reurl.cc Open in urlscan Pro
35.229.143.32 Public Scan

URL: https://re-news.tw/prnasia/4833681_XG33681_2

URL: https://re-news.tw/nearbymed/nighttime-light-exposure-and-type-2-diabetes-risk

URL: https://re-news.tw/racingcharger/61249

URL: https://re-news.tw/creditcard/289274

URL: https://re-news.tw/rich101/2165

URL: https://re-news.tw/zocha/664f06a4333c44b7de8afda5

URL: https://youtils.cc/emoji
Title: 表情符號(emoji)

URL: https://youtils.cc/geoip
Title: IP查詢

URL: https://youtils.cc/big5gb
Title: 繁簡轉換

URL: https://youtils.cc/qrcode
Title: QRCode

URL: https://youtils.cc/length
Title: 身高/長度換算

URL: https://www.comptw.com/
Title: 台灣公司查詢網

URL: https://stockinfo.tw/
Title: 台股資訊網

URL: https://youtils.cc/wordcounter/zh-Hants
Title: 字數統計

URL: https://youtils.cc/dateCalculator
Title: 日期計算機

URL: https://youtils.cc/lunarCalendar
Title: 農曆轉國曆

URL: https://youtils.cc/utm
Title: UTM網址

URL: https://ad.holmesmind.com/adserver/c?p=14210:182968:282987:03a9ec82ef5c7940f830bd9d0f6db8d6:14756&dest=https%3A%2F%2Fwww.clickforce.com.tw%2F

URL: https://adclick.g.doubleclick.net/aclk?sa=l&ai=CVyE0VncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwDSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA7EJRzdkde1oy_qACgOYCwHICwGADAGiDAOQAQHaDBAKChCQ3tnc9YP7qkwSAgEDqg0CVFfIDQHiDRMI9OXTyc-UkQMVx8E0Bx0NRzvv6g0TCLek1MnPlJEDFcfBNAcdDUc77_ANAogO____________AbgT5APYEw2IFAPQFQGYFgHKFgIKAPgWAYAXAbIXDhgBKgo0Mjg0MjU5OTU5uhcCOAGqGBcJAAAAADDYFUESCjQyODQyNTk5NTkYAbIYCRICvlAYLiIBANAYAegYAcIZAggB&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_0udvm74egBIDpRvpAC7Hfl5MaIrw&client=ca-pub-4485239425924787&rf=4&nb=9&adurl=https://octopart.com/bom-tool%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3Dg_cpc_apac-tw_display_bomv2_english_en_usd_bom-sqr%26gad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE

URL: https://adclick.g.doubleclick.net/aclk?sa=l&ai=CVyE0VncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwDSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA7EJRzdkde1oy_qACgOYCwHICwGADAGiDAOQAQHaDBAKChCQ3tnc9YP7qkwSAgEDqg0CVFfIDQHiDRMI9OXTyc-UkQMVx8E0Bx0NRzvv6g0TCLek1MnPlJEDFcfBNAcdDUc77_ANAogO____________AbgT5APYEw2IFAPQFQGYFgHKFgIKAPgWAYAXAbIXDhgBKgo0Mjg0MjU5OTU5uhcCOAGqGBcJAAAAADDYFUESCjQyODQyNTk5NTkYAbIYCRICvlAYLiIBANAYAegYAcIZAggB&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_0udvm74egBIDpRvpAC7Hfl5MaIrw&client=ca-pub-4485239425924787&rf=4&nb=0&adurl=https://octopart.com/bom-tool%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3Dg_cpc_apac-tw_display_bomv2_english_en_usd_bom-sqr%26gad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE
Title: Source Your BOM in Seconds

URL: https://adclick.g.doubleclick.net/aclk?sa=l&ai=CVyE0VncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwDSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA7EJRzdkde1oy_qACgOYCwHICwGADAGiDAOQAQHaDBAKChCQ3tnc9YP7qkwSAgEDqg0CVFfIDQHiDRMI9OXTyc-UkQMVx8E0Bx0NRzvv6g0TCLek1MnPlJEDFcfBNAcdDUc77_ANAogO____________AbgT5APYEw2IFAPQFQGYFgHKFgIKAPgWAYAXAbIXDhgBKgo0Mjg0MjU5OTU5uhcCOAGqGBcJAAAAADDYFUESCjQyODQyNTk5NTkYAbIYCRICvlAYLiIBANAYAegYAcIZAggB&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_0udvm74egBIDpRvpAC7Hfl5MaIrw&client=ca-pub-4485239425924787&rf=4&nb=19&adurl=https://octopart.com/bom-tool%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3Dg_cpc_apac-tw_display_bomv2_english_en_usd_bom-sqr%26gad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE

URL: https://www.google.com/aclk?sa=l&ai=CcoacVncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB-fXsQLYBwDACAHSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA4AKA5gLAcgLAdoLCwgfEKCK0NCLAxgAgAwBogwDkAEB2gwQCgoQkN7Z3PWD-6pMEgIBA6oNAlRXyA0B4g0TCPTl08nPlJEDFcfBNAcdDUc77-oNEwi3pNTJz5SRAxXHwTQHHQ1HO-_wDQKIDv___________wG4E-QD2BMNiBQD0BUBmBYByhYCCgD4FgGAFwGyFw4YASoKNDI4NDI1OTk1OboXAjgBqhgXCQAAAAAw2BVBEgo0Mjg0MjU5OTU5GAGyGAkSAr5QGC4iAQDQGAHoGAHCGQIIAQ&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASABEgI82_D_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_3lrfI6nR_cm1fMi-It2wVNAARlMg&nb=6&adurl=https://octopart.com/%3Fgad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASABEgI82_D_BwE
Title: Search on Octopart.com

URL: https://www.google.com/aclk?sa=l&ai=Ct-zKVncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB-fXsQLYBwDACALSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA4AKA5gLAcgLAdoLCwgfEJ2K0NCLAxgBgAwBogwDkAEB2gwQCgoQkN7Z3PWD-6pMEgIBA6oNAlRXyA0B4g0TCPTl08nPlJEDFcfBNAcdDUc77-oNEwi3pNTJz5SRAxXHwTQHHQ1HO-_wDQKIDv___________wG4E-QD2BMNiBQD0BUBmBYByhYCCgD4FgGAFwGyFw4YASoKNDI4NDI1OTk1OboXAjgBqhgXCQAAAAAw2BVBEgo0Mjg0MjU5OTU5GAGyGAkSAr5QGC4iAQDQGAHoGAHCGQIIAQ&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASACEgLpK_D_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_2vkTgeCjUUHohzC-4M8ZodDLW-Kg&nb=6&adurl=https://octopart.com/join%3Fgad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASACEgLpK_D_BwE
Title: Join Octopart for Free

URL: https://www.google.com/aclk?sa=l&ai=CanNVVncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB-fXsQLYBwDACAPSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA4AKA5gLAcgLAdoLCwgfEMqJ9I-XBxgAgAwBogwDkAEB2gwQCgoQkN7Z3PWD-6pMEgIBA6oNAlRXyA0B4g0TCPTl08nPlJEDFcfBNAcdDUc77-oNEwi3pNTJz5SRAxXHwTQHHQ1HO-_wDQKIDv___________wG4E-QD2BMNiBQD0BUBmBYByhYCCgD4FgGAFwGyFw4YASoKNDI4NDI1OTk1OboXAjgBqhgXCQAAAAAw2BVBEgo0Mjg0MjU5OTU5GAGyGAkSAr5QGC4iAQDQGAHoGAHCGQIIAQ&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASADEgIXE_D_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_2nrTH04Azf8CEPXPDLn74mWFTu5g&nb=6&adurl=https://octopart.com/partner-solutions%3Fgad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASADEgIXE_D_BwE
Title: Partner with Octopart

URL: https://adclick.g.doubleclick.net/aclk?sa=l&ai=CVyE0VncpadbVJMeD0-kPjY7t-Q6upOazf8Pjp4P0E5m42MCSRhABINLMgRpgnwGgAZ_lqbIDyAEJ4AIAqAMByAMKqgT5AU_QzYyJMLfSImcrxb0irqOSkPeM2aDmq1awR928EeATGNduHa0Oq73yRIQVP0ziU7KpddKNF-f3u7d7ThkxErboAZpl9FohpSh3YC7X7oREfV7Iq-dF0VOkBJH1Y1-3UFNGWMNOdb_CjbMSxrBPW01OW2B5zH8daA0ivBHI1lIEuRH3Bpxyx_vRXjuKn-Uvp52oj8sjv9SvKSR1L5Od0cWN72Fj6WJPf7Z0-7nstulIzwroEWKATgAXfLMl0fN6BhB32O8s-Av77RFJwwbJKd7mHjI4q73WKqpMkhOEH3HFD792qxE_MJFyEswtmMcUGnu5bvr8vydcksAErvGO4ooF4AQBiAWQ--24U6AGLoAH_93H_ASoB6fMsQKoB-LYsQKoB6a-G6gHzM6xAqgH89EbqAeW2BuoB6qbsQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gH2baxAqgHmgaoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQKoB_jCsQKoB_vCsQLYBwDSCC8IgGEQARidATIIioKAgICAgAg6DYBAgMCAgICAqIACqANIvf3BOljfrdPJz5SRA7EJRzdkde1oy_qACgOYCwHICwGADAGiDAOQAQHaDBAKChCQ3tnc9YP7qkwSAgEDqg0CVFfIDQHiDRMI9OXTyc-UkQMVx8E0Bx0NRzvv6g0TCLek1MnPlJEDFcfBNAcdDUc77_ANAogO____________AbgT5APYEw2IFAPQFQGYFgHKFgIKAPgWAYAXAbIXDhgBKgo0Mjg0MjU5OTU5uhcCOAGqGBcJAAAAADDYFUESCjQyODQyNTk5NTkYAbIYCRICvlAYLiIBANAYAegYAcIZAggB&ae=1&ase=2&gclid=EAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE&num=1&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&sig=AOD64_0udvm74egBIDpRvpAC7Hfl5MaIrw&client=ca-pub-4485239425924787&rf=4&nb=8&adurl=https://octopart.com/bom-tool%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26utm_campaign%3Dg_cpc_apac-tw_display_bomv2_english_en_usd_bom-sqr%26gad_source%3D5%26gad_campaignid%3D22399384976%26gclid%3DEAIaIQobChMI1tjUyc-UkQMVx8E0Bx0NRzvvEAEYASAAEgKuQPD_BwE

URL: https://adssettings.google.com/whythisad?source=display&reasons=AQde934gpqPn4yJ2_F3MQz1Ow2VB7Svfh9E2xX4mtPSt47CFy4zHAgPRPQl7PFIYaQVgXjwtUM98dCsdpT5wz6Fmayybm5aw20Q02nVVv8Mmt3acGfYkdsQYXvX65cw2Y6ZFz_qVosepU_jLFV8nRHMVCE--6g_W0RFPSc6DRnzLKI6s7fNOP0Cq0SjxPJqGhMbYQDy71P1W9UyXf2Ygh-ZTRf2izqeDNxLm2OEHebMZs5OumHWQy4ulXYjh_xU0ofO18a-V2cc3hfmI9Ep4WKaK_wqF0Pi4rphmNTzS9RXeHhzrNfXGvm4czjPRIM2ypzjAzBHkDwWPeGrZpINYqg5Gr7JNo_KlmuD21zKKAUPpyqY0RxDdvdL446NETIbmZ6qzlMjvh2KkU3XnhkoJwQYT4r_OckDat9fqnblycFcSPMsgxumWnBVIHOBFLumLkEPQ0IP9odLXpg6bwJapjEKOrFCfx5grujhmK4qEFTDPp34H98aVL8BfdItUlFT_aj6Tm9M-_zgu6rzHcRThcN3RcErRurrDiUOqMAxYCOG0HdEBWXwDeTT2-dnT0LBSKj0nPP4SQXgugD-yV3fcMnPlfh3hU2s3Zf-tZDCpdwo8lC__CkWWJN3v008P4E5usN9DR-afrQxnnT7cYzaFukk2t9WeC6sgXqyuLZz6FfIzpPgrKrp9UVb06DaAclmzWZUNPgki566UxcbikI8R7xzyCzkHtoALHqYu0T7Y1jQe-GOZNP3b8BG2WL0zu5x0CDwLVMQmNV-KEtGe8_g1saYBqFH0GCtA1ybC1SocrpiwMn956TanFZZriOWKD7Qv9HOj69tO6MjjnKMDk27WSdqJqw9uBvf2hTs4t6eQ51VOISGg8-imoUXvdwcAU0eGGVOrxtwqhyX0k07Dt3Ounu6VsPpkyh1tf-KaJC_jTFSs1sGb-mrh3ywLkLBZytH4-pLVQvABDdPleR-Gw5CYsC2gf_ON3hofXyqLsOJnrOcYPF4OK67LqzNjWMQeY86YK9uwOIiVST_FSdi_uwd8J17uWRPUVfP91tO4ZhgvPZn6pVLIH6yPgy8cqJtIc9ke6IeBzwqAVXKdXIpyW-nkRCw9gQYUoYi7sJ2sEfJhwEY-d2Zu6J1AeZUWQlr3en6jUl3H95JQu_ErZJrl9bEuQ3rzKaazqTv_P2PPG81-30KaKq5mamrNEsoqlskK9S9Z99qWhSpjfOM4E-G3UYt20TFONOIwvY0Dw22D_WxLzVZehlXgvVGUoxT5FtDADhgGp1MLS4oJJYGnOxbwcT6-QE0E6zwvw_BhTnqi20molEYDPpbaK8xslWidXWUBP4skKH0oMsRkeUjRQOl0emXemJnUq6iERiyIA5TDAm1rBm6GW7RUWvUy1i1CdpBo8l2AxvPpf8iq3hdNGVlik7jOBifvKkGENPQjZN60vXdVWptyYCLcmvEOKnxptOxEq7qgTFsoqbZdc6nRbq9yy-8ub0qhP41ej-h_ax1B0jo2gejnCk2c1OQwkZB2VyriUGo3fVjF-6wAoZp1S9-YaxenQm0GpXwujrnX1_MoCs4LC0eyMROME3DLfs2uPaGvl-ePy-6F3UiX1BDXTk4Amqqe2IFdNW7WPnSdRXs5Q5wJe0Rx6EXwoeHRV10ZeehrMAIPOBHkms77zp-Ye7OE6K_0mFxWR4fR8lvUe1B0sf3abb2P92jzytZTf1KfKml38phUxpiPQ8hea524LQqAJpixTkUP8JOqj5Qr_hApbn_RNWfnycgjO1nSXpgXLn5IkXyEpukpv44MhAzii4OjpIEs9SxcyHNx74Ph9xL_qQ-s9nVD2bweIePZW5HmKG4g8rSLBSkGmxZ4acl1YCtKs0pUduhm5JnRXiIXRgbzgAdgJWnux22GXhA6me4tTTw__1hQUkTqvyrRQcNN3mbXJXI4j1vK3Z_5q_tMNGH72f9dp2J0Y7lBdcGCLm8-GuI4Iv2Rw1OUS7gsIpg8VCBmtWLsKre4cZAcbmgMrHUbH4qqXH4L-TWAieymsMP1iQbo7AT7i0fS5Y1u26uDcCq6XWMecpNjj4fheGSkrnvwou1yw7wPlBHdsxEFo9afKMQ_vmEKlE8X4_y23fyI4qtv4BA2_81CNUmK0yPzBXXLeB7PhWXnFMDJ8xGVwp420QgNsuG79X8j9Tk-QhxT5_jrwQnspuyAkMeGlZXy35oynLml3_zspiCG25taQxZjrlpPmeR4e6gfDw3ei36dzZCui6c6uQwIP5w6ierVfCEV-sZgLDWu4BlBY9LSCCdxoJgicC6ZPqQdGBMpxi2M4B_d2YvEMwO2Sxfzk4Ou3HpI-SGWzNKKo3liLXd8jeURCKoH5yRNshuR1NBh9aT3vyd7LEh_OLioPi_2TMd-8mfgARQjdEhc0XPeWwPuzg&opi=122715837

