5499309.fls.doubleclick.net Open in urlscan Pro
142.250.186.166 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://5499309.fls.doubleclick.net/activityi;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.17595035...
Effective URL:
https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=121918333409...
Submission: On October 03 via api (October 3rd 2025, 3:01:38 pm UTC) from CH — Scanned from FI

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 19 IPs in 7 countries across 18 domains to perform 21 HTTP transactions. The main IP is 142.250.186.166, located in United States and belongs to GOOGLE, US. The main domain is 5499309.fls.doubleclick.net.
TLS certificate: Issued by WE2 on September 15th 2025. Valid for: 3 months.

This is the only time 5499309.fls.doubleclick.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 3	142.250.186.166 142.250.186.166	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:be00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	193.0.160.131 193.0.160.131	54312 (ROCKETFUEL) (ROCKETFUEL)
1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1 2	52.48.49.253 52.48.49.253	16509 (AMAZON-02) (AMAZON-02)
1	103.231.98.109 103.231.98.109	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.127.178.105 3.127.178.105	16509 (AMAZON-02) (AMAZON-02)
1	2.23.8.26 2.23.8.26	16625 (AKAMAI-AS) (AKAMAI-AS)
1	57.129.18.105 57.129.18.105	16276 (OVH OVH SAS) (OVH OVH SAS)
1	44.210.2.245 44.210.2.245	14618 (AMAZON-AES) (AMAZON-AES)
1 2	104.18.26.193 104.18.26.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.244.174.68 35.244.174.68	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:1f10:4ce... 2600:1f10:4ce4:4a01:fd3e:15bb:a8ad:2782	14618 (AMAZON-AES) (AMAZON-AES)
1	63.33.14.238 63.33.14.238	16509 (AMAZON-02) (AMAZON-02)
1	35.214.136.108 35.214.136.108	19527 (GOOGLE-2) (GOOGLE-2)
1 2	151.101.66.49 151.101.66.49	54113 (FASTLY) (FASTLY)
21	19

3 142.250.186.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net

5499309.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:be00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.131 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

20777079p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.48.49.253 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-48-49-253.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.231.98.109 (Japan)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.127.178.105 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-178-105.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.23.8.26 (Prague, Czech Republic)

ASN16625 (AKAMAI-AS, US)
PTR: a2-23-8-26.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 57.129.18.105 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: haproxy-eu-011.roqad.pl

wt.rqtrk.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.210.2.245 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-210-2-245.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.26.193 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f10:4ce4:4a01:fd3e:15bb:a8ad:2782 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.33.14.238 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-14-238.eu-west-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.136.108 (Groningen, Netherlands)

ASN19527 (GOOGLE-2, US)
PTR: 108.136.214.35.bc.googleusercontent.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.66.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	doubleclick.net 1 redirects 5499309.fls.doubleclick.net cm.g.doubleclick.net — Cisco Umbrella Rank: 317	4 KB
2	everesttech.net 1 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 895	653 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 715	1 KB
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 285	1 KB
2	rfihub.com 1 redirects 20777079p.rfihub.com p.rfihub.com — Cisco Umbrella Rank: 953	8 KB
1	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 448	183 B
1	agkn.com aa.agkn.com — Cisco Umbrella Rank: 630	307 B
1	tremorhub.com partners.tremorhub.com — Cisco Umbrella Rank: 1184	175 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 560	439 B
1	liadm.com i.liadm.com — Cisco Umbrella Rank: 626	208 B
1	rqtrk.eu wt.rqtrk.eu — Cisco Umbrella Rank: 1358	349 B
1	media.net contextual.media.net — Cisco Umbrella Rank: 1006	509 B
1	eyeota.net ps.eyeota.net — Cisco Umbrella Rank: 1065	344 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 566	278 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 945	252 B
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4220	6 KB
1	google.com adservice.google.com — Cisco Umbrella Rank: 603	63 B
0	adnxs.com Failed ib.adnxs.com Failed
21	18

