content-type
image/png
content-security-policy
script-src 'none'; object-src 'none'
cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
x-xss-protection
0
attribution-reporting-register-source
{"aggregation_keys":{"39641748":"0xcee7a90a7b7882670000000000000000","39641749":"0x78f5ce81248ac7da0000000000000000","39641750":"0x6b751327085533080000000000000000"},"debug_key":"13007580782828146772","debug_reporting":true,"destination":["https://rbcgam.com","https://rbcroyalbank.com","https://houseful.ca"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"691200","filter_data":{"14":["13072275","12689199","25234101","2828828"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["3755243"]},"max_event_level_reports":2,"priority":"0","source_event_id":"9969619962326369206"}
server
cafe
GET
H2
200
trustedIframe.html Show response
btloader.com/ Frame 9FA5
4 KB
2 KB
99ms
98ms
Document
text/html
104.20.20.189
CLOUDFLARENET
General
Full URL
https://btloader.com/trustedIframe.html?o=6278260873756672&tid=JjPTNd623-33xtL7NC9-989b314d02&upapi=true
Requested by
Host: btloader.com
URL: https://btloader.com/tag?o=6278260873756672&upapi=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.20.189 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f0859e704d6c17bc40690f45d57d47d7c53683ab2f597e2e37a8900ac247a052

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cf-ray
96db13780caaadb4-SEA
content-encoding
br
content-type
text/html
date
Mon, 11 Aug 2025 22:12:42 GMT
server
cloudflare
vary
Accept-Encoding
GET
H2
200
main.19.8.605.js Show response
static.adsafeprotected.com/ Frame 2E6F
264 KB
0
559ms
559ms
Script
application/javascript
3.171.85.59
AMAZON-02
General
Full URL
https://static.adsafeprotected.com/main.19.8.605.js
Requested by
Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/2572523/88821676/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022230610&ias_pubId=83fd1714&ias_chanId=101&ias_placementId=22855463669&bidurl=https://d2emu.com/&ias_dealId=mBGaf&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0ijnOYgIbmVkHASs11T9I8a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.85.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-85-59.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6dcc938319b723d0d5c25216428462994400e34f8c1466bdb36e6a9de78cdf79

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-amz-version-id
5Kbm9svbbbhmSDjM.sHIlgcSiXVfz7Ck
etag
W/"126ce5e89c733af2a9e37aec9a7a1a09"
age
2248961
x-cache
Hit from cloudfront
x-amz-cf-id
70ZFfuCnm1e5lg4HsV4SdnEAPy8FeNRwri4NWOEPAzBknsbEhnlJnA==
date
Wed, 16 Jul 2025 21:30:03 GMT
content-type
application/javascript
vary
Accept-Encoding
last-modified
Wed, 16 Jul 2025 20:47:58 GMT
x-amz-replication-status
COMPLETED
cache-control
public, max-age=315360000, immutable
via
1.1 415ae3c766005c5c7c6a16e45f13745c.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame F0B6
0
0
150ms
149ms
Fetch
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame F0B6
0
0
149ms
149ms
Fetch
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame F0B6
0
0
148ms
148ms
Fetch
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E6F
0
0
248ms
149ms
Fetch
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E6F
0
0
257ms
149ms
Fetch
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E6F
0
0
271ms
147ms
Fetch
image/gif
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
main.css
s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/ Frame 57F4
4 KB
1 KB
204ms
198ms
Stylesheet
text/css
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/main.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
63408a11d53c8bfbf2ff54546b4b20b65fe7e37922325ada51b238dd8743d374
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
text/css
vary
Accept-Encoding
last-modified
Tue, 17 Jun 2025 20:52:36 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
1274
x-xss-protection
0
server
sffe
GET
H2
200
jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame 57F4
87 KB
31 KB
570ms
204ms
Script
text/javascript
142.251.179.95
GOOGLE
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.179.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f95.1e100.net
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/

Response headers

content-encoding
gzip
age
63690
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 04:31:13 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 04:31:13 GMT
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
31017
x-xss-protection
0
server
sffe
GET
H2
200
css
fonts.googleapis.com/ Frame 57F4
5 KB
2 KB
593ms
240ms
Stylesheet
text/css
172.253.115.95
GOOGLE
General
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.95 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f95.1e100.net
Software
ESF /
Resource Hash
f045a83d1715d5a18466d035dd5c5304913d25f136ea36d30eea5ce7275b68c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Mon, 11 Aug 2025 21:57:08 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.9.4/ Frame 57F4
273 KB
58 KB
165ms
86ms
Script
application/javascript
104.17.25.14
CLOUDFLARENET
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.9.4/lottie.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
461dc565cc5bb7cce19c7ce7b71037a33e5d27f83ad37c8f3afccd53862662c5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://s0.2mdn.net
Referer