URL: https://ad.doubleclick.net/pcs/click?xai=AKAOjsuKpYmR-MdH4N7k9DGoNi0YC9nJt6jqyzVxhxQ78aSSBCCrrkjPBqo2oAuuOsikkBnGDn4w3qeNdcDMkY0wV5uyMKa-gJwrCRXsjEGNuBo7M-XL0j3oSWHIogoiVPr7fHqOf1GCWHpJZole4vSNfp-sAo_I-QB72XcFogHIbK-i4Zpby07RQpJyidgXGHzsFCUGli_6vWclS5eueJNWLD-pttdQTRuAj1J758krlETPv3jyQpESoqbjZVLei0wG85HIRRRxE259YwiHrAAA53UcowQpfbhu7S7rOfqSXdRXpjd-oQ-xnOt9jKEmdsSmEjAlYlv8MuU_Pzed8fW_Us8kg8Ubm6C0CB20jqM9t6b1TTGXJ_Wye9l89pkvwF4_jeUfLmmIeIzpEfz2CQzxSPLrlC-F94iz46xphrrURW_KKTuKTtFEy2EdzxyJe5ek69zJaae0G5thKwi6jaz3VS0s8tbio9NeNnv0Daj_9qpHUwQgj9ZuSR1do2VtxxZAfRH2NCt8kSYF-Bxl87Av7jX_bYWhgaDoeBpuFj_LC3qdHRqfKmJbgprOd-zR1mXb_t95BP-Vusf4cV0Hg7vGO7idOU2j7H_yobidFoOpXqJ0kCZmaKq6A2pjQWiqePsVFsHKKCXwdcBS3rpXRtXM6HU4foDKg6JifHagerDiI_3azxdmHJjzoBYCK-Ja0wwbLfkf8y9fUlDgsD-nBilmevF8x0eQ-c2GxQeeJkzkq3ioYi3X-tX3oixyMNxQB4zuBZECL-upTGmzsr_O1P31qtnQ870rAnhHXChAv7qUB_pRVzbeBpwy2pEsFvgWXrPzSeMD31DExR6v3wY2fsOoUFoZMRv1NLOCYsSx7knXxiRYzYmdyWg8_5Pp4r0ziBC6slnqXAgn82j_cwiSJQM3jazoh5g0-TBh2mtOMBIOJ3g3s7XOVxE1ufuspiDg5YjigE1WI0XPPnxE3MLHQcDPjOVUW1x_eeENLURqQd_K3mrSIzcrSzDOu6i_ywELLnbUZNpagGlYz7ebBnzvJTa19SXlQZXM53GIaqDagCW6iyvoyesFvzxZt9JlchZcMbVthB6553MHYcV4tTUOCwdv-QRQMaWmbcCYAGQHBhxXVUTB3bwzdonxHqnQ7uQ0l-WHuJ2Y8KqECb8ypmzr4uG0IUrZQ5z2-FLjAgZ0ICC5a1sPrLcx9HSqZ4HTPcQoRLheeMOEMCuVMHQwT17Ji6zsYB7sOpuG2hp7PXhxvL6PafWJ_ft_wwNqMOl8OzohX_qDvmzpePCdrWOlXPxbnFY-alo-W_4KePwfe1HbwGplBcqKJu3wA62o7HI3vSJkF2OI2Ga7TyC79I24nwxcxC-MDfcKFRkuD65ZggBiK6dxJello5oSK3obv6NeRzmj349Ec48HTKrHshpkTuVcBVF4KOu4gzb7fT6HSRQnGoZrY82Tl4Ud0bjsfpZOsNA-BLh4A4H9fuCHAgVP51L_iSPfEbcEkIVrBS5okfam1rMbnj2M2gMbzbYFpktPAEHpYx2swCUIOvWGtSVoGml3-hx2SNmfjJ2_x95VLZvZkZYsr748HOKJ58uZPpD6_Zn-WO9ET8x9kmBr3DhTMg827mvy4izRRez1jNSgF4qcCsPVh9MjGGXFmozCaSjsN3KJMaQKRpN562wephgrONlb3zqlyOf04i3cJueLmyRtSTMzrSG3pevM4i66eVMLoD0zEpceeqxQSaKh3FKb8Oo1nNE3RrtBCj4P9NRbqzoxhaEcZ70Zh4kwWaHZWPL3eY2FUlR039qZKdDIVA&sai=AMfl-YQ5sZNHWRFlRpOJgi52d5vqh_Wk1LoC3wzvTpr2lVimeWWMorYYTJkjvoeq00VE-w168s1R5OlvqmhseoaC9lx-CGs7WDSOElojJHbChIW7ULmpoCJBM6pkCFjN5ZbKqMhHLtET_UCPy05nEgbP72eycYVSkeVzUAHVk6YPipXS-DVdGH4xGobo2_YPmtmHs0HzfCLuTbSmyR7Iol_ksd-8uhdYt3pMozTc7oQ4oUaP1c3Y1IbrF-MUFABE1ejxINuPo_qC8p3tB8dbHjoItXfTPu4arKktmxzF4zRn6EKVNiKxHzgqAKPn0V1fbKQGWhYdxeCfMz0LdAQ2mEOQR4ie0xpH6rLmLWHHhjWb72VOTuNE-h6Uw5b-x_OhUkBmpIs4R3bXAsyZmMAI63bPswky5dtlZRxvW7QIDll14TV224TiQBpPxZo_DzEWKeFZo6Gd64ng2z_qXnN-uYqNGO79juexFd0mYQb1qd9wpIaiRa4d_INfyFEwvqmVWfnRv1EnKVH3XMbXKe9rCH61HETGfUi8mwlSlEHy-tL9hmURo9tDRnoa3CTV7aLePoLrVHmYRyNJpaJmKiyo6fup2UZCU1zoDZzSzU7miFbpJFY&sig=Cg0ArKJSzLBG06Xsp2R6&fbs_aeid=%5Bgw_fbsaeid%5D&crd=aHR0cHM6Ly9zaGFuZ3JpLWxhLmNvbQ&urlfix=1&adurl=https://www.shangri-la.com/shanghai/tradershongqiaoairport/%3Fenrolcode%3DSLC-PAIDMEDIA%26WT.mc_id%3DSlim-SLIM_202511_TW_DI_DVI_TAC_PT-Shanghai-Business_HQ2025-RMBK_EN-Banner-thhq-plan-foodlover/

URL: https://adssettings.google.com/whythisad?source=display&reasons=AQde936XvgwEVKF_G5d2qnMZSzGAf1TOCo0pIYYKWSHEskuJyadD6oQoxgvq-m7l3XT8c6XdddqHV7hbqmy7TxphPdd4JBSwVpyzn0EDAeDRDPYhf8Ykby3UAH4JFfWySmpY6g3ukVZl100D5gw7yhLCtrAaWLNa3zrDD-Vh42Sqju0Z1YOHPlqSq6xHuP0xxag5CrgU-_nCM4WQIuM1PEVjEO3F1fIjdheIZy9B_OUyfIYet-G8J8S1HQOgEiugbQETez-XafV4VLrOI4K_Bb3JsoypfA86WbZ8VqIq3iQjOouFMLuGQcF8hb4rxUOxAL7eDSZQ5DZtYSrafZsebhuPoOXKzlFXotwMSwhYoSN3cLzHjXm0iTHLMAShNCZKhTu1lI1ZVoiUdv3rgtrJeFlNlZo-yZgGKR3GEsivfmMa2lUaeLSIoiTiUTwYeizGhucaLjJtvBuSVKn8uwAzWE2_diG7hdsEPS2SlgYYPIFJ_yK0qCAvR_CkIEGWYcbi-ok2HokFwzHqW7m80dGAtALXKbrRRmv0d8c9xsbwSkusnQYJ4v6QFZ5FP8zQHQSxpK4JsrOBas8NrA5dTT6cQCG78LM46ekebc3D5HYnHzVeqbRIU0KhhDH2ULu5td54rQKBbSgY1aXNVqnt9n3pWh-avNrz-2ilrBjj_4i3lHegHWP9t3iXsh-Rfxpp3OLVd2WKmKSF6v6GE92D-0UbKzJHMQLIdOy8tGk8RmNWWsJB7zk94fCD5McD1YQlqFTChN0XkvBGbbT2p8s5lwcqq_DOGVue-lGNcjJ9NAX2HYKc32EpRlpFNnHyVuFuffu1P6A8hTnBvsIH9LxORJ333oFJU84hXxyBFOe7BCemAsgderOCcaTxot0JI0LvlpxJzm23SF9pdpDxlJg_qgrLdjt7K2QJpV9fggCzenWQrJExsjeirQa54SRcOviwcRqzrytdTuHp57e8SakjxfB2iqb2dVxRPaETqjsQylrxI64eDQ_nod3pZCixSDskQ5unpo2sC7Zk_G6-Iego3_IcggDz0Vk5mtZ8ZkZ9myeaULm0JHUVtHxyOKgYlBoC47-ysEMRpXhdUQdwOZJeoKI_X9mKyXRor-Twq5uqbnLL9AwVjb-KR5DBYtopN4c8mvg3tKZBmDXB1Ix7adeWR5LJptF8zvBPujoXeXTJOJ2jikSATYzPz9R8cAU2NrW7fR2DP5xYQkTFiI06PjOPH-jH1quFr4iBoIgzsH684ch24rvSfFqZJSBqO1RPW9lZOM0vCbfnH12-e4xh2cgNHO5reekob_bXSPvvuwR3Up5kfLMEV15U6Mfya4owpXKR_5gLAlOxvWSuhuoHK1mQtq7py4sWh7fx_X0ZmLGRoqtJrq3IAI0FoA64TALkR6fU7lNKDV0lB09HayhKwNUOCeEPLPxIvmz1EuIaEPjoPoWP4ZdH7bH006JD1LoN7VanscddZ3F9Nc-VLnOZh5glf9Wuq9J7i6tr4q44y2kd-ugi9TW6kGJ8jZFYs18gSdfROa_wwuNIZNOaw-nSA9saGhZq60xw9wbPqUfCgu7KYjE3cD4M7gMvY3P4fTOLIXhPWgYP_vhoULOvTYhNI317uErX7nNpLgY2In368m73kJFMSA_0mDKDuj3ZY-MeD3spg588AW02ub8Zo4lSLKLeQjy3-QHR844miSFG1Gb4Vtu9-BTfkEPaIZaSv4xOjqc8A6mURj0mR9ZJ5TtbbVjoYaocP_jqJiMkKBuctPPQnaDjH2FvDwbWEzS-aykH_WL-IM_mW3nDn0iRQ1jCBHWsD5JC4M1FNM_5ekzwdZccolTvpPI90arQQgvC40OCmUS9jGoVQtI4a4hP4IB0W3OWDf1WIOLd07m6jqoWf2cLW9v2FaG13pKR0oLgedr8lNN8dPH8LQJeYwNwvbSttaud7Wns4ZDSS_9-PTJ7LXjqNja6LWWeHoRHiDsVRDTIxVNODnJSww9obUZsLw8oBG-spWjfWS4oj5sye6LFyPIYsJwlsR_bextWpaE1mE3yeX2WpXuAfVcZv1zzrqRn7XgQgpuN-zID6o9SluZIuNOJDs9vKdWpHdX963LD3fXXURwyvDBc1pk9myL8pKAK1g