	Domain	Requested by
3	5499309.fls.doubleclick.net	1 redirects
2	sync-tm.everesttech.net	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	dpm.demdex.net	1 redirects
1	x.bidswitch.net	5499309.fls.doubleclick.net
1	aa.agkn.com	5499309.fls.doubleclick.net
1	partners.tremorhub.com	5499309.fls.doubleclick.net
1	idsync.rlcdn.com	5499309.fls.doubleclick.net
1	i.liadm.com	5499309.fls.doubleclick.net
1	wt.rqtrk.eu	5499309.fls.doubleclick.net
1	contextual.media.net	5499309.fls.doubleclick.net
1	ps.eyeota.net
1	p.rfihub.com	1 redirects
1	us-u.openx.net	5499309.fls.doubleclick.net
1	image2.pubmatic.com	5499309.fls.doubleclick.net
1	cm.g.doubleclick.net	5499309.fls.doubleclick.net
1	20777079p.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	5499309.fls.doubleclick.net
1	adservice.google.com	5499309.fls.doubleclick.net
0	ib.adnxs.com Failed	5499309.fls.doubleclick.net
21	20

This site contains no links.

Subject Issuer	Validity	Valid
*.doubleclick.net WE2	`2025-09-15` - `2025-12-08`	3 months	crt.sh
*.google.com WE2	`2025-09-15` - `2025-12-08`	3 months	crt.sh
*.rfihub.net Amazon RSA 2048 M04	`2025-08-31` - `2026-09-29`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2025-04-02` - `2026-04-27`	a year	crt.sh
*.g.doubleclick.net WE2	`2025-09-15` - `2025-12-08`	3 months	crt.sh
*.pubmatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-19` - `2026-03-22`	a year	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2025-08-12` - `2026-08-19`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2024-10-23` - `2025-10-22`	a year	crt.sh
*.rqtrk.eu RapidSSL TLS RSA CA G1	`2025-05-16` - `2026-05-15`	a year	crt.sh
*.liadm.com Amazon RSA 2048 M03	`2025-07-01` - `2026-07-29`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2025-02-06` - `2026-03-05`	a year	crt.sh
*.tremorhub.com Amazon RSA 2048 M02	`2024-12-24` - `2026-01-23`	a year	crt.sh
*.agkn.com RapidSSL TLS RSA CA G1	`2025-09-18` - `2026-09-17`	a year	crt.sh
*.bidswitch.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-08-12` - `2025-11-07`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest
Frame ID: 77A7A3DCC7B0FA6C9A5CF027E8E64E00
Requests: 4 HTTP requests in this frame

Frame: https://20777079p.rfihub.com/ca.html?ver=9&rb=27244&ca=20777079&_o=27244&_t=20777079&pe=https%3A%2F%2F5499309.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCNi1sIemiJADFSJFHgId-RQyPQ%3Bsrc%3D5499309%3Btype%3Dsitev00%3Bcat%3Dwfpor0%3Bord%3D1219183334095%3Bnpa%3D1%3Bauiddc%3D1439226369.1759503595%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bpscdl%3Dnoapi%3Bfrm%3D0%3B_tu%3DKFA%3Bgtm%3D45fe5a20h2z86630861za200zb6630861zd6630861xea%3Bgcd%3D13l3l3l2l1l1%3Bdma_cps%3Dsyphamo%3Bdma%3D1%3Bdc_fmt%3D2%3Btag_exp%3D101509157%7E103116026%7E103200004%7E103233427%7E104527906%7E104528500%7E104684208%7E104684211%7E104948813%7E115480709%7E115616985%7E115834636%7E115834638%3Bepver%3D2%3Bdc_random%3DI-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g%3B_dc_test%3D1%3B%7Eoref%3Dhttps%253A%252F%252Fwww.wfp.org%252Ffittest%3F&pf=&ra=44902789033458834
Frame ID: 34038D6C7A65CA5281AFA63F5ECAAAD7
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://5499309.fls.doubleclick.net/activityi;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc... HTTP 302
https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfp... Page URL