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"626f3c29-e3fc"
age
477556
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bl7LhY4%2B5EWVv8ZAKuBRKFofYTMZmRXtXAanYybqc3BUeQuFF%2F%2BpJpt5WBi%2B7yU46JzdAgUd6sWx8wcJr4Lvr4Mc%2BdbQ4kMB8gwsfMgn5oNbOlX90BFCyZ5flZFSsoqBy9%2Fww9UZ"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Sat, 01 Aug 2026 22:12:43 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 02 May 2022 02:04:25 GMT
vary
Accept-Encoding
priority
u=1,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
96db137b683bd7dd-SEA
accept-ranges
bytes
access-control-allow-origin
*
content-length
58364
server
cloudflare
GET
H2
200
script.js Show response
s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/ Frame 57F4
3 KB
946 B
200ms
198ms
Script
application/x-javascript
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/script.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
c5cd2ef1d10fc29fb8a975ddd7c657e56b5249421d031d405fbcb61bb272593c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
application/x-javascript
vary
Accept-Encoding
last-modified
Tue, 17 Jun 2025 20:52:36 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
861
x-xss-protection
0
server
sffe
GET
H2
200
replay.png
s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/ Frame 57F4
2 KB
2 KB
204ms
201ms
Image
image/png
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/replay.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
4026dc5f50c59025c81b40b20c5fe1918f1af41aec80895f446d6d5f343386d7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253

Response headers

report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/png
last-modified
Tue, 17 Jun 2025 20:52:36 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
2042
x-xss-protection
0
server
sffe
GET
H2
200
close.png
s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/ Frame 57F4
361 B
434 B
201ms
199ms
Image
image/png
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/close.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
c460b0a7fcdeeb66b88247d81f52fea1c7480a8ec574013857702e68f5773562
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253

Response headers

report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/png
last-modified
Tue, 17 Jun 2025 20:52:36 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
361
x-xss-protection
0
server
sffe
GET
H2
200
createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 4E95
186 KB
48 KB
209ms
208ms
Script
text/javascript
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/ads/studio/cached_libs/createjs_2015.11.26_54e1c3722102182bb133912ad4442e19_min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
575c82f23dbb9285df2f62c7c8121c65d89e8137713110a149067d695975215e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253

Response headers

content-encoding
gzip
age
0
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Mon, 11 Aug 2025 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:43 GMT
last-modified
Wed, 16 Mar 2016 13:51:35 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=0
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
49100
x-xss-protection
0
server
sffe
GET
H2
200
createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 4E95
236 KB
63 KB
601ms
227ms
Script
text/javascript
23.53.35.198
AKAMAI-ASN1 Akama...
General
Full URL
https://code.createjs.com/1.0.0/createjs.min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
23.53.35.198 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-53-35-198.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/

Response headers

x-n
S
cache-control
max-age=900
content-encoding
gzip
expires
Mon, 11 Aug 2025 22:27:43 GMT
accept-ranges
bytes
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
text/javascript
vary
Accept-Encoding
server
Apache
GET
H2
200
LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.js Show response
s0.2mdn.net/sadbundle/7021369239909610418/ Frame 4E95
36 KB
6 KB
199ms
198ms
Script
application/x-javascript
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
456665405c0a9720430ad178cfaba24ec7c7a396af75233d62fa205c2a98bd67
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/7021369239909610418/LOC_FY25%20RBC%20Healthcare%20Student%20Acquisition%20Campaign%20__160x600_EN.html?ev=01_253

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 22:12:43 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
application/x-javascript
vary
Accept-Encoding
last-modified
Tue, 29 Jul 2025 17:57:11 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
x-xss-protection
0
server
sffe
GET
H3
200
nbTj7yWD2DU-zw_D-YzrFV0BA8HMLKrJU8sjYwZCNB8.js Show response
pagead2.googlesyndication.com/bg/ Frame CBAC
53 KB
20 KB
418ms
139ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/bg/nbTj7yWD2DU-zw_D-YzrFV0BA8HMLKrJU8sjYwZCNB8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
sffe /
Resource Hash
9db4e3ef2583d8353ecf0fc3f98ceb155d0103c1cc2caac953cb23630642341f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://tpc.googlesyndication.com/

Response headers

content-encoding
br
age
249741
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options
nosniff
expires
Sun, 09 Aug 2026 00:50:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 09 Aug 2025 00:50:22 GMT
last-modified
Mon, 04 Aug 2025 09:58:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges
bytes
content-length
20697
x-xss-protection
0
server
sffe
GET
H3
200
nbTj7yWD2DU-zw_D-YzrFV0BA8HMLKrJU8sjYwZCNB8.js Show response
pagead2.googlesyndication.com/bg/ Frame F2BB
53 KB
0
413ms
413ms
Script
text/javascript
142.251.163.155
GOOGLE
General
Full URL
https://pagead2.googlesyndication.com/bg/nbTj7yWD2DU-zw_D-YzrFV0BA8HMLKrJU8sjYwZCNB8.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wv-in-f155.1e100.net
Software
sffe /
Resource Hash
9db4e3ef2583d8353ecf0fc3f98ceb155d0103c1cc2caac953cb23630642341f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://tpc.googlesyndication.com/

Response headers

content-encoding
br
age
249741
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options
nosniff
expires
Sun, 09 Aug 2026 00:50:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 09 Aug 2025 00:50:22 GMT
last-modified
Mon, 04 Aug 2025 09:58:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges
bytes
content-length
20697
x-xss-protection
0
server
sffe
GET
H2
200
pd Show response
ggsoftware-d.openx.net/w/1.0/ Frame 4E72
756 B
986 B
90ms
88ms
Document
text/html
34.98.64.218
GOOGLE-CLOUD-PLAT...
General
Full URL
https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
/
Resource Hash
fc17a47244ac71ff6356805c58360c676c01c598313fa5c7e12f3cb5b8ce332e