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://onead.onevision.com.tw/v2/pixel/ltm?id=552bfba3b35846ce8bc6cfcc159703ac

Request Chain 71

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://onead.onevision.com.tw/v2/pixel/ttd?id=9b8a2872-d43c-40bf-8ec4-c014894bc9b2

Request Chain 72

https://ps.eyeota.net/pixel?pid=3m51m51&uid=ce564343-cc43-11f0-b9bf-42010a000079&t=ajs HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=ce564343-cc43-11f0-b9bf-42010a000079&t=ajs

Request Chain 73

https://trc.taboola.com/sg/onedata/1/cm HTTP 302
https://onead.onevision.com.tw/v2/pixel/taboola?id=56bd6ae6-0c21-4792-9715-3b5ca47cd3d3-tuct1022fcd5

Request Chain 95

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 96

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

Request Chain 99

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 103

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

Request Chain 106

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 110

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

Request Chain 113

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 117

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

Request Chain 120

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 124

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

Request Chain 127

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 131

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

Request Chain 171

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=xTddEbsDCKafEuUiVXcpaQ

Request Chain 172

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=E36yg0FwAaOtC85kVXcpaQ

Request Chain 173

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid HTTP 307
https://ad2.apx.appier.net/v1/prebid/bid?acid=llhsfs2pDjG07wozVXcpaQ

Request Chain 372

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_cver=1&google_push=AXcoOmQgMA2VJvuXpNAsXiOVGQZmi7eP3E3FgnNNOd-QcJL-XwiPwZN-K4sp0tjGV-pPSGAnpMCAZrQGS3Auty3iRYEPrdteQ7KACK28qnkgJB9dtJ-Ta9rCK4ppFsXcIA_vcvc1RETEKZA-WIdWXVqLQYQU2Vk HTTP 302
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=1b7a846b53992112&is_secure=true&networkId=14000&version=1&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_cver=1&google_push=AXcoOmQgMA2VJvuXpNAsXiOVGQZmi7eP3E3FgnNNOd-QcJL-XwiPwZN-K4sp0tjGV-pPSGAnpMCAZrQGS3Auty3iRYEPrdteQ7KACK28qnkgJB9dtJ-Ta9rCK4ppFsXcIA_vcvc1RETEKZA-WIdWXVqLQYQU2Vk HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAKfwkudaeD5wJWgTbYAQEBAQEBAQCbyPs0TQEBAJvI-zRN&expiration=1764411609&google_cver=1&is_secure=true&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_push=AXcoOmQgMA2VJvuXpNAsXiOVGQZmi7eP3E3FgnNNOd-QcJL-XwiPwZN-K4sp0tjGV-pPSGAnpMCAZrQGS3Auty3iRYEPrdteQ7KACK28qnkgJB9dtJ-Ta9rCK4ppFsXcIA_vcvc1RETEKZA-WIdWXVqLQYQU2Vk

Request Chain 373

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEOqR6mdFOAnKBeetFWY-MWU&google_cver=1&google_push=AXcoOmRsnPDY2mjSoBw05oVhZE0Uz5BG79fW7_DmdM2EazVpCHMknL1dqH21DGS8HavD4n6hwH7Q9bWJLoA_0dxNKuQgPefM_fDBBa_KCeE4DLmVZHgHLdIR1TPRmvALE_WWozHpoauKukF0Aigi2AJfaC9p4S0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRsnPDY2mjSoBw05oVhZE0Uz5BG79fW7_DmdM2EazVpCHMknL1dqH21DGS8HavD4n6hwH7Q9bWJLoA_0dxNKuQgPefM_fDBBa_KCeE4DLmVZHgHLdIR1TPRmvALE_WWozHpoauKukF0Aigi2AJfaC9p4S0

Request Chain 374

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESELMBojeg_sd-xbmbcJ2fSIk&google_cver=1&google_push=AXcoOmSi-EuHDvLwvHnFbs5Qu3P5qYv-HX6Wd-K6OvlqVh-fIXSKQ7P0k8hrsxED4ffGIIYbfGcN6Ov8zmzWK5phqgPH4lgEbal0VeAZYEEUwQYlBO7IcglxysIXxR_qBwQOb1ZC5xZO5LnIym7oUR0gEU-KD20 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjI1OWU3MTYtY2RlNS00NmM3LTkxZGItZTEwZjE4MDNkMDQ2&google_gid=CAESELMBojeg_sd-xbmbcJ2fSIk&google_cver=1&google_push=AXcoOmSi-EuHDvLwvHnFbs5Qu3P5qYv-HX6Wd-K6OvlqVh-fIXSKQ7P0k8hrsxED4ffGIIYbfGcN6Ov8zmzWK5phqgPH4lgEbal0VeAZYEEUwQYlBO7IcglxysIXxR_qBwQOb1ZC5xZO5LnIym7oUR0gEU-KD20

Request Chain 375

https://a.c.appier.net/gcm?google_gid=CAESEGb8C6lTCrMQkAkWZpz1rdo&google_cver=1&google_push=AXcoOmRKu791M9QmYmTYcmBrbnLE8rZn34FVEqKCOJUAfT2QvpHfBEL00g4lmDODNCNvGQw8KgVevjAyf37p1C2nU0HzCyvdzSUaueQKng3V31oNfh_TYax9kzxFAat-0eoWwmQrTmo-fUGolF1mM-ixcYoadQ0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_hm=bGxoc2ZzMnBEakcwN3dvelZYY3BhUQ%3D%3D&google_nid=appier&google_push=AXcoOmRKu791M9QmYmTYcmBrbnLE8rZn34FVEqKCOJUAfT2QvpHfBEL00g4lmDODNCNvGQw8KgVevjAyf37p1C2nU0HzCyvdzSUaueQKng3V31oNfh_TYax9kzxFAat-0eoWwmQrTmo-fUGolF1mM-ixcYoadQ0

Request Chain 376

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQyVwshbXPA-9sFRZzZK1lHxoqyL6zPoU51wYRbeDAlw0TWIxkg8YwR2W9rXMeGm64jPNY0_P5FRkwYGdxOtzO9w1TFqF3ttUrYxhl3ROdAv_57DH518fTkOz4CQBwogkBmDZgg9ErWraH6phAjw0eFlHg&google_gid=CAESEJwxrvxaooaWds0pg_Be73M&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1OREQ3ckJHd3ZMVEcxOXdnVjBzMm5BU3NVMFdHZzRHOXVSVWNtUQ&google_push=AXcoOmQyVwshbXPA-9sFRZzZK1lHxoqyL6zPoU51wYRbeDAlw0TWIxkg8YwR2W9rXMeGm64jPNY0_P5FRkwYGdxOtzO9w1TFqF3ttUrYxhl3ROdAv_57DH518fTkOz4CQBwogkBmDZgg9ErWraH6phAjw0eFlHg

Request Chain 377

https://pixelfnt-us.dsp-api.moloco.com/v1/cm/adxpm?google_gid=CAESEOo7oS98w6BhGY3d-pRD3sc&google_cver=1&google_push=AXcoOmQ07N42cRWOnOhgOaPSVJA9GEo56cE6j6q_BoQTDaaUy5nL4GhZd-1Gg9XovzKhSu3Z__8UOlqt8P8o1_3MST9N09AFGD_MG2G7-jQDlmoPso6TGqjwwyeOMSvphbQDnW4y0ByTDqwOPxzA7mnB482v1MI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=-tAJHr2-SHiaAXKEk94CIg&google_push=AXcoOmQ07N42cRWOnOhgOaPSVJA9GEo56cE6j6q_BoQTDaaUy5nL4GhZd-1Gg9XovzKhSu3Z__8UOlqt8P8o1_3MST9N09AFGD_MG2G7-jQDlmoPso6TGqjwwyeOMSvphbQDnW4y0ByTDqwOPxzA7mnB482v1MI

Request Chain 378

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESEJrJYcAsFviXhx-r8-9gv_0&google_cver=1&google_push=AXcoOmSD_tah0VDokYdSre-X8XKdOD8_pU40xZFd8FK6FbjVxv8p7zUBlZmnSHCLWFjgMRZ5PiFIWN6fh9gBGvJlB-7UTs2teX9uqOwL-qGzH6E5OEV0rvCcP3HmnVpvV6E-LRTPpms_z3wyboNyYV_DRjoKTUx2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSD_tah0VDokYdSre-X8XKdOD8_pU40xZFd8FK6FbjVxv8p7zUBlZmnSHCLWFjgMRZ5PiFIWN6fh9gBGvJlB-7UTs2teX9uqOwL-qGzH6E5OEV0rvCcP3HmnVpvV6E-LRTPpms_z3wyboNyYV_DRjoKTUx2&google_nid=whaleco_services_llc

Request Chain 380

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1&gdpr=0&C=1

Request Chain 381

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aSl3WBdaRKwAEkFYBD2RBgAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1

Request Chain 382

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESELHJYbUwo6V-zQOHft70vDE&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESELHJYbUwo6V-zQOHft70vDE%26google_cver%3D1

Request Chain 383

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26gdpr%3D0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQxMTc1OTA5NDU2Njc1MTM2OA%3D%3D&gdpr=0

394 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request NNrq69 Show response
reurl.cc/ 16 KB
5 KB 143ms
66ms Document
text/html 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: f397ff857e92a9e0aa44ab7fe57f66df91376054d29a2a6f45f10cbca60f323e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 28 Nov 2025 10:20:03 GMT
Server: nginx/1.22.1
Transfer-Encoding: chunked

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/ 152 KB
26 KB 260ms
93ms Stylesheet
text/css 151.101.65.229
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/bootstrap.min.css

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"2606e-bhA1SChFSJj9qA9V897LNH/Z7SE"
age: 2070190
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-etou8220110-FRA, cache-nrt-rjtf7700103-NRT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25648
x-jsd-version: 4.3.1

GET
H/1.1 200
OK style.css
reurl.cc/asset/stylesheets/ 6 KB
2 KB 69ms
67ms Stylesheet
text/css 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/stylesheets/style.css?v=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 351966dece7214af3b43d9a94f07c1c936176ad5dd81f0bbe1f6b319b4cd96d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/NNrq69

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800
Content-Encoding: gzip
ETag: W/"69159a16-16bb"
Connection: keep-alive
Expires: Fri, 05 Dec 2025 10:20:03 GMT
Date: Fri, 28 Nov 2025 10:20:03 GMT
Content-Type: text/css
Last-Modified: Thu, 13 Nov 2025 08:43:02 GMT
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H2 200 ats.js Show response
anymind360.com/js/9479/ 380 KB
114 KB 262ms
95ms Script
application/javascript 151.101.193.55
FASTLY

General

Check archive.org

Download Go to

Full URL

https://anymind360.com/js/9479/ats.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.193.55 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a7c26694861bbd926c7d903f707b406aa8eaa6a5065a3acb6c8e0028e8eaee6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=+l4scw==, md5=RPhira7MebZTO3yL8IH51w==
etag: "44f862adaecc79b6533b7c8bf081f9d7"
age: 128346
x-goog-stored-content-encoding: gzip
expires: Wed, 26 Nov 2025 22:40:57 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-goog-stored-content-length: 115683
x-cache: HIT, HIT
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 23 Sep 2025 04:37:48 GMT
x-served-by: cache-tyo11968-TYO, cache-nrt-rjtf7700107-NRT
x-cache-hits: 668, 67
x-guploader-uploadid: AOCedOGf1ZQMho-zWKQck39JqckhmH5j_MpvIS7m8hlb3DUAPaxRIkl1d4fzkLQ7gCd51T31
strict-transport-security: max-age=31557600
vary: Accept-Encoding
cache-control: max-age=1200
x-goog-storage-class: STANDARD
x-timer: S1764325204.159126,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1758602268219650
content-length: 115683
server: UploadServer

GET
H/1.1 200
OK clickforce_anchor.js Show response
reurl.cc/asset/javascripts/common/ 1 KB
907 B 36ms
35ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/clickforce_anchor.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 873b90cdbff7dcb26e9ea34c647a5d15e83daecca768a816619dd38a503c09b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/NNrq69

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800
Content-Encoding: gzip
ETag: W/"687f3443-4bf"
Connection: keep-alive
Expires: Fri, 05 Dec 2025 10:20:04 GMT
Date: Fri, 28 Nov 2025 10:20:04 GMT
Content-Type: application/javascript
Last-Modified: Tue, 22 Jul 2025 06:48:35 GMT
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H/1.1 200
OK pixel.js Show response
reurl.cc/asset/javascripts/common/ 470 B
792 B 37ms
37ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/pixel.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 6e9ab8ab1d57a0695a66577e348ae4343e1a92f70cb4835a52c4863f11114037

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/NNrq69

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-1d6"
Connection: keep-alive
Expires: Fri, 05 Dec 2025 10:20:04 GMT
Accept-Ranges: bytes
Content-Length: 470
Date: Fri, 28 Nov 2025 10:20:04 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H/1.1 200
OK ga.js Show response
reurl.cc/asset/javascripts/common/ 566 B
888 B 41ms
36ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/ga.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 3774a7ce325859b32b6b0b01bde2879c75b81131fafe4a584b18b744711bd75d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/NNrq69

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-236"
Connection: keep-alive
Expires: Fri, 05 Dec 2025 10:20:04 GMT
Accept-Ranges: bytes
Content-Length: 566
Date: Fri, 28 Nov 2025 10:20:04 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 430 KB
145 KB 403ms
195ms Script
application/javascript 142.250.194.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

828b4b3954c817fef1444857f9e3d0fa5d96d9bdc7a24fc48210984731db8900

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 28 Nov 2025 10:20:04 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148285
date: Fri, 28 Nov 2025 10:20:04 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 491 KB
161 KB 363ms
157ms Script
application/javascript 142.250.194.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