Detected technologies

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Page Statistics

21
Requests

71 %
HTTPS

11 %
IPv6

18
Domains

20
Subdomains

19
IPs

7
Countries

21 kB
Transfer

29 kB
Size

19
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://5499309.fls.doubleclick.net/activityi;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest HTTP 302
https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559739772422698&referrer=https%3A%2F%2F5499309.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCNi1sIemiJADFSJFHgId-RQyPQ%3Bsrc%3D5499309%3Btype%3Dsitev00%3Bcat%3Dwfpor0%3Bord%3D1219183334095%3Bnpa%3D1%3Bauiddc%3D1439226369.1759503595%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bpscdl%3Dnoapi%3Bfrm%3D0%3B_tu%3DKFA%3Bgtm%3D45fe5a20h2z86630861za200zb6630861zd6630861xea%3Bgcd%3D13l3l3l2l1l1%3Bdma_cps%3Dsyphamo%3Bdma%3D1%3Bdc_fmt%3D2%3Btag_exp%3D101509157%7E103116026%7E103200004%7E103233427%7E104527906%7E104528500%7E104684208%7E104684211%7E104948813%7E115480709%7E115616985%7E115834636%7E115834638%3Bepver%3D2%3Bdc_random%3DI-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g%3B_dc_test%3D1%3B%7Eoref%3Dhttps%253A%252F%252Fwww.wfp.org%252Ffittest%3F&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=8de0c36d-43e7-4aa2-bf60-adeae3a79907%3A1759503699.3801122&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D8de0c36d-43e7-4aa2-bf60-adeae3a79907%253A1759503699.3801122%26_%3D1759503699.381142&cb=1759503699.3811553 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=8de0c36d-43e7-4aa2-bf60-adeae3a79907%3A1759503699.3801122&_=1759503699.381142 HTTP 307
https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID

Request Chain 6

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5108559739772422698&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559739772422698&redir=

Request Chain 9

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=5108559739772422698&bid=omt9pi0

Request Chain 13

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559739772422698&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559739772422698&forward=&C=1

Request Chain 18

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aN-lUwAOYfQSXgAs

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;... Show response
5499309.fls.doubleclick.net/
Redirect Chain

https://5499309.fls.doubleclick.net/activityi;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=...
https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=...

2 KB
1 KB

217ms
216ms

Document
text/html

142.250.186.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

1822d5836137dd81e3ea9415b4c6764591d2f32d1153a1b8171be7474b31c53f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 862
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Oct 2025 15:01:38 GMT
expires: Fri, 03 Oct 2025 15:01:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 03 Oct 2025 15:01:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=*;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z8663086...
adservice.google.com/ddm/fls/z/ 42 B
63 B 176ms
96ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=*;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest

Requested by

Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://5499309.fls.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 03 Oct 2025 15:01:38 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 223ms
63ms Script
application/x-javascript 2600:9000:214f:be00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:be00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://5499309.fls.doubleclick.net/

Response headers

x-amz-cf-id: 2Z_9XitfAwAYMFLqRwx4he7i2jAWT5P7idSH1TauWnn0jG-nk84L9w==
cache-control: public, max-age=3600
content-encoding: gzip
age: 793
via: 1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
expires: Fri, 03 Oct 2025 15:48:25 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Fri, 03 Oct 2025 14:48:25 GMT
content-type: application/x-javascript
last-modified: Fri, 03 Oct 2025 14:48:15 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H/1.1 200
OK ca.html Show response
20777079p.rfihub.com/ Frame 3403 6 KB
7 KB 273ms
59ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Download Go to