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0, no-cache
content-length
756
content-type
text/html
date
Mon, 11 Aug 2025 22:12:43 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
pragma
no-cache
vary
Accept, Accept-Encoding
via
1.1 google
x-forwarded-for
212.104.215.93
GET
H2
200
checksync.php Show response
hbx.media.net/ Frame F49C
39 KB
13 KB
554ms
257ms
Document
text/html
23.222.200.28
AKAMAI-AS
General
Full URL
https://hbx.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU87559X&prvid=2034%2C2155%2C2033%2C2076%2C2075%2C2030%2C590%2C2073%2C273%2C233%2C2028%2C2027%2C2104%2C2026%2C236%2C676%2C2025%2C237%2C117%2C636%2C55%2C99%2C2045%2C2120%2C3011%2C3010%2C2041%2C122%2C201%2C2039%2C4%2C521%2C126%2C203%2C523%2C326%2C404%2C9%2C407%2C2011%2C2055%2C2099%2C3020%2C294%2C251%2C2009%2C178%2C255%2C3018%2C653%2C2125%2C214%2C2124%2C413%2C3014%2C338%2C459%2C77%2C2144%2C2022%2C182%2C262%2C3073%2C461%2C222%2C542%2C301%2C345%2C225%2C10000%2C624%2C80%2C229&itype=PREBID&purpose1=1&gdprconsent=1&gdpr=0&coppa=0&usp_status=0&usp_consent=1&uspstring=1---
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.222.200.28 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-222-200-28.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
79ee0055c064c168b28515a3d69f4b43210b9a306991e27d57b8bec631efe389
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains max-age=604800

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=93600
cache-control
max-age=172800
content-encoding
gzip
content-length
12855
content-type
text/html; charset=UTF-8
date
Mon, 11 Aug 2025 22:12:43 GMT
expires
Wed, 13 Aug 2025 22:12:43 GMT
p3p
CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server
Apache
strict-transport-security
max-age=86400 ; includeSubDomains max-age=604800
timing-allow-origin
*
vary
Accept-Encoding
x-mnet-hl2
E
GET
H2
200
/ Show response
sync.cootlogix.com/api/sync/iframe/ Frame 260D
3 KB
4 KB
593ms
248ms
Document
text/html
147.182.212.117
DIGITALOCEAN-ASN
General
Full URL
https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1---&coppa=0
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
147.182.212.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
4bffe715aa1e21cda97bd324a2ca9fa1c632e03411dd4048ad280438a280a582

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods
GET, HEAD, OPTIONS, POST
access-control-allow-origin
*
content-length
2948
content-type
text/html
date
Mon, 11 Aug 2025 22:12:43 GMT
p3p
CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
GET
H2
200
syncframe Show response
gum.criteo.com/ Frame 7813
15 KB
6 KB
148ms
147ms
Document
text/html
74.119.117.17
AS-CRITEO
General
Full URL
https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=d2emu.com&us_privacy=1---&gpp=
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
0b96855e780057f73465081f56971f30c152233048e4af1bc2b1437b07d8b597
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 11 Aug 2025 22:12:43 GMT
server
Kestrel
server-processing-duration-in-ticks
1115814
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
x-robots-tag
noindex
GET
H2
200
sync Show response
eb2.3lift.com/ Frame DE30
1 KB
2 KB
611ms
218ms
Document
text/html
35.71.139.29
AMAZON-02
General
Full URL
https://eb2.3lift.com/sync?us_privacy=1---&
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bdbf941de659cf2a2405c64ed5348496f7c0cfb2c564af91b21cc9135c99d5d2

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
1119
content-type
text/html; charset=utf-8
date
Mon, 11 Aug 2025 22:12:43 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET
H/1.1
200
OK
async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B10A
52 KB
17 KB
224ms
72ms
Document
text/html
151.101.193.108
FASTLY
General
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: s.nitropay.com
URL: https://s.nitropay.com/ads-1773.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://d2emu.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
52674
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Mon, 11 Aug 2025 22:12:43 GMT
ETag
W/"623de86a-cf34"
Expires
Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
103943, 58736
X-Served-By
cache-lga21993-LGA, cache-yvr1527-YVR
X-Timer
S1754950364.633523,VS0,VE0
GET
H2
200
ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82
dpm.demdex.net/
Redirect Chain
  • https://match.adsrvr.org/track/usersync?us_privacy=1---&gdpr=0&gdpr_consent=undefined&ust=image
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82
42 B
715 B
150ms
149ms
Image
image/gif
35.173.123.99
AMAZON-AES
General
Full URL
https://dpm.demdex.net/ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
35.173.123.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-173-123-99.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-va6-1-v077-08fcc72bf.edge-va6.demdex.com 2 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
qo+zdpKfRRw=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif

Redirect headers

location
https://dpm.demdex.net/ibs:dpid=903&dpuuid=46f4af91-2ba3-4305-896c-c258960d2f82
content-length
189
date
Mon, 11 Aug 2025 22:12:44 GMT
server
Kestrel
GET
H2
200
skeleton.js Show response
static.adsafeprotected.com/ Frame 2E6F
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/st/2572523/88821676/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022230610&ias_pubId=83fd1714&ias_chanId=101&ias_placementId=22855463669&bidurl=https...
  • https://static.adsafeprotected.com/skeleton.js?ias_xappb=
17 B
476 B
144ms
143ms
Script
application/javascript
3.171.85.59
AMAZON-02
General
Full URL
https://static.adsafeprotected.com/skeleton.js?ias_xappb=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
3.171.85.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-85-59.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id
bDXACOfImjYVF6ZWuu7AoLLLip1bTZ_4
age
6072342
x-cache
Hit from cloudfront
x-amz-cf-id
FEzU7kA1gODbcyFzPn8SJfCAO159LYaRAyEpnY5YaPG_NyGrfcvn_Q==
date
Mon, 02 Jun 2025 15:27:02 GMT
content-type
application/javascript
last-modified
Wed, 28 May 2025 21:18:41 GMT
x-amz-replication-status
COMPLETED
cache-control
public,max-age=31536000,immutable
via
1.1 415ae3c766005c5c7c6a16e45f13745c.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
17
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256