203-66-35-130.hinet-ip.hinet.net

Software

Google Tag Manager /

Resource Hash

6846bc2cfb6755ae4f8d084a6e3269f261af7804a6a34e4b5a1204a0cf15977a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 28 Nov 2025 10:20:04 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164524
date: Fri, 28 Nov 2025 10:20:04 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ 9 KB
10 KB 309ms
125ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ab187b70940d331c60646d5731fa8e86d6958ba69dfa241361e39d30d81c2d31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: PKBfBRh_ckEc5dxIcFkl8Hvvqrcpi_Dy
etag: "daceea64521f6f981e4b58edc119028a"
age: 14
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9646
x-amz-cf-id: yGXCZRjVVvn8eSvhgsFeVnWEpY6T92HZM4-kNi3A8XjLy3PJjHNy1A==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Fri, 09 May 2025 03:01:34 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ad-serv.min.js Show response
ad-specs.guoshipartners.com/static/js/ 52 KB
17 KB 194ms
44ms Script
application/javascript 203.66.35.130
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

203.66.35.130 , Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

HiNetCDN / OneAD

Resource Hash

57e3fef09cab4680c25c4a06c9c1ce195325f5d502d4d75b5d53a7c2f14e2916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: W/"68c28bcb-cfd3"
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
x-varnish: 24594342
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
last-modified: Thu, 11 Sep 2025 08:43:55 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 onead-lib.min.js Show response
ad-specs.guoshipartners.com/static/js/ 25 KB
8 KB 228ms
78ms Script
application/javascript 203.66.35.130
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://ad-specs.guoshipartners.com/static/js/onead-lib.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

203.66.35.130 , Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-66-35-130.hinet-ip.hinet.net

Software

HiNetCDN / OneAD

Resource Hash

620a382665ff035abb643a19e12f088aef2bc27b55398d4ae3f131b773be6355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: W/"68c0e8bd-65e4"
age: 215
access-control-allow-methods: GET,POST,OPTIONS,PUT
x-varnish: 211803548 198252224
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding
last-modified: Wed, 10 Sep 2025 02:55:57 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 vue.min.js Show response
cdn.jsdelivr.net/npm/vue@2.5.16/dist/ 84 KB
33 KB 65ms
62ms Script
application/javascript 151.101.65.229
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.5.16/dist/vue.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"151b4-KLsckeN7U/TrtIzkgtzLJAAD4Hg"
age: 1307337
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230088-FRA, cache-nrt-rjtf7700103-NRT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33184
x-jsd-version: 2.5.16

GET
H/1.1 200
OK renews.js Show response
reurl.cc/asset/javascripts/common/ 690 B
1012 B 37ms
36ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/renews.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 100d72a28123bcee974e8642b8bf1c0865bf1034c9b59f59597d53809e192fdc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/NNrq69

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-2b2"
Connection: keep-alive
Expires: Fri, 05 Dec 2025 10:20:04 GMT
Accept-Ranges: bytes
Content-Length: 690
Date: Fri, 28 Nov 2025 10:20:04 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H/1.1 200
OK loading.js Show response
reurl.cc/asset/javascripts/redirect/ 240 B
561 B 62ms
61ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/redirect/loading.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 25355805f44af99037c6b951f9afd762f5fd74eb126aba4b2f82cafa563c0f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/NNrq69

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-f0"
Connection: keep-alive
Expires: Fri, 05 Dec 2025 10:20:04 GMT
Accept-Ranges: bytes
Content-Length: 240
Date: Fri, 28 Nov 2025 10:20:04 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 105 KB
34 KB 261ms
124ms Script
text/javascript 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: anymind360.com
URL: https://anymind360.com/js/9479/ats.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f95a4fc0dc57f84954907d7ad02624f85dc4134c0df86e6b9ac1bc42d51bd62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 670 / 20420 / m202511120101 / config-hash: 14247479607061606112
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34314
x-xss-protection: 0
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 422 KB
143 KB 353ms
148ms Script
application/javascript 142.250.194.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1fbec17555f6b2eb9d414224cafaef5566cb9abaeeaa5e536f219e06b0db491c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 28 Nov 2025 10:20:04 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146332
date: Fri, 28 Nov 2025 10:20:04 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 oid Show response
onead.onevision.com.tw/v2/et/ 370 B
1 KB 139ms
62ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://onead.onevision.com.tw/v2/et/oid?cb=window.text_etag_callback_3xh6o

Requested by

Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

gws / OneAD

Resource Hash

ca483c394e5f951efa46f10062551346ff8eb630a3a60aa2a264749aaab8e316

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
etag: ce564338-cc43-11f0-b9bf-42010a000079
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 561821
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Fri, 28 Nov 2025 10:20:04 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=600
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 370
x-onead-backend: onead-http-event-1cb4-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 325 KB
84 KB 133ms
65ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/pixel.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-OYf5TX0w' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-OYf5TX0w' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=4980, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: AC18f7SelgyKBXOegBwL+tRxLHQuv5LhzIYrRWygG10gYJA0j388sthEp8l/j3wk6GhbQj7BdoY/LYdf/jRSyA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 311ms
105ms Script
text/javascript 142.250.196.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/ga.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.196.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
age: 6254
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:35:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 08:35:50 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20737
server: Golfe2

GET
H3 200 page.php Show response
www.facebook.com/plugins/ Frame B1C4 41 KB
13 KB 321ms
253ms Document
text/html 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

15c12350fa0c59d455cdd5e2ee7bc0f88e47be1800517d4b56eff8a5a4870637

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-5uu7lh16' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-5uu7lh16' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:04 GMT
document-policy: force-load-at-top include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719052751476328&cpp=C3&cv=1030417076&st=1764325204605"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719052751476328&cpp=C3&cv=1030417076&st=1764325204605"}],"group":"network-errors"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7577719052751476328&cpp=C3&cv=1030417076&st=1764325204605", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=4929, tp=8, tpl=0, uplat=190, ullat=0
x-fb-debug: rDK0d+At6GHQaFCvkCYxVCuz1TS5OxAvBJWCajRUSqdCReuEN0qhNArWv29COWc1AtSP+vDwhzEnPdP4vAY0Kw==
x-xss-protection: 0

GET
H2 200 feeds Show response
re-news.tw/ 5 KB
3 KB 178ms
65ms XHR
text/html 35.185.136.122
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://re-news.tw/feeds
Requested by: Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/renews.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.136.122 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 122.136.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 105934ac22e27118d549ed86f3e7d09c23938aa2e5cf72185061ab559464395c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
etag: W/"1554-mKBrDEf+FEFGC0ahXZVoEkKwGM0"
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
server: nginx/1.18.0 (Ubuntu)
vary: Origin

GET
H3 200 keywordCategories.json Show response
anymind360.com/ 148 KB
60 KB 127ms
63ms Fetch
application/json 151.101.193.55
FASTLY

General

Check archive.org

Download Go to

Full URL

https://anymind360.com/keywordCategories.json

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.193.55 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

9aa92a9a076fd2e55f339cd82c8b540e96ea0a4e4c7c12da6602edfadf2a0819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=hYq3+w==, md5=ZJdPIhH4R+FB2zz6x81gJg==
content-encoding: gzip
etag: "64974f2211f847e141db3cfac7cd6026"
age: 51142
x-goog-stored-content-encoding: identity
expires: Wed, 27 Aug 2025 11:36:24 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-goog-stored-content-length: 151503
x-cache: HIT, HIT
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/json
last-modified: Wed, 27 Aug 2025 06:51:59 GMT
x-served-by: cache-tyo11981-TYO, cache-nrt-rjtf7700095-NRT
x-cache-hits: 200026, 7844
x-guploader-uploadid: ABgVH8_WbYCDB2LaOxaydMbIBmzZEeTdmD__y3SdRPYQiipklanNaJ-DP_0DBH49PGWyFZEEI1nzUSM
strict-transport-security: max-age=31557600
vary: Accept-Encoding
cache-control: max-age=1200
x-goog-storage-class: STANDARD
x-timer: S1764325205.568941,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1756277519403323
content-length: 61163
server: UploadServer

GET
H2 200 adsrv Show response
onead.onevision.com.tw/v2/ 176 B
478 B 153ms
152ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://onead.onevision.com.tw/v2/adsrv?version=20250516&uid=1000480&category=-1&cookie=true&ip=&guid=ce564343-cc43-11f0-b9bf-42010a000079&channel=0&volume=0.5&r=&adid=&response_freq_multiple=native-drive.0&web_location=https%3A%2F%2Freurl.cc%2FNNrq69&title=reteam%27s%20Campsite.bio&fp=b9dd8c3d3e5883a5c65bcadce069a4e9&_t=1764325204557&cb=ONEAD_text_response_3xh6o&pb=0&spid=&player_type=NATIVE_LIST&bgid=0

Requested by

Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

xx-fbcdn-shv-02-nrt1.fbcdn.net

Software

gws / OneAD

Resource Hash

ebef1f1b51593eeecaac3f8a3994b602a4dfedf8a92f0f904066ef3f3f3af37b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 182171772
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-onead-guid: ce564343-cc43-11f0-b9bf-42010a000079
x-onead-force-backend: false
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 176
x-onead-hit-counter: 1
x-onead-backend: onead-http-query-fvn0-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 1764323595-29b7b23631db049d43716cb16d4ca31a-840x525.png
img.gbyhn.com.tw/2025/11/ 548 KB
548 KB 88ms
40ms Image
image/png 104.21.96.9
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://img.gbyhn.com.tw/2025/11/1764323595-29b7b23631db049d43716cb16d4ca31a-840x525.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.9 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdb0de47ae1b8fb74591873384f7c81d22af3ab6afc5f5f1dde7266a8039dc8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: HIT
age: 1186
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VHohW8MuU17u%2FZmYZF89JN%2BDyD%2BP3KVfRQsAIeci1V5wPutDSz8WSkBAX2sX0zocJuTP0goxMcB0LKV1p3Ks88DEZ4haNhfUcW%2Bmuvp1"}]}
expires: Fri, 05 Dec 2025 10:00:17 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: image/png
last-modified: Fri, 28 Nov 2025 09:53:15 GMT
vary: accept-encoding
priority: u=1,i
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9a5921719bc54a33-TPE
accept-ranges: bytes
content-length: 560907
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET
H2 200 image1.jpg
mma.prnasia.com/media2/2832553/ 27 KB
28 KB 158ms
50ms Image
image/jpeg 104.18.95.225
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://mma.prnasia.com/media2/2832553/image1.jpg?p=medium600
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.18.95.225 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / ASP.NET
Resource Hash: 660a2f783da28ba2b3a0202dff4f7fb4170f7788f36bf3612093c460877cbf0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-bgj: h2pri
cf-cache-status: HIT
age: 24898
access-control-allow-methods: GET, POST, OPTIONS
expires: Fri, 28 Nov 2025 03:25:07 GMT
server-timing: intid;desc=c1d144d3035d4614
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: image/jpeg
last-modified: Fri, 28 Nov 2025 03:25:06 GMT
vary: *, Accept-Encoding
access-control-allow-headers: Content-Type
cache-control: public, max-age=1
cf-ray: 9a592171fa50075c-TPE
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27704
x-powered-by: ASP.NET
server: cloudflare

GET
H3 200 result_MYSTIC_7c569db7-8e1f-466a-91c6-947fba193c11_0-390x220.jpeg
nearbymed.com/wp-content/uploads/2025/06/ 12 KB
12 KB 85ms
42ms Image
image/jpeg 104.21.25.44
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://nearbymed.com/wp-content/uploads/2025/06/result_MYSTIC_7c569db7-8e1f-466a-91c6-947fba193c11_0-390x220.jpeg
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.25.44 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00e9976e95e4812f88eea643f29e77485729f43c45a04a83ce0e2d054bf286b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: HIT
etag: "68d811d9-300d"
age: 163053
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6WquPREK0WvVSq3hDdHbULBAWo%2B5ApVf%2F%2F7pm%2BLnmwCwLmRPl4M6VYiwH3eR5FPuh8UdvoIkHHjjMtKeU3ib7kkUpP7UYcb%2F4bMR"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: image/jpeg
last-modified: Sat, 27 Sep 2025 16:33:29 GMT
vary: accept-encoding
priority: u=1,i
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9a5921719b454a6c-TPE
accept-ranges: bytes
content-length: 12301
server: cloudflare

GET
H2 200 2025112713111155.jpg
img.racingcharger.tw/wp-content/uploads/2025/11/ 83 KB
83 KB 175ms
67ms Image
image/jpeg 103.1.220.9
YUANJHEN-AS-TW Yu...