Full URL: https://20777079p.rfihub.com/ca.html?ver=9&rb=27244&ca=20777079&_o=27244&_t=20777079&pe=https%3A%2F%2F5499309.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCNi1sIemiJADFSJFHgId-RQyPQ%3Bsrc%3D5499309%3Btype%3Dsitev00%3Bcat%3Dwfpor0%3Bord%3D1219183334095%3Bnpa%3D1%3Bauiddc%3D1439226369.1759503595%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bpscdl%3Dnoapi%3Bfrm%3D0%3B_tu%3DKFA%3Bgtm%3D45fe5a20h2z86630861za200zb6630861zd6630861xea%3Bgcd%3D13l3l3l2l1l1%3Bdma_cps%3Dsyphamo%3Bdma%3D1%3Bdc_fmt%3D2%3Btag_exp%3D101509157%7E103116026%7E103200004%7E103233427%7E104527906%7E104528500%7E104684208%7E104684211%7E104948813%7E115480709%7E115616985%7E115834636%7E115834638%3Bepver%3D2%3Bdc_random%3DI-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g%3B_dc_test%3D1%3B%7Eoref%3Dhttps%253A%252F%252Fwww.wfp.org%252Ffittest%3F&pf=&ra=44902789033458834
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 36f3e9318f2d46b7ea9cb64d436939b2ee2924b132c9262c8ed5fe1e693b13cf

Request headers

Referer: https://5499309.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 6347
Content-Type: text/html;charset=utf-8
Date: Fri, 03 Oct 2025 15:01:39 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET

getuid
ib.adnxs.com/ Frame 3403
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559739772422698&referrer=https%3A%2F%2F5499309.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCNi1sIemiJADFSJFHgId-RQyPQ%3Bsrc%3...
https://p.rfihub.com/cm?pub=39342&in=0&userid=8de0c36d-43e7-4aa2-bf60-adeae3a79907%3A1759503699.3801122&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D8de0c36d-43e7-4aa2-bf60-adeae3a...
https://idsync.rlcdn.com/501709.gif?partner_uid=8de0c36d-43e7-4aa2-bf60-adeae3a79907%3A1759503699.3801122&_=1759503699.381142
https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID

0
0

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 3403 170 B
409 B 203ms
72ms Image
image/png 142.250.181.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEwODU1OTczOTc3MjQyMjY5OA==&forward=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 03 Oct 2025 15:01:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET setuid
ib.adnxs.com/ Frame 3403 0
0

GET
H2

200

demconf.jpg
dpm.demdex.net/ Frame 3403
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5108559739772422698&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559739772422698&redir=

42 B
716 B

84ms
83ms

Image
image/gif

52.48.49.253
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559739772422698&redir=

Protocol

Server

52.48.49.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-48-49-253.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-irl1-1-v080-095f585c5.edge-irl1.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: Ujck6lpcTIE=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559739772422698&redir=
dcs: dcs-prod-irl1-1-v080-0cc7e71f7.edge-irl1.demdex.com 0 ms
pragma: no-cache
x-tid: 4FFOOnA2SOw=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Fri, 03 Oct 2025 15:01:39 GMT

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame 3403 0
252 B 194ms
58ms Image
text/html 103.231.98.109
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL

https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw==&piggybackCookie=5108559739772422698&r=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

103.231.98.109 , Japan, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

strict-transport-security: max-age=16070400; includeSubDomains
cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-encoding: gzip
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: text/html; charset=utf-8
server: nginx

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame 3403 43 B
278 B 147ms
67ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073062&val=5108559739772422698&r=
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 185.204.1.185
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Fri, 03 Oct 2025 15:01:38 GMT
content-type: image/gif
vary: Accept

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame 3403
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=5108559739772422698&bid=omt9pi0

0
344 B

227ms
56ms

Image
text/plain

3.127.178.105
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5108559739772422698&bid=omt9pi0
Protocol: HTTP/1.1
Server: 3.127.178.105 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-178-105.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

Content-Length: 0
Date: Fri, 03 Oct 2025 15:01:39 GMT
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: https://ps.eyeota.net/match?uid=5108559739772422698&bid=omt9pi0
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Fri, 03 Oct 2025 15:01:39 GMT
Server: Jetty(9.4.51.v20230217)

GET
H2 200 cksync.php
contextual.media.net/ Frame 3403 43 B
509 B 347ms
190ms Image
image/gif 2.23.8.26
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=5108559739772422698

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.23.8.26 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-23-8-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
content-encoding: gzip
pragma: no-cache
expires: Fri, 03 Oct 2025 15:01:39 GMT
alt-svc: h3=":443"; ma=93600
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
content-length: 55
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif
vary: Accept-Encoding