Redirect headers

cache-control
no-cache
location
https://static.adsafeprotected.com/skeleton.js?ias_xappb=
p3p
CP="COM NAV INT STA NID OUR IND NOI"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
pragma
no-cache
GET
H2
200
sca.17.6.4.js Show response
static.adsafeprotected.com/ Frame 3F21
91 KB
23 KB
155ms
152ms
Script
application/javascript
3.171.85.59
AMAZON-02
General
Full URL
https://static.adsafeprotected.com/sca.17.6.4.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.85.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-85-59.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ac42cf20760d5b0f71be7a0391c76020002aa1dcfc75bae782360bf2761db29f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-amz-version-id
bOtNsqPibVajaDyuqqyqCrhSRcjcC6sa
etag
W/"8fa66f8b94450bd040e7b5a7550c52de"
age
6072342
x-cache
Hit from cloudfront
x-amz-cf-id
Gl02BUfpO8YVDp3eazMhjrqgN0Xr6eGlc-z5e8Gm6FLEiRav-wG0kA==
date
Mon, 02 Jun 2025 15:27:02 GMT
content-type
application/javascript
vary
Accept-Encoding
last-modified
Mon, 13 May 2024 16:44:02 GMT
x-amz-replication-status
COMPLETED
cache-control
max-age=315360000
via
1.1 415ae3c766005c5c7c6a16e45f13745c.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H3
200
sd
us-u.openx.net/w/1.0/ Frame 4E72
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=8192551922752742053&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B
87ms
87ms
Image
image/gif
35.244.159.8
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8192551922752742053&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: ggsoftware-d.openx.net
URL: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ggsoftware-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8192551922752742053&gdpr=0&gdpr_consent=&us_privacy=
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length
0
pragma
no-cache
date
Mon, 11 Aug 2025 22:12:43 GMT
GET
H3
200
sd
us-u.openx.net/w/1.0/ Frame 4E72
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=1820804327581032944
43 B
61 B
85ms
84ms
Image
image/gif
35.244.159.8
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=1820804327581032944
Requested by
Host: ggsoftware-d.openx.net
URL: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ggsoftware-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
no-store, no-cache, private
location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=1820804327581032944
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
8a65eb1b-909b-4dd2-9a4d-5c21f8853481
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H3
200
396846.gif
idsync.rlcdn.com/ Frame 4E72
Redirect Chain
  • https://id.rlcdn.com/464246.gif?partner_uid=6399a230-0c18-4bbb-916a-e8da6624bdb2
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=6399a230-0c18-4bbb-916a-e8da6624bdb2
42 B
60 B
136ms
135ms
Image
image/gif
35.244.154.8
GOOGLE-CLOUD-PLAT...
General
Full URL
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=6399a230-0c18-4bbb-916a-e8da6624bdb2
Requested by
Host: ggsoftware-d.openx.net
URL: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol
H3
Server
35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.154.244.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ggsoftware-d.openx.net/

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
42
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif

Redirect headers

cache-control
private, max-age=0, no-cache
location
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=6399a230-0c18-4bbb-916a-e8da6624bdb2
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/gif
vary
Accept, Accept-Encoding
GET
H3
200
receive
pixel.tapad.com/idsync/ex/ Frame 4E72
95 B
124 B
89ms
87ms
Image
image/png
34.111.113.62
GOOGLE-CLOUD-PLAT...
General
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=3021aeaa-9a58-405c-84f2-f0ff6c331d66
Requested by
Host: ggsoftware-d.openx.net
URL: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
Jetty(11.0.25) /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ggsoftware-d.openx.net/

Response headers

strict-transport-security
max-age=31536000
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
95
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/png
server
Jetty(11.0.25)
GET
H3
200
sd
us-u.openx.net/w/1.0/ Frame 4E72
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
  • https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=1321fdd7-9d3b-41e2-9613-725546e71dc6-689a6adc-4341&gdpr=0&gdpr_consent=
43 B
61 B
88ms
87ms
Image
image/gif
35.244.159.8
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072977&val=1321fdd7-9d3b-41e2-9613-725546e71dc6-689a6adc-4341&gdpr=0&gdpr_consent=
Requested by
Host: ggsoftware-d.openx.net
URL: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ggsoftware-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif
vary
Accept