General

Check archive.org

Download Go to Show image

Full URL: https://img.racingcharger.tw/wp-content/uploads/2025/11/2025112713111155.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 103.1.220.9 , Taiwan, ASN131149 (YUANJHEN-AS-TW Yuan-Jhen Info., Co., Ltd, TW),
Reverse DNS: ph2.g-dns.com
Software: Apache /
Resource Hash: a2edb0e5be7dcedbde0f8ca7c8468f70d5ed6e4a8510390a136fe41214762bca

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

accept-ranges: bytes
content-length: 85144
date: Fri, 28 Nov 2025 10:20:03 GMT
last-modified: Thu, 27 Nov 2025 13:11:01 GMT
content-type: image/jpeg
server: Apache

GET
H2 200 2024-%E5%9B%9B%E5%A4%A7%E8%B6%85%E5%95%86%E6%8E%A8%E8%96%A6%E4%BF%A1%E7%94%A8%E5%8D%A1-1080x630.jpg
creditcards.com.tw/wp-content/uploads/2024/02/ 49 KB
50 KB 224ms
78ms Image
image/webp 192.0.78.25
AUTOMATTIC

General

Check archive.org

Download Go to Show image

Full URL

https://creditcards.com.tw/wp-content/uploads/2024/02/2024-%E5%9B%9B%E5%A4%A7%E8%B6%85%E5%95%86%E6%8E%A8%E8%96%A6%E4%BF%A1%E7%94%A8%E5%8D%A1-1080x630.jpg?crop=1

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.78.25 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

Software

nginx /

Resource Hash

e0caaaf1452d601fb0974ec42a0c5737e7c30261b8ad6600e2208793db37330e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

etag: "6472bb09871fae99"
x-content-type-options: nosniff
access-control-allow-methods: GET, HEAD
expires: Fri, 18 Jun 2027 16:14:31 GMT
server-timing: a8c-cdn, dc;desc=bur, cache;desc=HIT;dur=1.0, a8c-cdn, dc;desc=hkg, cache;desc=HIT;dur=1.0
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: image/webp
last-modified: Wed, 18 Jun 2025 04:14:31 GMT
vary: Accept
strict-transport-security: max-age=31536000
cache-control: public, max-age=63115200
timing-allow-origin: *
x-nc: HIT bur 5
access-control-allow-origin: *
content-length: 50526
x-ac: 29.hkg _atomic_bur HIT
server: nginx

GET
H2 200 renews-title1.png
re-news.tw/images/ 24 KB
24 KB 110ms
39ms Image
image/png 35.185.136.122
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://re-news.tw/images/renews-title1.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.136.122 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 122.136.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

accept-ranges: bytes
content-length: 24493
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "61a30347-5fad"
content-type: image/png
last-modified: Sun, 28 Nov 2021 04:19:19 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 file.png
static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/ 1010 KB
1010 KB 156ms
70ms Image
image/png 3.166.244.71
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 3.166.244.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-166-244-71.nrt20.r.cloudfront.net
Software: openresty/1.27.1.2 /
Resource Hash: 76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-cf-id: IY4rsuTUbpkO5mNTAVc5JAsbKEUjYr-7N4F-DK8jzKKNlQ65j6Vygg==
cache-control: public, max-age=2592000, immutable
timing-allow-origin: *
age: 2171451
via: 1.1 google, 1.1 eb7faad23f4d7ee01418be618b555b1c.cloudfront.net (CloudFront)
x-wixmp-trace: projects/wix-media-infrastructure/traces/34xSVXowVyMjEIEh2ZI2BSvPMvt
access-control-allow-origin: *
x-seen-by: image-manipulator-d5d5b748b-pkxxt
content-length: 1033732
alt-svc: h3=":443"; ma=86400
date: Mon, 03 Nov 2025 07:09:13 GMT
content-type: image/png
x-cache: Hit from cloudfront
server: openresty/1.27.1.2
x-amz-cf-pop: NRT20-P6

GET
H3 200 1675200226052423 Show response
connect.facebook.net/signals/config/ 100 KB
25 KB 64ms
64ms Script
application/x-javascript 157.240.31.5
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1675200226052423?v=2.9.243&r=stable&domain=reurl.cc&hme=fdfab1132115f4ac7aabc9fd7eee63947594f6e6f1735b47a225dd71217525d3&ex_m=89%2C147%2C127%2C18%2C65%2C66%2C120%2C61%2C41%2C121%2C70%2C60%2C134%2C78%2C13%2C88%2C26%2C115%2C108%2C68%2C71%2C114%2C131%2C97%2C136%2C7%2C3%2C4%2C6%2C5%2C2%2C79%2C87%2C137%2C214%2C158%2C55%2C216%2C217%2C48%2C173%2C25%2C67%2C222%2C221%2C161%2C28%2C54%2C8%2C57%2C83%2C84%2C85%2C90%2C111%2C27%2C24%2C113%2C110%2C109%2C128%2C69%2C130%2C129%2C43%2C53%2C105%2C12%2C133%2C38%2C203%2C205%2C168%2C21%2C22%2C23%2C15%2C16%2C37%2C33%2C35%2C34%2C74%2C80%2C82%2C95%2C119%2C122%2C39%2C96%2C19%2C17%2C101%2C62%2C31%2C124%2C123%2C125%2C116%2C20%2C30%2C52%2C94%2C132%2C63%2C14%2C126%2C29%2C183%2C154%2C275%2C201%2C145%2C186%2C179%2C155%2C92%2C112%2C73%2C103%2C47%2C40%2C102%2C107%2C51%2C58%2C42%2C98%2C46%2C49%2C45%2C86%2C135%2C0%2C106%2C11%2C104%2C9%2C1%2C50%2C81%2C56%2C59%2C100%2C77%2C76%2C44%2C117%2C75%2C72%2C64%2C99%2C91%2C36%2C118%2C32%2C93%2C10%2C138

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.31.5 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

40eaab61bd7f8b876f54d3cf16fda515c06a2b41544bd9ebf7fb7b6b75938558

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-m7OC9daN' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-m7OC9daN' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=98, mss=1232, tbw=96410, tp=87, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: QVEKDNMUZUT1ZwCjrilHX45BjqAfl9RTXpMOJedX2KSjbA1PZbNVBa4unm5Ea1HYb8izekdp1Qety0cwyYkKWA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 25503
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame AE3B 12 KB
12 KB 278ms
121ms Document
text/html 3.164.121.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-96.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 55
content-length: 12184
content-type: text/html
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 4c8c55ed7c98d423d22ae4c088f8ff36.cloudfront.net (CloudFront)
x-amz-cf-id: u8ffyrbiNuFIZFIVvNcOMTX6fqetdcjRTBwTNTlZ7rR8-wFmHWYq2w==
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame EAC3 11 KB
11 KB 73ms
73ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame C3C5 11 KB
0 70ms
69ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame AF89 11 KB
0 65ms
65ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 8EF7 11 KB
0 61ms
61ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame E09D 11 KB
0 57ms
57ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame B83D 11 KB
0 53ms
53ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame EFE4 11 KB
0 47ms
47ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame DD91 11 KB
0 43ms
43ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: _DptxoaH9jonB3cA0WKyrC6iu3lwn-4jCOTYIsYhjCvEj4yehSSATg==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 iXGJEr7Orjl.css
static.xx.fbcdn.net/rsrc.php/v5/yE/l/1,cross/ Frame B1C4 20 KB
6 KB 136ms
67ms Stylesheet
text/css 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v5/yE/l/1,cross/iXGJEr7Orjl.css

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2a4c7b96514bcf9e8548de41d1fd7b0fa727ae09136bcb61273bf298c7ed67e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: BDmd8A+PMKI6MSceqiBEXQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 25 Nov 2026 02:26:06 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: siY1TCVBzKVkiBca4LDKTYZ4s9UrIf1nCWRzAw2G2Col8Cim1uWHUIeL6mS/5TlWqgKXw0++m3+oZCAEMXD/3A==
priority: u=0
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=5216, tp=14, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 5635
origin-agent-cluster: ?1

GET
H3 200 8WauLuHIUmG.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yl/r/ Frame B1C4 339 KB
90 KB 136ms
67ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d7627bee7b263ac39dc5cf783096e2581b6f03eccdd4e9b403a2e7f0689aa81a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: dp+8OK3lvj4Szd2zfWeXdQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 00:21:35 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: zh8FX+EqqnU2EW2plAIKMjUx9i/BAVJ1j1OZZZ+ET6dv/Mn6dJx6bql8bvWnTvBn1505HOpSwfcz/n/pEY0nkw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=5216, tp=14, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 92041
origin-agent-cluster: ?1

GET
H3 200 WQMqdoxbuA9.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yB/r/ Frame B1C4 8 KB
3 KB 136ms
67ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yB/r/WQMqdoxbuA9.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fdef8acb7e3dbb6cb32783cb67afbe528299489fd6d5eb5ec6e72ea0677c2daf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: fTj0Tupj/XcAbrs5fBnZhA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 18:22:11 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: 3He0XCoklBhAmAXqeFpWS8o1Fi3CCN0J/PaaUti4uzYfnp1RRccI52TMqZMp8TCyYJAQ3RAtQOproQJjLyaD8w==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=5216, tp=14, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 2672
origin-agent-cluster: ?1

GET
H3 200 gJtoJCnaERC.js Show response
static.xx.fbcdn.net/rsrc.php/v4iEpO4/yV/l/zh_TW-j/ Frame B1C4 185 KB
50 KB 270ms
201ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yV/l/zh_TW-j/gJtoJCnaERC.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8f29ac3b5f4bfc5f40bd635b82dc0fc20dcfe9e13e138641239beecb3c1d7886

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: nYM4Is3npxS0TLqOM9hN6g==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Tue, 24 Nov 2026 15:16:28 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: bHoSWS7EzoG5cER7o7gRRUnkyLfFcm+UHJ/RL0rAnY+5mxwUyskYo0ywxkDCHN6uz/ZW6pevMrAJBwon4MSGZw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=34208, tp=38, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 50931
origin-agent-cluster: ?1

GET
H3 200 4O9wHg-5OUU.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yh/r/ Frame B1C4 32 KB
11 KB 285ms
216ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yh/r/4O9wHg-5OUU.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b2eb8d16fc7f414112b0ac4fa8d6d946fd133dc7480c7e4b05fc2822b3b4fae6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: X/Mz95bvlXexgrB+u9fkFA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 00:26:17 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: w+V/fVmCkSTZe/xP5sLmpYG35h484Dpj0UXWFrStB7bfADt5W/jY6MiHrIaSjNj2UEzlomUtosnZ+mv+J8oVyw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=13264, tp=21, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 10901
origin-agent-cluster: ?1

GET
H3 200 8wypiAW_bfk.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yb/r/ Frame B1C4 557 B
466 B 289ms
220ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yb/r/8wypiAW_bfk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c2bfe20d9d58935828e75bc753e2655f240621077408ae64f9b40a20f5125487

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: WrWgdG79ReerxOLSJDvtvA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 21:15:42 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: wZrDnVTveMGHLsUXeOhIDkVv65bfKBZpmeytAGA9hlCSYFS0P/FmIoOSkCCcZOOv+mMCPJswChsN7TGOn2YQ6A==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=13264, tp=21, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 323
origin-agent-cluster: ?1

GET
H3 200 dLi53jE44G4.js Show response
static.xx.fbcdn.net/rsrc.php/v4iLl54/yx/l/zh_TW-j/ Frame B1C4 30 KB
9 KB 288ms
219ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iLl54/yx/l/zh_TW-j/dLi53jE44G4.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

591b086a9ce22c2be9d5fddd0126eadd36e6f516e14d1dfdece9223f60295a6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: 6qDNq8VAKjbuC+9iCeOHeg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 20:51:58 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: VCfu+hLU0MufWdaQeXMkgj36ve+/ksGaPHm1Tn0NHl0C9p7kRvJu0pBfI9JM8+XULnKvPEIF4VElXJDYy8uSTQ==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=23, mss=1232, tbw=34208, tp=38, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 8801
origin-agent-cluster: ?1

GET
H3 200 302181889_449668210518240_1343224774275673253_n.png
scontent-tpe1-1.xx.fbcdn.net/v/t39.30808-1/ Frame B1C4 2 KB
2 KB 73ms
33ms Image
image/png 31.13.87.5
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL: https://scontent-tpe1-1.xx.fbcdn.net/v/t39.30808-1/302181889_449668210518240_1343224774275673253_n.png?stp=cp0_dst-png_s50x50&_nc_cat=105&ccb=1-7&_nc_sid=f907e8&_nc_ohc=pUlyqmnBEAEQ7kNvwE8Gzwp&_nc_oc=AdlIlFayCC38GNlvx54aehjocke8n6Kln-68nLqmgcYCZW0K3yCtOXWYTFbxfSuLbIo&_nc_zt=24&_nc_ht=scontent-tpe1-1.xx&edm=ADwHzz8EAAAA&_nc_gid=6_pNDB7PIN6g9-9sGeeAhg&oh=00_AfgGxkJkvYAkSyvhd26konEaxs-cLlBlI6KD80gSU1XAbA&oe=692F6115
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 31.13.87.5 Taipei, Taiwan, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-tpe1.fbcdn.net
Software: /
Resource Hash: 352d0915216b13b935f1abedea04d4a039802faaf69153ae71c377410990e322

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

x-robots-tag: noarchive, noindex
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
no-vary-search: key-order, params=("_nc_gid" "oh" "oe" "_nc_oc" "_nc_ohc" "_nc_cat" "_nc_ht" "_nc_cb")
last-modified: Tue, 06 Sep 2022 22:20:57 GMT
x-fb-ptm-uuid: BD4A25B4293A8E809884ED7E28AF3F9E
content-type: image/png
priority: u=3,i
cache-control: max-age=1209600, no-transform
timing-allow-origin: *
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=31, rtx=0, c=23, mss=1232, tbw=4977, tp=9, tpl=0, uplat=0, ullat=-1
x-crypto-project: 0
cross-origin-resource-policy: cross-origin
content-digest: adler32=747767112
access-control-allow-origin: *
accept-ranges: bytes
content-length: 2066
x-additional-error-detail