GET
H2 200 /
wt.rqtrk.eu/ Frame 3403 43 B
349 B 198ms
63ms Image
image/gif 57.129.18.105
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://wt.rqtrk.eu/?pid=afd6afd5-a807-471d-940d-aa3c19fc7dca&src=www&type=100&sid=1&cb=nug5uHGwn4xn&uid=5108559739772422698&url=https%3A%2F%2F5499309.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCNi1sIemiJADFSJFHgId-RQyPQ%3Bsrc%3D5499309%3Btype%3Dsitev00%3Bcat%3Dwfpor0%3Bord%3D1219183334095%3Bnpa%3D1%3Bauiddc%3D1439226369.1759503595%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bpscdl%3Dnoapi%3Bfrm%3D0%3B_tu%3DKFA%3Bgtm%3D45fe5a20h2z86630861za200zb6630861zd6630861xea%3Bgcd%3D13l3l3l2l1l1%3Bdma_cps%3Dsyphamo%3Bdma%3D1%3Bdc_fmt%3D2%3Btag_exp%3D101509157%7E103116026%7E103200004%7E103233427%7E104527906%7E104528500%7E104684208%7E104684211%7E104948813%7E115480709%7E115616985%7E115834636%7E115834638%3Bepver%3D2%3Bdc_random%3DI-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g%3B_dc_test%3D1%3B%7Eoref%3Dhttps%253A%252F%252Fwww.wfp.org%252Ffittest%3F&gdpr=&gdpr_pd=0&gdpr_consent=
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 57.129.18.105 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: haproxy-eu-011.roqad.pl
Software: istio-envoy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

cache-control: no-cache,private
pragma: no-cache
x-envoy-upstream-service-time: 1
expires: Fri, 03 Oct 2025 15:01:38 GMT
content-length: 43
p3p: CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif
server: istio-envoy

GET
H/1.1 200
OK 90096
i.liadm.com/s/ Frame 3403 0
208 B 1429ms
667ms Image
text/plain 44.210.2.245
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/90096?bidder_id=246506&bidder_uuid=5108559739772422698

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.210.2.245 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-210-2-245.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Fri, 03 Oct 2025 15:01:39 GMT
trace-id: db66095683bfc48d
Request-Time: 0
Connection: keep-alive

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 3403
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559739772422698&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559739772422698&forward=&C=1

43 B
302 B

79ms
79ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559739772422698&forward=&C=1
Protocol: H2
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nT95xFyhmZ45WbSR2ZR%2FqaejDhq9A3Ev5aqBxlYnfUU%2B2Bdhrmt6KmeB0uhfvecdUrP3BgbSXzU5aaJ%2FnyvxsuXRx3KkTFhvGDqvxa3pfqfZjO12ZysB"}]}
cf-ray: 988d50e8ca9f1bf4-HEL
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif
vary: accept-encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=57&external_user_id=5108559739772422698&forward=&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=jr3lrElWSl7ONYgbX%2BDYK7LkxakUFubpftYPdXFrq%2FOW%2FWpLK4Odi3IPl%2FUWzbBsTZQ4yjbYYaIHrjwHoa1X5n5ZaI%2BTCvOE9OG5vAmJ9UYtI9Evw4uj"}]}
cf-ray: 988d50e848fc1bf4-HEL
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 03 Oct 2025 15:01:39 GMT
vary: accept-encoding
server: cloudflare

GET
H2 200 360947.gif
idsync.rlcdn.com/ Frame 3403 42 B
439 B 143ms
69ms Image
image/gif 35.244.174.68
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=5108559739772422698
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif

GET
H2 200 sync
partners.tremorhub.com/ Frame 3403 43 B
175 B 425ms
128ms Image
image/gif 2600:1f10:4ce4:4a01:fd3e:15bb:a8ad:2782
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=5108559739772422698&r=oZouXVZtSbNS
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f10:4ce4:4a01:fd3e:15bb:a8ad:2782 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif
server: nginx