Redirect headers

cache-control
max-age=0,no-cache,no-store
location
https://us-u.openx.net/w/1.0/sd?id=537072977&val=1321fdd7-9d3b-41e2-9613-725546e71dc6-689a6adc-4341&gdpr=0&gdpr_consent=
pragma
no-cache
via
1.1 google
expires
Tue, 11 Oct 1977 12:34:56 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length
0
date
Mon, 11 Aug 2025 22:12:44 GMT
server
A
GET
H3
200
sd
us-u.openx.net/w/1.0/ Frame 4E72
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
  • https://us-u.openx.net/w/1.0/sd?id=537073028&val=76dce58b-a78d-4622-a204-0c7f55995773
43 B
61 B
85ms
85ms
Image
image/gif
35.244.159.8
GOOGLE-CLOUD-PLAT...
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073028&val=76dce58b-a78d-4622-a204-0c7f55995773
Requested by
Host: ggsoftware-d.openx.net
URL: https://ggsoftware-d.openx.net/w/1.0/pd?us_privacy=1---
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://ggsoftware-d.openx.net/

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
212.104.215.93
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
image/gif
vary
Accept

Redirect headers

X-CI-RTID
ac3147cb-1787-43eb-b269-df4fa9c4b9c7
Location
https://us-u.openx.net/w/1.0/sd?id=537073028&val=76dce58b-a78d-4622-a204-0c7f55995773
Content-Length
112
Date
Mon, 11 Aug 2025 22:12:43 GMT
Content-Type
text/html; charset=utf-8
Connection
keep-alive
GET
H2
200
skeleton.js Show response
static.adsafeprotected.com/ Frame F0B6
Redirect Chain
  • https://fw.adsafeprotected.com/rfw/st/2527642/88099442/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1022032771&ias_pubId=S2rESyUH&ias_chanId=101&ias_placementId=22699554197&bidurl=https...
  • https://static.adsafeprotected.com/skeleton.js?ias_xappb=
17 B
0
77ms
77ms
Script
application/javascript
3.171.85.59
AMAZON-02
General
Full URL
https://static.adsafeprotected.com/skeleton.js?ias_xappb=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
3.171.85.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-85-59.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

etag
"53fab767ecbd3bf07990b10246befbd4"
x-amz-version-id
bDXACOfImjYVF6ZWuu7AoLLLip1bTZ_4
age
6072342
x-cache
Hit from cloudfront
x-amz-cf-id
FEzU7kA1gODbcyFzPn8SJfCAO159LYaRAyEpnY5YaPG_NyGrfcvn_Q==
date
Mon, 02 Jun 2025 15:27:02 GMT
content-type
application/javascript
last-modified
Wed, 28 May 2025 21:18:41 GMT
x-amz-replication-status
COMPLETED
cache-control
public,max-age=31536000,immutable
via
1.1 415ae3c766005c5c7c6a16e45f13745c.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
17
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256

Redirect headers

cache-control
no-cache
location
https://static.adsafeprotected.com/skeleton.js?ias_xappb=
p3p
CP="COM NAV INT STA NID OUR IND NOI"
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
pragma
no-cache
GET
H2
200
sca.17.6.4.js Show response
static.adsafeprotected.com/ Frame EE41
91 KB
0
84ms
84ms
Script
application/javascript
3.171.85.59
AMAZON-02
General
Full URL
https://static.adsafeprotected.com/sca.17.6.4.js
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.85.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-3-171-85-59.iad89.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ac42cf20760d5b0f71be7a0391c76020002aa1dcfc75bae782360bf2761db29f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

content-encoding
gzip
x-amz-version-id
bOtNsqPibVajaDyuqqyqCrhSRcjcC6sa
etag
W/"8fa66f8b94450bd040e7b5a7550c52de"
age
6072342
x-cache
Hit from cloudfront
x-amz-cf-id
Gl02BUfpO8YVDp3eazMhjrqgN0Xr6eGlc-z5e8Gm6FLEiRav-wG0kA==
date
Mon, 02 Jun 2025 15:27:02 GMT
content-type
application/javascript
vary
Accept-Encoding
last-modified
Mon, 13 May 2024 16:44:02 GMT
x-amz-replication-status
COMPLETED
cache-control
max-age=315360000
via
1.1 415ae3c766005c5c7c6a16e45f13745c.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-P3
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
200
dt
dt.adsafeprotected.com/
43 B
178 B
626ms
259ms
Image
image/gif
54.160.229.225
AMAZON-AES
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=2572523&asId=470afa9c-a30c-8f7e-4267-c76e8cc3068b&tv=%7Bc:kZxmk9,pingTime:-2,time:927,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:2994,beZ:2996,mfA:3745,cmA:3747,inA:3747,inZ:3765,prA:3765,prZ:3800,si:3809,poA:3810,poZ:3820,cmZ:3820,mfZ:3820,loA:3894,loZ:3897,ltA:3920,ltZ:3920,mdA:2998,mdZ:3715%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:160.600,dom:div%7D%7D,env:%7Bgca:false,cca:true,ccd:%7Bversion:1,uspString:1---%7D,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:814%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:927,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:814,wc:390.390.1600.1200,ac:440.450.160.600,am:sp,cc:390.390.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B159~0%5D,as:%5B159~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:uTBCSh4+11%7C12%7C13%7C14%7C15%7C16%7C171*.2572523-88821676%7C1711%7C1712%7C1713%7C172%7C173%7C181%7C182%7C19%7C1a1.2527642-88099442%7C1a11%7C1a12%7C1a13%7C1a2%7C1a3%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i%7C1j,idMap:171*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:815,slid:%5Bbanner-left%5D,msd:0,ph:1200,igt:0,sinceFw:109,readyFired:true%7D&br=c
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.160.229.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-160-229-225.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache
p3p
CP="COM NAV INT STA NID OUR IND NOI"
content-length
43
date
Mon, 11 Aug 2025 22:12:44 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
json Show response
gum.criteo.com/sid/ Frame 7813
2 KB
2 KB
141ms
140ms
Fetch
application/json
74.119.117.17
AS-CRITEO
General
Full URL
https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=d2emu.com&sn=ChromeSyncframe&so=0&topUrl=d2emu.com&bundle=YIMu9V8weVAlMkZ0a28yOXFSejNkOTRDRWVLYU8yYUVuamxGQzdMWFNRN0VsMmRWd1lvV2JwcEclMkZXV1RKbmd1Ulh0RW5yVWF1YkptdjkxaEhrNm5Qdjd6RWNGN0o2S2dlJTJGWVNidk43NmJOc3hHaWhnSmdPY3RkNlFCSWNlWXplMzhCNlU1UQ&topicsavail=1&fledgeavail=1
Requested by
Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=d2emu.com&us_privacy=1---&gpp=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
6429df1ed278ed73271e795638301fd7111b2483c043ee226f6f99e88972f87f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=d2emu.com&us_privacy=1---&gpp=