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame F302 12 KB
0 217ms
217ms Document
text/html 3.164.121.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-96.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 55
content-length: 12184
content-type: text/html
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 4c8c55ed7c98d423d22ae4c088f8ff36.cloudfront.net (CloudFront)
x-amz-cf-id: u8ffyrbiNuFIZFIVvNcOMTX6fqetdcjRTBwTNTlZ7rR8-wFmHWYq2w==
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 1698 12 KB
0 212ms
212ms Document
text/html 3.164.121.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-96.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 55
content-length: 12184
content-type: text/html
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 4c8c55ed7c98d423d22ae4c088f8ff36.cloudfront.net (CloudFront)
x-amz-cf-id: u8ffyrbiNuFIZFIVvNcOMTX6fqetdcjRTBwTNTlZ7rR8-wFmHWYq2w==
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 88C8 12 KB
0 211ms
211ms Document
text/html 3.164.121.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-96.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 55
content-length: 12184
content-type: text/html
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 4c8c55ed7c98d423d22ae4c088f8ff36.cloudfront.net (CloudFront)
x-amz-cf-id: u8ffyrbiNuFIZFIVvNcOMTX6fqetdcjRTBwTNTlZ7rR8-wFmHWYq2w==
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame C318 12 KB
0 210ms
210ms Document
text/html 3.164.121.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-96.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 55
content-length: 12184
content-type: text/html
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 4c8c55ed7c98d423d22ae4c088f8ff36.cloudfront.net (CloudFront)
x-amz-cf-id: u8ffyrbiNuFIZFIVvNcOMTX6fqetdcjRTBwTNTlZ7rR8-wFmHWYq2w==
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 111F 12 KB
0 206ms
206ms Document
text/html 3.164.121.96
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-96.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 55
content-length: 12184
content-type: text/html
date: Fri, 28 Nov 2025 10:20:04 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 4c8c55ed7c98d423d22ae4c088f8ff36.cloudfront.net (CloudFront)
x-amz-cf-id: u8ffyrbiNuFIZFIVvNcOMTX6fqetdcjRTBwTNTlZ7rR8-wFmHWYq2w==
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/ 608 KB
192 KB 69ms
69ms Script
text/javascript 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 6518253978845184816
age: 68531
x-content-type-options: nosniff
expires: Fri, 27 Nov 2026 15:17:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 27 Nov 2025 15:17:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 196693
x-xss-protection: 0
server: cafe

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame EAC3 2 KB
636 B 402ms
121ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13858
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d2986d922842fcae8dd193d6d389060cc5ccd1f0d3ea67652c35a83ee9db4d24

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame EAC3 30 KB
30 KB 78ms
78ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame B83D 820 B
506 B 411ms
131ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=22213
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1005edce901738f3e7db638eb15c2aab780b0eb6980371a743f826e9edf02aa1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame B83D 30 KB
0 77ms
77ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 8EF7 1 KB
610 B 374ms
96ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13861
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 38a936bb3ef60e388edbed99554f9fa93ffafcd1669777d0e4e00a6b0e23f1da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 8EF7 30 KB
0 76ms
76ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame C3C5 2 KB
853 B 373ms
98ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 97526e5a5802eee45d0f67427c48dddd0eb0c90a24b22d33f509203c56c1a156

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame C3C5 30 KB
0 75ms
75ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame AF89 2 KB
636 B 394ms
121ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13860
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d2986d922842fcae8dd193d6d389060cc5ccd1f0d3ea67652c35a83ee9db4d24

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame AF89 30 KB
0 73ms
73ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame E09D 820 B
506 B 368ms
96ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=18535
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1005edce901738f3e7db638eb15c2aab780b0eb6980371a743f826e9edf02aa1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame E09D 30 KB
0 72ms
72ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame EFE4 7 KB
1 KB 112ms
111ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=22214
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9722a06b170a87794da6a4cf27efd1997b9616d64f1ab14cfbfb7d4738480cc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame EFE4 30 KB
0 70ms
70ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame DD91 7 KB
1 KB 94ms
94ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14209
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7ab261e572155915a8e6ef0476abedf3620a0a65af8fa91c057921344ceef112

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame DD91 30 KB
0 69ms
69ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 55
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: x_MUebPHj2QsfNWVUsDwpFeUeTonMtKOcODrpL28mG9x8XPKHxttbQ==
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H3

200

ltm
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://onead.onevision.com.tw/v2/pixel/ltm?id=552bfba3b35846ce8bc6cfcc159703ac

170 B
203 B

42ms
41ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/ltm?id=552bfba3b35846ce8bc6cfcc159703ac

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
x-vendor: ltm
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 12027117
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 552bfba3b35846ce8bc6cfcc159703ac
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-1cb4-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
location: https://onead.onevision.com.tw/v2/pixel/ltm?id=552bfba3b35846ce8bc6cfcc159703ac
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT

GET
H3

200

ttd
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://onead.onevision.com.tw/v2/pixel/ttd?id=9b8a2872-d43c-40bf-8ec4-c014894bc9b2

170 B
203 B

45ms
44ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/ttd?id=9b8a2872-d43c-40bf-8ec4-c014894bc9b2

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
x-vendor: ttd
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 390039754
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 9b8a2872-d43c-40bf-8ec4-c014894bc9b2
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-8s8z-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

location: https://onead.onevision.com.tw/v2/pixel/ttd?id=9b8a2872-d43c-40bf-8ec4-c014894bc9b2
content-length: 197
date: Fri, 28 Nov 2025 10:20:05 GMT
server: Kestrel

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=3m51m51&uid=ce564343-cc43-11f0-b9bf-42010a000079&t=ajs
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=ce564343-cc43-11f0-b9bf-42010a000079&t=ajs

1 KB
1 KB

99ms
99ms

Image
application/javascript

18.177.116.10
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=ce564343-cc43-11f0-b9bf-42010a000079&t=ajs
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: HTTP/1.1
Server: 18.177.116.10 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-177-116-10.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Content-Length: 1304
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 28 Nov 2025 10:20:05 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=3m51m51&uid=ce564343-cc43-11f0-b9bf-42010a000079&t=ajs
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Fri, 28 Nov 2025 10:20:05 GMT

GET
H3

200

taboola
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://trc.taboola.com/sg/onedata/1/cm
https://onead.onevision.com.tw/v2/pixel/taboola?id=56bd6ae6-0c21-4792-9715-3b5ca47cd3d3-tuct1022fcd5

170 B
203 B

40ms
39ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/taboola?id=56bd6ae6-0c21-4792-9715-3b5ca47cd3d3-tuct1022fcd5

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

nrt12s36-in-f14.1e100.net

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
x-vendor: taboola
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 261073713
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 56bd6ae6-0c21-4792-9715-3b5ca47cd3d3-tuct1022fcd5
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-8s8z-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

x-fastly-to-nlb-rtt: 73221
location: https://onead.onevision.com.tw/v2/pixel/taboola?id=56bd6ae6-0c21-4792-9715-3b5ca47cd3d3-tuct1022fcd5
x-timer: S1764325205.079110,VS0,VE74
x-vcl-time-ms: 74
via: 1.1 varnish
accept-ranges: bytes
x-cache: MISS
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
x-service-version: v1
server: nginx
x-cache-hits: 0
x-served-by: cache-nrt-rjtf7700044-NRT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
446 B 106ms
105ms XHR
text/plain 142.250.196.142
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j102&a=514185403&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2FNNrq69&ul=zh-tw&dt=reteam%27s%20Campsite.bio&sr=1600x1200&vp=1600x1200&_u=IEBAAEABAAAAACAAI~&jid=1808823874&gjid=1119722607&cid=359362692.1764325205&tid=UA-102456694-1&_gid=1450125701.1764325205&_r=1&_slc=1&z=2030487328

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.196.142 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

report-to: {"group":"ascnsrsgac:211:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:211:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:04 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:211:0
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:211:0
content-length: 3
server: Golfe2

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 271ms
206ms Fetch
image/png 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=1675200226052423

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/1675200226052423?v=2.9.243&r=stable&domain=reurl.cc&hme=fdfab1132115f4ac7aabc9fd7eee63947594f6e6f1735b47a225dd71217525d3&ex_m=89%2C147%2C127%2C18%2C65%2C66%2C120%2C61%2C41%2C121%2C70%2C60%2C134%2C78%2C13%2C88%2C26%2C115%2C108%2C68%2C71%2C114%2C131%2C97%2C136%2C7%2C3%2C4%2C6%2C5%2C2%2C79%2C87%2C137%2C214%2C158%2C55%2C216%2C217%2C48%2C173%2C25%2C67%2C222%2C221%2C161%2C28%2C54%2C8%2C57%2C83%2C84%2C85%2C90%2C111%2C27%2C24%2C113%2C110%2C109%2C128%2C69%2C130%2C129%2C43%2C53%2C105%2C12%2C133%2C38%2C203%2C205%2C168%2C21%2C22%2C23%2C15%2C16%2C37%2C33%2C35%2C34%2C74%2C80%2C82%2C95%2C119%2C122%2C39%2C96%2C19%2C17%2C101%2C62%2C31%2C124%2C123%2C125%2C116%2C20%2C30%2C52%2C94%2C132%2C63%2C14%2C126%2C29%2C183%2C154%2C275%2C201%2C145%2C186%2C179%2C155%2C92%2C112%2C73%2C103%2C47%2C40%2C102%2C107%2C51%2C58%2C42%2C98%2C46%2C49%2C45%2C86%2C135%2C0%2C106%2C11%2C104%2C9%2C1%2C50%2C81%2C56%2C59%2C100%2C77%2C76%2C44%2C117%2C75%2C72%2C64%2C99%2C91%2C36%2C118%2C32%2C93%2C10%2C138

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-4WZRHwt3' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719055698006957&cpp=C3&cv=1030417076&st=1764325205052"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719055698006957&cpp=C3&cv=1030417076&st=1764325205052"}],"group":"network-errors"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: rolSghFOQK90A5FMf5FW/UlO2cE7GprzHxrwNycVfor1CKlQQeXbsyiJBUg0824y6Ml8o9ANTMwng2XyFyDD6w==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7577719055698006957&cpp=C3&cv=1030417076&st=1764325205052", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-4WZRHwt3' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
cache-control: private, no-store, no-cache, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=24, mss=1232, tbw=4980, tp=9, tpl=0, uplat=144, ullat=0
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 65ms
63ms Image
text/plain 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2FNNrq69&rl=&if=false&ts=1764325204881&sw=1600&sh=1200&v=2.9.243&r=stable&ec=0&o=4124&fbp=fb.1.1764325204878.512707835876540527&cs_est=true&ler=empty&cdl=API_unavailable&plt=714.7999954223633&it=1764325204720&coo=false&expv2[0]=pl1&expv2[1]=el2&expv2[2]=bc1&expv2[3]=mr0&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=2333, tp=5, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
196 B 301ms
300ms Image
image/png 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2FNNrq69&rl=&if=false&ts=1764325204881&sw=1600&sh=1200&v=2.9.243&r=stable&ec=0&o=4124&fbp=fb.1.1764325204878.512707835876540527&cs_est=true&ler=empty&cdl=API_unavailable&plt=714.7999954223633&it=1764325204720&coo=false&expv2[0]=pl1&expv2[1]=el2&expv2[2]=bc1&expv2[3]=mr0&rqm=FGET

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-CqhAJPuE' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719055063776368&cpp=C3&cv=1030417076&st=1764325205263"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719055063776368&cpp=C3&cv=1030417076&st=1764325205263"}],"group":"network-errors"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: sgr9p/TFo2wLVyTBV6cc2zb8y6wYXaHnTQ/qNUE03gucnnatmsUhQTOsQSHOYMpoz1FJg2AmR+nLEANRAmVAfw==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7577719055063776368&cpp=C3&cv=1030417076&st=1764325205263", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-CqhAJPuE' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
cache-control: private, no-store, no-cache, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=22, mss=1232, tbw=3124, tp=11, tpl=0, uplat=236, ullat=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 collect
analytics.google.com/g/ 0
0 167ms
63ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5bi1v9181474282za200zd9181474282&_p=1764325204366&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=359362692.1764325205&ecid=9452089&ul=zh-tw&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_s=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764325204&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=reteam%27s%20Campsite.bio&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1219
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
544 B 138ms
65ms Ping
text/plain 74.125.204.157
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZDFZCDVDK1&cid=359362692.1764325205&gtm=45je5bi1v9181474282za200zd9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.204.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ti-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 490 KB
161 KB 117ms
114ms Script
application/javascript 142.250.194.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0&cx=c&gtm=4e5bi1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

52e7db060af035270790fa8fdc2b4ef2317a671e0ecba6d66a4e1b3bdc7f2464

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 28 Nov 2025 10:20:05 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164485
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 422 KB
143 KB 156ms
155ms Script
application/javascript 142.250.194.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D&cx=c&gtm=4e5bi1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b527ed588bb09bba79b29061a43d45c73394c740b1c24c4fd142113fa2bc1962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 28 Nov 2025 10:20:05 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146351
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 ga-audiences
www.google.com.tw/ads/ 42 B
107 B 363ms
160ms Image
image/gif 172.217.31.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com.tw/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZDFZCDVDK1&cid=359362692.1764325205&gtm=45je5bi1v9181474282za200zd9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638&z=871655250