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 3403 0
307 B 255ms
72ms Image
text/plain 63.33.14.238
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=5108559739772422698
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.33.14.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-14-238.eu-west-1.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
expires: 0
access-control-allow-origin: *
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Fri, 03 Oct 2025 15:01:39 GMT
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 sync
x.bidswitch.net/ Frame 3403 43 B
183 B 224ms
61ms Image
image/gif 35.214.136.108
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=119&user_id=5108559739772422698&expires=30&gdpr=&gdpr_consent=&gdpr_pd={GDPR_PD}
Requested by: Host: 5499309.fls.doubleclick.net
URL: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.214.136.108 Groningen, Netherlands, ASN19527 (GOOGLE-2, US),
Reverse DNS: 108.136.214.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/gif

GET
H2

200

/
sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/ Frame 3403
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aN-lUwAOYfQSXgAs

85 B
171 B

39ms
38ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aN-lUwAOYfQSXgAs
Protocol: H2
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://20777079p.rfihub.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1759503699.396641,VS0,VE0
age: 2771
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Fri, 03 Oct 2025 15:01:39 GMT
content-type: image/png
x-served-by: cache-bma-essb1270043-BMA
server: Jetty(9.4.35.v20201120)
x-cache-hits: 6198

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=aN-lUwAOYfQSXgAs
x-timer: S1759503699.265737,VS0,VE92
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Fri, 03 Oct 2025 15:01:39 GMT
x-served-by: cache-bma-essb1270043-BMA
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3 404 favicon.ico
5499309.fls.doubleclick.net/ 2 KB
2 KB 89ms
89ms Other
text/html 142.250.186.166
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://5499309.fls.doubleclick.net/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

7f25fd0260c4ef8c26a87a5a126634e846ba539c75e5d508103f4d98831654a5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Referer: https://5499309.fls.doubleclick.net/activityi;dc_pre=CNi1sIemiJADFSJFHgId-RQyPQ;src=5499309;type=sitev00;cat=wfpor0;ord=1219183334095;npa=1;auiddc=1439226369.1759503595;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;_tu=KFA;gtm=45fe5a20h2z86630861za200zb6630861zd6630861xea;gcd=13l3l3l2l1l1;dma_cps=syphamo;dma=1;dc_fmt=2;tag_exp=101509157~103116026~103200004~103233427~104527906~104528500~104684208~104684211~104948813~115480709~115616985~115834636~115834638;epver=2;dc_random=I-6Mr8oE8fyZNcrNgNrlQ_6MFsSUj8ua9g;_dc_test=1;~oref=https%3A%2F%2Fwww.wfp.org%2Ffittest?

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1572
date: Fri, 03 Oct 2025 15:01:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: cafe

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/getuid?https%3A%2F%2Fidsync.rlcdn.com%2F52154.gif%3Fserved_by%3Devergreen%26partner_uid%3D%24UID

Domain: ib.adnxs.com
URL: https://ib.adnxs.com/setuid?entity=18&code=5108559739772422698&gdpr=&gdpr_consent=&redir=