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
pragma
no-cache
server-processing-duration-in-ticks
1318904
expires
0
date
Mon, 11 Aug 2025 22:12:43 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
Kestrel
GET
H2
200
async_usersync Show response
ib.adnxs.com/ Frame B10A
0
793 B
222ms
221ms
Script
text/html
68.67.181.103
ASN-APPNEX
General
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://acdn.adnxs.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
212.104.215.93; 212.104.215.93; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
8509c350-065a-46f2-ac5a-ec27984df233
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:43 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
200
dt
dt.adsafeprotected.com/
43 B
177 B
612ms
259ms
Image
image/gif
54.160.229.225
AMAZON-AES
General
Full URL
https://dt.adsafeprotected.com/dt?advEntityId=2527642&asId=682ba251-840e-3309-aa59-e01b25fe7bdf&tv=%7Bc:kZxmkm,pingTime:-2,time:980,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:2776,beZ:2778,mfA:3689,cmA:3690,inA:3690,inZ:3692,prA:3692,prZ:3698,si:3702,poA:3703,poZ:3713,cmZ:3714,mfZ:3714,loA:3738,loZ:3740,ltA:3755,ltZ:3755,mdA:2780,mdZ:3536%7D%7D,sca:%7Bdfp:%7Bdf:3,sz:300.600,dom:div%7D%7D,env:%7Bgca:false,cca:true,ccd:%7Bversion:1,uspString:1---%7D,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:600,t:925%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:980,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:925,wc:390.390.1600.1200,ac:1690.450.300.600,am:sp,cc:390.390.300.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B65~0%5D,as:%5B65~300.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:rjss,dtt:0,fm:uTBCSh4+11%7C12%7C13%7C14%7C15%7C16%7C171.2572523-88821676%7C1711%7C1712%7C1713%7C1714%7C172%7C173%7C181%7C182%7C19%7C1a1*.2527642-88099442%7C1a11%7C1a12%7C1a13%7C1a2%7C1a3%7C1b%7C1c%7C1d%7C1e%7C1f%7C1g%7C1h%7C1i%7C1j,idMap:1a1*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:926,slid:%5Bbanner-right%5D,msd:0,ph:1200,igt:0,sinceFw:52,readyFired:true%7D&br=c
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.160.229.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-160-229-225.compute-1.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache
p3p
CP="COM NAV INT STA NID OUR IND NOI"
content-length
43
date
Mon, 11 Aug 2025 22:12:44 GMT
pragma
no-cache
content-type
image/gif
GET
H2
200
sync
odr.mookie1.com/t/v2/
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=criteo&custom_data=aMCLEV9FNmYyV0JCQlAlMkZYMkZKJTJCTEhvMERHbW1PWkNzQ0xNVkF5U0ltSHlkQkJLbyUzRA&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-x_l6fFWKtE...
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&ssp=criteo&gdpr=0&gdpr_consent=
43 B
632 B
428ms
259ms
Image
image/gif
35.190.90.30
GOOGLE-CLOUD-PLAT...
General
Full URL
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&ssp=criteo&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
35.190.90.30 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
30.90.190.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
Thu, 01 Jan 1970 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-application-context
application
p3p
CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
date
Mon, 11 Aug 2025 22:12:44 GMT
content-length
43
content-type
image/gif;charset=UTF-8
server
Apache