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.31.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame AE3B 42 KB
17 KB 294ms
108ms Script
application/javascript 3.173.197.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.197.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-197-56.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fb04bf962208df81def881d4eb39e5f263c8f79e4c9425bbe79042eb36938c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 152
via: 1.1 8104408086379f0d5dc3491249134cfe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5dEMNp2rqa5eb5GnBc4LIYqySEgrNg2l_0BJSWRKFmDQMFKtnvLhcQ==
date: Fri, 28 Nov 2025 10:17:34 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P8
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame F302 42 KB
0 289ms
289ms Script
application/javascript 3.173.197.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.197.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-197-56.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fb04bf962208df81def881d4eb39e5f263c8f79e4c9425bbe79042eb36938c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 152
via: 1.1 8104408086379f0d5dc3491249134cfe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5dEMNp2rqa5eb5GnBc4LIYqySEgrNg2l_0BJSWRKFmDQMFKtnvLhcQ==
date: Fri, 28 Nov 2025 10:17:34 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P8
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 1698 42 KB
0 284ms
284ms Script
application/javascript 3.173.197.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.197.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-197-56.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fb04bf962208df81def881d4eb39e5f263c8f79e4c9425bbe79042eb36938c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 152
via: 1.1 8104408086379f0d5dc3491249134cfe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5dEMNp2rqa5eb5GnBc4LIYqySEgrNg2l_0BJSWRKFmDQMFKtnvLhcQ==
date: Fri, 28 Nov 2025 10:17:34 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P8
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 88C8 42 KB
0 277ms
277ms Script
application/javascript 3.173.197.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.197.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-197-56.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fb04bf962208df81def881d4eb39e5f263c8f79e4c9425bbe79042eb36938c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 152
via: 1.1 8104408086379f0d5dc3491249134cfe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5dEMNp2rqa5eb5GnBc4LIYqySEgrNg2l_0BJSWRKFmDQMFKtnvLhcQ==
date: Fri, 28 Nov 2025 10:17:34 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P8
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame C318 42 KB
0 273ms
273ms Script
application/javascript 3.173.197.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.197.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-197-56.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fb04bf962208df81def881d4eb39e5f263c8f79e4c9425bbe79042eb36938c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 152
via: 1.1 8104408086379f0d5dc3491249134cfe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5dEMNp2rqa5eb5GnBc4LIYqySEgrNg2l_0BJSWRKFmDQMFKtnvLhcQ==
date: Fri, 28 Nov 2025 10:17:34 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P8
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 111F 42 KB
0 269ms
269ms Script
application/javascript 3.173.197.56
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.197.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-197-56.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6fb04bf962208df81def881d4eb39e5f263c8f79e4c9425bbe79042eb36938c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 152
via: 1.1 8104408086379f0d5dc3491249134cfe.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 5dEMNp2rqa5eb5GnBc4LIYqySEgrNg2l_0BJSWRKFmDQMFKtnvLhcQ==
date: Fri, 28 Nov 2025 10:17:34 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P8
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
cm.lndata.com/ Frame AE3B 35 B
470 B 204ms
60ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Content-Length: 35
P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Date: Fri, 28 Nov 2025 10:20:05 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Connection: keep-alive
Server: TornadoServer/1.2.1

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame A496 0
217 B 496ms
251ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:05 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame 00AD 39 B
182 B 3327ms
3222ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:08 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame AE3B 409 B
632 B 369ms
125ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame AE3B 5 KB
3 KB 141ms
34ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame AE3B 0
218 B 370ms
126ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

cm
c.holmesmind.com/ Frame AE3B
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
499 B

204ms
204ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame AE3B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

0
458 B

202ms
98ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 28 Nov 2025 11:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFrE9gp-wXgrAePXJFBprsRX3kWZGWuQwue1XyQDz18WQI1e9PcRDzx_MCP3HKqQ9qD
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame F302 35 B
394 B 235ms
35ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 28 Nov 2025 10:20:05 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame F302 0
217 B 461ms
93ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame F302
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
17 B

222ms
193ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 22FD 0
217 B 559ms
64ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:05 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame 9B6C 39 B
88 B 3545ms
221ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:08 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame F302 409 B
631 B 443ms
77ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame F302
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

0
0

45ms
45ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 28 Nov 2025 11:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFrE9gp-wXgrAePXJFBprsRX3kWZGWuQwue1XyQDz18WQI1e9PcRDzx_MCP3HKqQ9qD
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 1698 35 B
394 B 266ms
34ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 28 Nov 2025 10:20:05 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 1698 0
217 B 523ms
65ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 1698
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

214ms
191ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 4767 0
217 B 660ms
104ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:05 GMT
server: nginx/1.18.0 (Ubuntu)

GET cm.php
fcm.holmesmind.com/ Frame AB52 0
0

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 1698 409 B
631 B 512ms
67ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 1698
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

0
0

0ms
0ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 28 Nov 2025 11:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFrE9gp-wXgrAePXJFBprsRX3kWZGWuQwue1XyQDz18WQI1e9PcRDzx_MCP3HKqQ9qD
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 88C8 35 B
394 B 296ms
34ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 28 Nov 2025 10:20:05 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 88C8 0
217 B 658ms
138ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 88C8
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

192ms
191ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 0509 0
217 B 725ms
63ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:05 GMT
server: nginx/1.18.0 (Ubuntu)

GET cm.php
fcm.holmesmind.com/ Frame C5CA 0
0

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 88C8 409 B
631 B 612ms
103ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 88C8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

0
0

1ms
1ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 28 Nov 2025 11:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFrE9gp-wXgrAePXJFBprsRX3kWZGWuQwue1XyQDz18WQI1e9PcRDzx_MCP3HKqQ9qD
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame C318 35 B
394 B 332ms
39ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 28 Nov 2025 10:20:05 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame C318 0
217 B 784ms
124ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame C318
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

222ms
192ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame CBB8 0
217 B 813ms
91ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:05 GMT
server: nginx/1.18.0 (Ubuntu)

GET cm.php
fcm.holmesmind.com/ Frame 480F 0
0

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame C318 409 B
631 B 682ms
74ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame C318
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

0
0

0ms
0ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 28 Nov 2025 11:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFrE9gp-wXgrAePXJFBprsRX3kWZGWuQwue1XyQDz18WQI1e9PcRDzx_MCP3HKqQ9qD
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 111F 35 B
394 B 371ms
44ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Fri, 28 Nov 2025 10:20:05 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 111F 0
217 B 846ms
66ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 111F
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
12 B

226ms
197ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame FE64 0
217 B 919ms
110ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 28 Nov 2025 10:20:05 GMT
server: nginx/1.18.0 (Ubuntu)

GET cm.php
fcm.holmesmind.com/ Frame D1C2 0
0

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 111F 409 B
631 B 744ms
66ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 111F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1

0
0

0ms
0ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Fri, 28 Nov 2025 11:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOFrE9gp-wXgrAePXJFBprsRX3kWZGWuQwue1XyQDz18WQI1e9PcRDzx_MCP3HKqQ9qD
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEBBd3juL8klRgqb7UYVwUw8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 UXtr_j2Fwe-.png
static.xx.fbcdn.net/rsrc.php/v4/yw/r/ Frame B1C4 573 B
716 B 64ms
63ms Image
image/png 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yw/r/UXtr_j2Fwe-.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yE/l/1,cross/iXGJEr7Orjl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://static.xx.fbcdn.net/rsrc.php/v5/yE/l/1,cross/iXGJEr7Orjl.css

Response headers

content-md5: 07aG/2AEtDHVAZ5LUajMDQ==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 18:07:54 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: cSwFyB7YE1KhK/s8xwfj6OVXhM3KZ+N2Enix1xiQ7rLdqxIZwlRonaFn5DwFEIYw1A2OhTA74p/xfddMc0W+Lg==
priority: u=3,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=2333, tp=5, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 573
origin-agent-cluster: ?1

GET
H3 200 fEQL6-wrdkC.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yq/r/ Frame B1C4 247 KB
69 KB 64ms
64ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yq/r/fEQL6-wrdkC.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d7968e9beff2ccb96c1a30e8e5db2373a8486550fbb63179e59e7e674542e1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: wzBVv9s5vIHMgrYGY8cYwg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 21 Nov 2026 21:59:28 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: g0AJfFzBZGLE31IjOJ8Dt/Wixd9pOirW29RzShtzo1yq/rbiwHOUoRB3dxOjxlv+E7UYew8dqJgJ+E9/fiy6eg==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=164, mss=1232, tbw=182912, tp=162, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 70712
origin-agent-cluster: ?1

POST
H2 204 collect
analytics.google.com/g/ 0
0 37ms
36ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-S9B9ZLEX4D&gtm=45je5bi1v9235665865za200zb9181474282zd9181474282&_p=1764325204366&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=359362692.1764325205&ul=zh-tw&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~115583767~115938465~115938469~116184927~116184929~116217636~116217638&sid=1764325205&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=reteam%27s%20Campsite.bio&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1417
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
48 B 108ms
66ms Ping
text/plain 74.125.204.157
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-S9B9ZLEX4D&cid=359362692.1764325205&gtm=45je5bi1v9235665865za200zb9181474282zd9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~115583767~115938465~115938469~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.204.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ti-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.com.tw/ads/ 42 B
408 B 331ms
130ms Image
image/gif 172.217.31.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com.tw/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-S9B9ZLEX4D&cid=359362692.1764325205&gtm=45je5bi1v9235665865za200zb9181474282zd9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~115583767~115938465~115938469~116184927~116184929~116217636~116217638&z=1180542845

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.31.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
analytics.google.com/g/ 0
0 64ms
63ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5bj0h2v897965293za200zb9181474282zd9181474282&_p=1764325204366&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=359362692.1764325205&ul=zh-tw&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105322304~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764325205&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=reteam%27s%20Campsite.bio&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1458
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
57 B 107ms
66ms Ping
text/plain 74.125.204.157
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-N394QBRGC0&cid=359362692.1764325205&gtm=45je5bj0h2v897965293za200zb9181474282zd9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105322304~115583767~115938465~115938468~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.204.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ti-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.com.tw/ads/ 42 B
107 B 338ms
161ms Image
image/gif 172.217.31.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com.tw/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-N394QBRGC0&cid=359362692.1764325205&gtm=45je5bj0h2v897965293za200zb9181474282zd9181474282&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105322304~115583767~115938465~115938468~116184927~116184929~116217636~116217638&z=542635654

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.31.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:05 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 8EF7 2 KB
1 KB 98ms
97ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13861&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=635&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 36dcdd6a63c126f903a289b8c84493f59f48f4a7f9c8f4477a156fa18d74ec43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame E09D 3 KB
1 KB 117ms
117ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=989&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0f3df50432916f7f9a7f2ab6b427c38273a97922318f946ffd582374300ee205

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame C3C5 3 KB
1 KB 134ms
132ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=51&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7318a474eb5eebfa5466acbc7c2fc48414a9fccd9e9ce371013c59b4a7ea877f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame C3C5 3 KB
3 KB 69ms
67ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 35
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: __i5GB2xT-52LJ2C87kp0fWuCDcH37bBbVhfoKKJfTfKuJrNKvJk4Q==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame C3C5 128 KB
46 KB 309ms
173ms Script
text/javascript 182.161.74.47
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.47 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

96eb2af4499706fffc895afda3f26d456a47e4d04827031ec81c49218545b276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
expires: Sat, 29 Nov 2025 10:20:05 GMT
access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame C3C5 3 KB
4 KB 69ms
68ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 54
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: fscToHR9PdQLe_t8O-Cp5t8n9Scvq9GsvgrsT1p4BtBmHGH0Trx3cA==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame C3C5 3 KB
4 KB 106ms
105ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 43
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: gYZFt_0QFKudLw-QGfUBoBaEO6zCWZdJTXUGXEkDLQS2Mhn0-9wgWw==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame C3C5 5 KB
6 KB 106ms
105ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 43
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: didx1Fjq_9pio9tm-pD_9iQfltK2CsvmMdfR4y1z_lKNOD6tTzG0HA==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 teads_mainV3.js Show response
cdn.holmesmind.com/js/ Frame C3C5 46 KB
46 KB 106ms
105ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/teads_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6d4c444108925dc2ec8fe761f55a6760241c123740591e1348f0f94a653a3985

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 0GyqAf7LKhNiqEjX8VRsAWlYH_I2gXHI
etag: "a7e4fcfdedcaf972df92c41e4c9dc6b0"
age: 35
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 46892
x-amz-cf-id: ilSdSUxdf1dIPr7G4yTNybGAXU6sRTh8ZNeiUdJv9-BrKYzd8035Rw==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Thu, 16 May 2024 06:07:06 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 ucfunnel.js Show response
cdn.holmesmind.com/js/ Frame C3C5 2 KB
3 KB 106ms
106ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/ucfunnel.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 7FnOHKe__pwg0dVwIyTfAcdImUIZ6pwv
etag: "8ebabc4e0b1d40fe52514166c7db7048"
age: 52
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2166
x-amz-cf-id: T7D0nld0EvfIGivMx9H3_x3A7eTasigjg67KlNiGZkznUDgWpYAndg==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Fri, 21 Jul 2023 03:54:43 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame B1C4 69 KB
18 KB 414ms
414ms XHR
application/x-javascript 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22776730922422337%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F%22%2C%22width%22%3A340%2C%22height%22%3A500%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Afalse%2C%22referer_uri%22%3A%22https%3A%2F%2Freurl.cc%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20420.BP%3Aplugin_default_pkg.2.0...0&dpr=1&__ccg=GOOD&__rev=1030417076&__s=%3A%3Ajm1vn7&__hsi=7577719052751476328&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx609vCwjE0AC1xwEw7Bx61vw5zw78w5Uw64w8W1uw2oE17U2ZwrU1Xo1UU3jwea&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yV/l/zh_TW-j/gJtoJCnaERC.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

900387f1cb10af927d5a18620718c87d64f62aba72adf3a5dafa780fc2d0be11

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-ASBD-ID: 359341
X-FB-LSD: te3nRY6atA7tBC5hKm5HlI
Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719056109324869&cpp=C3&cv=1030417076&st=1764325205449"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719056109324869&cpp=C3&cv=1030417076&st=1764325205449"}],"group":"network-errors"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
x-fb-debug: pqv6PYSKcXIxPD18PR5Yml8CJ0amdpElrierWa4raz486TidHjmYsT1z3vLW1lT5lAkY/JYS0GedyHK/ixlnVw==
priority: u=1,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7577719056109324869&cpp=C3&cv=1030417076&st=1764325205449", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
cache-control: private, no-cache, no-store, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=40, mss=1232, tbw=27201, tp=38, tpl=0, uplat=351, ullat=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
origin-agent-cluster: ?1