Verdicts & Comments Add Verdict or Comment

6 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doubleclick.net/	1970-01-21 08:45:04	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-21 13:04:15	Name: receive-cookie-deprecation Value: 1
.rfihub.com/	1970-01-21 18:06:39	Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3tjQ3NzIxMjKztBDiM9TNsoj0ys4wzTQ3TIwAADN6fbglAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3tjQ3NzIxMjKztBDiM9TNsoj0ys4wzTQ3TIwAADN6fbglAAAA
.rlcdn.com/	1970-01-21 17:30:39	Name: rlas3 Value: VRRFPIgGfA3mSTys4i7nW7dcMs9tkvk8K/N+fyjaUb4=
.casalemedia.com/	1970-01-21 17:30:39	Name: CMID Value: aN-lU7mqPqwAKlK0AMAr0wAA
.casalemedia.com/	1970-01-21 10:54:39	Name: CMPS Value: 4400
.casalemedia.com/	1970-01-21 10:54:39	Name: CMPRO Value: 4400
.rqtrk.eu/	1970-01-21 08:55:08	Name: browser_id Value: 1:a1a4c0ba-ee9c-44cc-8171-5924f287ae78
.demdex.net/	1970-01-21 13:04:15	Name: demdex Value: 36885041100675660934016360783232383620
.rezync.com/	1970-01-21 13:04:15	Name: zync-uuid Value: 8de0c36d-43e7-4aa2-bf60-adeae3a79907:1759503699.3801122
live.rezync.com/	1970-01-21 13:04:15	Name: sd-session-id Value: .eJwNylEOwiAMANC79HsYoEApl1nqqAnRoRnzx2V3d58veQfMH91W6dp3KPv21QmWV7s0oBww2m_VJxSIzuYYmZCJfPA-cYZzgqFjtHefW71OrmoXTNUEVDJBxJv7I1kjVUVRiNlScRQ5WkzMN8zWOe_h_APPOiY7.aN_lUw.yBPt0TKhvbgTOoPCu0Skn7JEANY
.media.net/	1970-01-21 17:30:39	Name: visitor-id Value: 4025052994825518000V10
.media.net/	1970-01-21 17:29:13	Name: data-rk Value: 5108559739772422698~~3
.dpm.demdex.net/	1970-01-21 13:04:15	Name: dpm Value: 36885041100675660934016360783232383620
.rfihub.com/	1970-01-21 18:06:39	Name: eud Value: H4sIAAAAAAAA_13OLRICMQwF4IEBxaCqOESZpP_hNoGWAyErVyIr9wgcAYncI6xCQiK_eZP30jdHzJEi-ESEGIfyrPxSXpRX5Wkr_VQeOt9Jv5XHXv13kH6YXGqDm0_VBt-yDczOXu8JLNfGzXMmgnz5HZ19AUTnuvlrSiVM0vFj5FI_SX8BA2yctkoBAAA
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_wXBwRGAMAgEwI_t4ACXQLAbFFJIKnf3XL6q-YMVDbTTyFR6tzFldTbSI9gf8RmTYRE3Fouo_jzM92k6AAAA
.rlcdn.com/	1970-01-21 10:11:27	Name: pxrc Value: CNPK/8YGEgYItuoBEAA=
.eyeota.net/	1970-01-21 08:45:04	Name: SERVERID Value: 22563~DM

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://5499309.fls.doubleclick.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20777079p.rfihub.com
5499309.fls.doubleclick.net
aa.agkn.com
adservice.google.com
c1.rfihub.net
cm.g.doubleclick.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
i.liadm.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
p.rfihub.com
partners.tremorhub.com
ps.eyeota.net
sync-tm.everesttech.net
us-u.openx.net
wt.rqtrk.eu
x.bidswitch.net
ib.adnxs.com
103.231.98.109
104.18.26.193
142.250.181.226
142.250.186.162
142.250.186.166
151.101.66.49
193.0.160.131
2.23.8.26
2600:1f10:4ce4:4a01:fd3e:15bb:a8ad:2782
2600:9000:214f:be00:1:76cf:fe80:93a1
3.127.178.105
35.214.136.108
35.244.159.8
35.244.174.68
44.210.2.245
52.48.49.253
57.129.18.105
63.33.14.238
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
1822d5836137dd81e3ea9415b4c6764591d2f32d1153a1b8171be7474b31c53f
36f3e9318f2d46b7ea9cb64d436939b2ee2924b132c9262c8ed5fe1e693b13cf
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
7f25fd0260c4ef8c26a87a5a126634e846ba539c75e5d508103f4d98831654a5
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

5499309.fls.doubleclick.net Open in urlscan Pro 142.250.186.166 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

71 %HTTPS

11 %IPv6

18 Domains

20 Subdomains

19 IPs

7 Countries

21 kBTransfer

29 kBSize

19 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

6 JavaScript Window variables

19 Cookies

1 Console Messages

Security Headers

Indicators

5499309.fls.doubleclick.net Open in urlscan Pro
142.250.186.166 Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

71 %
HTTPS

11 %
IPv6

18
Domains

20
Subdomains

19
IPs

7
Countries

21 kB
Transfer

29 kB
Size

19
Cookies

21 HTTP transactions
0 data transactions