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&ssp=criteo&gdpr=0&gdpr_consent=
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:44 GMT
GET
H2
204
match
ssp-sync.criteo.com/user-sync/
Redirect Chain
  • https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dtPPlzV9iM1J0NFBmSzdyT3M4aVRldlFCdXZXRnA1aWJyaDFpTFh1NlhNeWdVcTcwJTNE%26u%3d%24UID&gdpr=0&gdpr_consent=
  • https://ssp-sync.criteo.com/user-sync/match?p=tPPlzV9iM1J0NFBmSzdyT3M4aVRldlFCdXZXRnA1aWJyaDFpTFh1NlhNeWdVcTcwJTNE&u=1820804327581032944&gdpr=0&gdpr_consent=
0
141 B
498ms
210ms
Image
text/plain
74.119.117.39
AS-CRITEO
General
Full URL
https://ssp-sync.criteo.com/user-sync/match?p=tPPlzV9iM1J0NFBmSzdyT3M4aVRldlFCdXZXRnA1aWJyaDFpTFh1NlhNeWdVcTcwJTNE&u=1820804327581032944&gdpr=0&gdpr_consent=
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-store,max-age=0
date
Mon, 11 Aug 2025 22:12:44 GMT
cross-origin-resource-policy
cross-origin
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
location
https://ssp-sync.criteo.com/user-sync/match?p=tPPlzV9iM1J0NFBmSzdyT3M4aVRldlFCdXZXRnA1aWJyaDFpTFh1NlhNeWdVcTcwJTNE&u=1820804327581032944&gdpr=0&gdpr_consent=
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
212.104.215.93; 212.104.215.93; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
d8d7083d-6ead-4c07-bcd3-c3f7166fabef
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Mon, 11 Aug 2025 22:12:44 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
GET
H2
204
match
ssp-sync.criteo.com/user-sync/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-x_l6fFWKtEehGji4tA-QmQvlOByDgR7aeeO7Vw&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
  • https://ssp-sync.criteo.com/user-sync/match?p=UXQfF18yNmFlaUZzVmdnY3ZRaUZ2QUxpNWRYRUhlSVlSMXJzNkZHS2FnSDR6MTBRJTNE&u=CAESEIXoMfZ7pua9anONyT2WX3E&gdpr=0&gdpr_consent=&google_cver=1
0
141 B
495ms
209ms
Image
text/plain
74.119.117.39
AS-CRITEO
General
Full URL
https://ssp-sync.criteo.com/user-sync/match?p=UXQfF18yNmFlaUZzVmdnY3ZRaUZ2QUxpNWRYRUhlSVlSMXJzNkZHS2FnSDR6MTBRJTNE&u=CAESEIXoMfZ7pua9anONyT2WX3E&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-store,max-age=0
date
Mon, 11 Aug 2025 22:12:44 GMT
cross-origin-resource-policy
cross-origin
server
Kestrel

Redirect headers

cache-control
no-cache, must-revalidate
location
https://ssp-sync.criteo.com/user-sync/match?p=UXQfF18yNmFlaUZzVmdnY3ZRaUZ2QUxpNWRYRUhlSVlSMXJzNkZHS2FnSDR6MTBRJTNE&u=CAESEIXoMfZ7pua9anONyT2WX3E&gdpr=0&gdpr_consent=&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
392
date
Mon, 11 Aug 2025 22:12:44 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain
  • https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
  • https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=6991502948339887798
0
144 B
222ms
221ms
Image
text/plain
74.119.117.39
AS-CRITEO
General
Full URL
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=6991502948339887798
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-store,max-age=0
content-length
0
date
Mon, 11 Aug 2025 22:12:44 GMT
server
Kestrel
cross-origin-resource-policy
cross-origin

Redirect headers

cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=6991502948339887798
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length
0
pragma
no-cache
date
Mon, 11 Aug 2025 22:13:04 GMT
GET
H2
204
match
ssp-sync.criteo.com/user-sync/
Redirect Chain
  • https://cs.admanmedia.com/e805be652c9053b8f771665f0ac3c361.gif?puid=k-x_l6fFWKtEehGji4tA-QmQvlOByDgR7aeeO7Vw&redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3dXCJJ-F9iYndqbU51M3lOTD...
  • https://ssp-sync.criteo.com/user-sync/match?p=XCJJ-F9iYndqbU51M3lOTDY1alluOUM4QkkzbHAlMkI3SHRSejRvcVdkUEtxZFJlJTJCZyUzRA&u=${USER_ID}
0
142 B
497ms
210ms
Image
text/plain
74.119.117.39
AS-CRITEO
General
Full URL
https://ssp-sync.criteo.com/user-sync/match?p=XCJJ-F9iYndqbU51M3lOTDY1alluOUM4QkkzbHAlMkI3SHRSejRvcVdkUEtxZFJlJTJCZyUzRA&u=${USER_ID}
Requested by
Host: d2emu.com
URL: https://d2emu.com/
Protocol
H2
Server
74.119.117.39 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://d2emu.com/

Response headers

strict-transport-security
max-age=31536000; preload;
cache-control
no-store,max-age=0
date
Mon, 11 Aug 2025 22:12:44 GMT
cross-origin-resource-policy
cross-origin
server
Kestrel

Redirect headers

expires
0
cache-control
no-cache, no-store, must-revalidate
location
https://ssp-sync.criteo.com/user-sync/match?p=XCJJ-F9iYndqbU51M3lOTDY1alluOUM4QkkzbHAlMkI3SHRSejRvcVdkUEtxZFJlJTJCZyUzRA&u=${USER_ID}
content-length
0
date
Mon, 11 Aug 2025 22:12:44 GMT
pragma
no-cache
server
nginx
GET
H3
200
300600.json Show response
s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/ Frame 57F4
269 KB
38 KB
153ms
152ms
XHR
application/json
172.253.115.149
GOOGLE
General
Full URL
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/300600.json
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.9.4/lottie.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.253.115.149 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f149.1e100.net
Software
sffe /
Resource Hash
422a692d23883e8941eb35e9d4848f2e8ecd786313726c6ada9f6c849319f144
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://s0.2mdn.net/sadbundle/12653938796366262696/YYA_FY25%20Q4%20BTS%20AIRPODS_OFFER_300x600_EN/index.html?ev=01_253

Response headers

content-encoding
gzip
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Tue, 11 Aug 2026 22:12:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
application/json
vary
Accept-Encoding
last-modified
Tue, 17 Jun 2025 20:52:36 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
x-xss-protection
0
server
sffe
GET
H3
200
KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2
fonts.gstatic.com/s/roboto/v48/ Frame 57F4
20 KB
20 KB
295ms
139ms
Font
font/woff2
142.251.179.94
GOOGLE
General
Full URL
https://fonts.gstatic.com/s/roboto/v48/KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAo.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.179.94 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
pd-in-f94.1e100.net
Software
sffe /
Resource Hash
e44c11f4834bdd4d6b6da7b8ee5eaebc8acb41250cd6bce5cc82ea8262140eaa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Origin
https://s0.2mdn.net
Referer
https://fonts.googleapis.com/

Response headers

age
474274
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 06 Aug 2026 10:28:10 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 06 Aug 2025 10:28:10 GMT
last-modified
Thu, 29 May 2025 23:35:01 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
20612
x-xss-protection
0
server
sffe
GET
H2
200
cookie
sync.cootlogix.com/api/ Frame 260D
Redirect Chain
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1---?gdpr=0&gdpr_conse...
  • https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=0&gdpr_consent=&us_privacy=1---
43 B
496 B
142ms
140ms
Image
image/avif
147.182.212.117
DIGITALOCEAN-ASN
General
Full URL
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1---&coppa=0
Protocol
H2
Server
147.182.212.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://sync.cootlogix.com/

Response headers

access-control-allow-credentials
true
access-control-allow-methods
GET, HEAD, OPTIONS, POST
access-control-allow-origin
*
p3p
CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length
43
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/avif
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=41c3d369-8f5c-4dd0-8eae-a741fd0a78c9&gdpr=0&gdpr_consent=&us_privacy=1---
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 11 Aug 2025 22:12:44 GMT
GET
H2
200
xuid
eb2.3lift.com/ Frame DE30
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=46f4af91-2ba3-4305-896c-c258960d2f82&dongle=0cfd&gdpr=0&gdpr_consent=
37 B
474 B
176ms
176ms
Image
image/gif
35.71.139.29
AMAZON-02
General
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=46f4af91-2ba3-4305-896c-c258960d2f82&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eb2.3lift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif

Redirect headers

location
https://eb2.3lift.com/xuid?mid=3658&xuid=46f4af91-2ba3-4305-896c-c258960d2f82&dongle=0cfd&gdpr=0&gdpr_consent=
content-length
251
date
Mon, 11 Aug 2025 22:12:44 GMT
server
Kestrel
GET
H2
200
xuid
eb2.3lift.com/ Frame DE30
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEI_S-uGA2go4kA7mO7nuOtY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
474 B
182ms
181ms
Image
image/gif
35.71.139.29
AMAZON-02
General
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEI_S-uGA2go4kA7mO7nuOtY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eb2.3lift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, must-revalidate
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEI_S-uGA2go4kA7mO7nuOtY&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
332
date
Mon, 11 Aug 2025 22:12:44 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H3
200
pixel
cm.g.doubleclick.net/ Frame DE30
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTUxOTExMjIxNDM5NTUxNTg3Mg%3D%3D
170 B
191 B
158ms
157ms
Image
image/png
172.253.115.156
GOOGLE
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTUxOTExMjIxNDM5NTUxNTg3Mg%3D%3D
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol
H3
Server
172.253.115.156 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
bg-in-f156.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eb2.3lift.com/

Response headers

cache-control
no-cache, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
170
date
Mon, 11 Aug 2025 22:12:44 GMT
x-xss-protection
0
content-type
image/png
server
HTTP server (unknown)

Redirect headers

cache-control
no-cache, no-store, must-revalidate
location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTUxOTExMjIxNDM5NTUxNTg3Mg%3D%3D
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Mon, 11 Aug 2025 22:12:44 GMT
GET
H2
200
ebda
eb2.3lift.com/ Frame DE30
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTUxOTExMjIxNDM5NTUxNTg3Mg%3D%3D
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
37 B
139 B
152ms
151ms
Image
image/gif
35.71.139.29
AMAZON-02
General
Full URL
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eb2.3lift.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
date
Mon, 11 Aug 2025 22:12:44 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, must-revalidate
location
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma
no-cache
cross-origin-resource-policy
cross-origin
report-to
{"group":"ad-exchange-cookie-matcher","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/httpsserver2/ad-exchange-cookie-matcher"}]}
content-security-policy-report-only
script-src 'none';form-action 'none';frame-src 'none'; report-uri https://csp.withgoogle.com/csp/httpsserver2/ad-exchange-cookie-matcher
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
248
date
Mon, 11 Aug 2025 22:12:44 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
GET
H2
200
setuid
px.ads.linkedin.com/ Frame DE30
0
366 B
153ms
132ms
Image
text/plain
150.171.22.12
MICROSOFT-CORP-MS...
General
Full URL
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1639519112214395515872&dbredirect=true&gdpr=0&consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1---&
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Referer
https://eb2.3lift.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 2B82CD90F93643F8A0E1C84EA1AC8444 Ref B: PDX31EDGE0119 Ref C: 2025-08-11T22:12:44Z
x-li-fabric
prod-ltx1
x-li-uuid
AAY8HjkONMu5k/M6cDqCZA==
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
x-cache
CONFIG_NOCACHE
content-length
0
date
Mon, 11 Aug 2025 22:12:43 GMT
GET

setuid
pbs.yahoo.com/ Frame DE30
0
0