POST
H3 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame B1C4 1021 B
722 B 262ms
261ms XHR
application/x-javascript 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yV/l/zh_TW-j/gJtoJCnaERC.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ac6f90ebf24f3e7a8883421e398e4fc8cb76a3602128d4ad363202d65ca05998

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-ASBD-ID: 359341
X-FB-LSD: te3nRY6atA7tBC5hKm5HlI
Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719056527503791&cpp=C3&cv=1030417076&st=1764325205453"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719056527503791&cpp=C3&cv=1030417076&st=1764325205453"}],"group":"network-errors"}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Origin, Accept-Encoding
x-fb-debug: hNrLQEOi25m7Au/pMZSrkrtfbc8TEE+5q7T1T9H48dstkUR4UwIyzaUeExF9pj4AYVTQ5g+3vQf3cQl7R3dbBA==
priority: u=1,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7577719056527503791&cpp=C3&cv=1030417076&st=1764325205453"
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
cache-control: private, no-cache, no-store, must-revalidate
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=40, mss=1232, tbw=25569, tp=34, tpl=0, uplat=198, ullat=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?1

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame AE3B 37 B
407 B 35ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

ea2fe5cb06763209ba4f17572bfc1d053f4f3c742995a61b2b8ab131b242d737

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame AF89 0
201 B 92ms
92ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13860&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=278&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame EAC3 1 KB
850 B 91ms
90ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13858&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=210&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fb2cbb353c92016451d7d85dd18c89c9b6b6fe7b31fd002d04ba7c5ebcde00a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame B83D 0
201 B 93ms
91ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=22213&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=870&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame DD91 0
201 B 92ms
91ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14209&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=310&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame DD91 3 KB
0 24ms
24ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 35
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: __i5GB2xT-52LJ2C87kp0fWuCDcH37bBbVhfoKKJfTfKuJrNKvJk4Q==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame DD91 128 KB
0 265ms
265ms Script
text/javascript 182.161.74.47
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 182.161.74.47 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),
Reverse DNS
Software: Kestrel /
Resource Hash: 96eb2af4499706fffc895afda3f26d456a47e4d04827031ec81c49218545b276

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
expires: Sat, 29 Nov 2025 10:20:05 GMT
access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame DD91 3 KB
0 24ms
24ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 54
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: fscToHR9PdQLe_t8O-Cp5t8n9Scvq9GsvgrsT1p4BtBmHGH0Trx3cA==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame DD91 3 KB
0 61ms
61ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 43
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: gYZFt_0QFKudLw-QGfUBoBaEO6zCWZdJTXUGXEkDLQS2Mhn0-9wgWw==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appierV2.js Show response
cdn.holmesmind.com/js/ Frame DD91 3 KB
4 KB 99ms
98ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appierV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2650f0bf9347561322354447171981c0a052401f826695fec1281e29fa16c840

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: L_ytFJI.iZbA3Ys9mJ75ciLmXqmRfuVO
etag: "21253aa5d7ee0c3b700ce5f1a4a1b4d1"
age: 54
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3446
x-amz-cf-id: Dpav20LfMfFel1HGGMG7dp7f8E4sgRfYlQYgeOZHduNmJuOUqUY6SA==
date: Fri, 28 Nov 2025 10:19:12 GMT
content-type: application/javascript
last-modified: Thu, 14 Dec 2023 06:52:43 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame DD91 5 KB
0 61ms
61ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 43
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: didx1Fjq_9pio9tm-pD_9iQfltK2CsvmMdfR4y1z_lKNOD6tTzG0HA==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 prebid_mainV3.js Show response
cdn.holmesmind.com/js/ Frame DD91 3 KB
4 KB 163ms
162ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/prebid_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 979da208bbb4e7e775544f9ea351afe3cae32b74ca9b980e05762c5b0533fe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: qFW_bhDMYXaROfK7pGZd0YtcGDNChS4b
etag: "3a64d41cf3ddc5d6b7a060ad46bee403"
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 3414
x-amz-cf-id: emWX9Up5KCZht0ZU8qhqBuJWvV90jMc1kAmPQs1FC_uKKgxn3psNeg==
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/javascript
last-modified: Fri, 14 Jul 2023 03:27:51 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 xgVgalBG80z.png
static.xx.fbcdn.net/rsrc.php/v4/yH/r/ Frame B1C4 1 KB
1 KB 62ms
62ms Image
image/png 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yH/r/xgVgalBG80z.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yE/l/1,cross/iXGJEr7Orjl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://static.xx.fbcdn.net/rsrc.php/v5/yE/l/1,cross/iXGJEr7Orjl.css

Response headers

content-md5: rB4cTW8WNZcBsFntToJGtA==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 18 Nov 2026 20:31:31 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: mH8kI9c5A9gHvF3mUsv4n8vYv++f3V8qEf3TWdfbFcQTU6gKVj+5QIuSEAjVy/k+nfovr+tz9yE+galyerbfIw==
priority: u=3,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=23, mss=1232, tbw=4868, tp=12, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 1315
origin-agent-cluster: ?1

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame EFE4 0
201 B 157ms
157ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=22214&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=166&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame AE3B 30 B
278 B 36ms
36ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame C3C5 0
171 B 388ms
174ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

GET
H2 200 128002626 Show response
fundingchoicesmessages.google.com/i/ 214 KB
69 KB 378ms
168ms Script
application/javascript 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/128002626?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cf0640db9500d74df2d160b7f4f3b0b58bb4faeed129cadf8528d55d44706c28

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-y0cckbpkxXVIIWTOf0HFFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJi8NeQYmi9eY51MhB3LTrPOgOIDRUusdoD8Yf6y6w_gLhI4gprAxB_qrrBKlB9gzWJ_SZrARCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwsJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRAPx9V3S0-yCdz4O-Eck5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpoaGhhZ6BaXyBAQDq5UhR"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-y0cckbpkxXVIIWTOf0HFFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 8EF7 13 KB
13 KB 83ms
83ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13861&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=635&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 49
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: 50Zb6lSPN_T_OVtxUCSLOun7h158sg0Groc3sLvKvkQmdpUEBh30bg==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame C3C5 0
168 B 215ms
62ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.6118880624175634
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Fri, 28 Nov 2025 10:20:05 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST
H2

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame C3C5
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=xTddEbsDCKafEuUiVXcpaQ

2 B
159 B

39ms
37ms

XHR
application/json

35.190.36.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=xTddEbsDCKafEuUiVXcpaQ
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Server: 35.190.36.98 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=xTddEbsDCKafEuUiVXcpaQ
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 28 Nov 2025 10:20:05 GMT
Server: nginx

POST
H2

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame DD91
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=E36yg0FwAaOtC85kVXcpaQ

2 B
130 B

113ms
110ms

XHR
application/json

35.190.36.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=E36yg0FwAaOtC85kVXcpaQ
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Server: 35.190.36.98 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=E36yg0FwAaOtC85kVXcpaQ
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 28 Nov 2025 10:20:05 GMT
Server: nginx

POST
H2

200

bid Show response
ad2.apx.appier.net/v1/prebid/ Frame DD91
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid
https://ad2.apx.appier.net/v1/prebid/bid?acid=llhsfs2pDjG07wozVXcpaQ

2 B
129 B

111ms
109ms

XHR
application/json

35.190.36.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ad2.apx.appier.net/v1/prebid/bid?acid=llhsfs2pDjG07wozVXcpaQ
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Server: 35.190.36.98 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.36.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-store
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
access-control-allow-credentials: true
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List
via: 1.1 google
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/json; charset=utf-8

Redirect headers

Cache-Control: no-store
Location: https://ad2.apx.appier.net/v1/prebid/bid?acid=llhsfs2pDjG07wozVXcpaQ
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: null
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 28 Nov 2025 10:20:05 GMT
Server: nginx

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame E09D 13 KB
0 80ms
80ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=989&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 49
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: 50Zb6lSPN_T_OVtxUCSLOun7h158sg0Groc3sLvKvkQmdpUEBh30bg==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 f.js Show response
cdn.holmesmind.com/js/ Frame E09D 12 KB
12 KB 151ms
151ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/f.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=989&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f8bcd058a4fbee6f8b68a5ff2930470c1890fc714914c226cf950b4e11ffdcdb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: I0L11em9y2rEWUbgZZxQXYLhoIMX8Pv6
etag: "1d98c42a6ebd67d5137147fbb5ad912f"
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: RefreshHit from cloudfront
content-length: 12254
x-amz-cf-id: sjNo1yhEQTivKG5IfZp6GzMBABfs231t_xjHgOFCOMiZdGlzpYqy_g==
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/javascript
last-modified: Fri, 14 Jun 2024 08:45:07 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame C3C5 13 KB
0 80ms
80ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=51&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 49
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: 50Zb6lSPN_T_OVtxUCSLOun7h158sg0Groc3sLvKvkQmdpUEBh30bg==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame EAC3 13 KB
0 82ms
81ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13858&rf=https%3A%2F%2Freurl.cc%2FNNrq69&n=210&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&fp_uuid=0257-9b18f932fd359fdd694cd7fd8d9788a6&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 49
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: 50Zb6lSPN_T_OVtxUCSLOun7h158sg0Groc3sLvKvkQmdpUEBh30bg==
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame AE3B 325 KB
84 KB 138ms
66ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-logOoN0e' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-logOoN0e' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=4928, tp=8, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HOA9pbCHoSN4FfR9D9kzbas3dA7ejojE0uvQ32a2qFsXMt72E47FU4i8OjZ0L1zPFxHFxdviQ1h1/kE7j0DXCA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/ 64 KB
23 KB 110ms
109ms Other
text/plain 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17914686685964197562
age: 65916
x-content-type-options: nosniff
expires: Thu, 04 Dec 2025 16:01:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 27 Nov 2025 16:01:29 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23115
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202511110101"

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 8EF7 5 KB
3 KB 133ms
32ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame E09D 5 KB
0 133ms
133ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame C3C5 5 KB
0 134ms
134ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame AF89 5 KB
0 86ms
86ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame EAC3 5 KB
0 50ms
50ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame B83D 5 KB
0 32ms
32ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame DD91 5 KB
0 32ms
32ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame EFE4 5 KB
0 33ms
33ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Fri, 28 Nov 2025 10:30:05 GMT
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame F302 325 KB
0 51ms
50ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-logOoN0e' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-logOoN0e' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=4928, tp=8, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HOA9pbCHoSN4FfR9D9kzbas3dA7ejojE0uvQ32a2qFsXMt72E47FU4i8OjZ0L1zPFxHFxdviQ1h1/kE7j0DXCA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 6tpzuzEODHB.js Show response
static.xx.fbcdn.net/rsrc.php/v4/y8/r/ Frame B1C4 213 B
355 B 64ms
63ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/y8/r/6tpzuzEODHB.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f21233ebfc628748be56e544ee831e6723e5534227b3d48b06b77a7bda1f6e28

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: Cz7JW2XPt8zqYMcsXYdDQg==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 18 Nov 2026 18:20:30 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: ZwWpZbenBYHB+n+XFhKRvcP0Z4YZX5/1tNT8U9xg6iVBl75qlHungkdCZ4tV7/JZTbbU+JY2SYg0lf53FfQEQw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=255456, tp=224, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 213
origin-agent-cluster: ?1

GET
H2 200 close_btn.png
cdn.holmesmind.com/image/creative/20200629/ 23 KB
23 KB 72ms
69ms Image
image/png 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/image/creative/20200629/close_btn.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0e83a8ffdd161a80e179732ca1f514ee08dcc3c4a128baa9c92bcffebc2a7c52

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: eftIHNkZLvs_zrsThuw3iZTYVcb2Z_86
etag: "e08deb6b87983b314d88a24c09f4d13f"
age: 72307
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 23254
x-amz-cf-id: A8eeAxdVCL4JHQ3rvemjGCqsXlKjK0-aEH1SA3WQRxI8qJewSrklvg==
date: Thu, 27 Nov 2025 14:14:58 GMT
content-type: image/png
last-modified: Thu, 15 Jun 2023 01:01:51 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame C3C5 0
458 B 338ms
158ms XHR
text/plain 182.161.74.26
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=164&profileId=184&cb=53505373083

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.26 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:04 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 1698 325 KB
0 0ms
0ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-logOoN0e' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-logOoN0e' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=4928, tp=8, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HOA9pbCHoSN4FfR9D9kzbas3dA7ejojE0uvQ32a2qFsXMt72E47FU4i8OjZ0L1zPFxHFxdviQ1h1/kE7j0DXCA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 8EF7 36 B
399 B 39ms
37ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame AF89 36 B
399 B 74ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame C3C5 36 B
399 B 177ms
102ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame EFE4 36 B
399 B 214ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame EAC3 36 B
399 B 250ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame E09D 36 B
399 B 286ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame DD91 36 B
399 B 321ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame B83D 36 B
399 B 356ms
35ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e77f0f7f1d34a5e49dc0e70d8dcafdd939bb1bfcf629282ef00464a171b6b4b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H3 400 / Show response
www.facebook.com/login/ Frame B1C4 178 KB
178 KB 213ms
213ms Document
text/html 31.13.82.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fhref%3Dhttps%253A%252F%252Fwww.facebook.com%252Freurl.cc%252F%26tabs%3Dtimeline%26width%3D340%26height%3D500%26small_header%3Dfalse%26adapt_container_width%3Dtrue%26hide_cover%3Dfalse%26show_facepile%3Dtrue%26appId

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

bb49de2aea4f5f3b81fddb5e8ca50b9fe0c27b6e1afa0ff5fbdd1b79fa1cae4b

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-InR3LXoI' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-length: 856
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-InR3LXoI' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 28 Nov 2025 10:20:05 GMT
document-policy: include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
nel: {"report_to":"network-errors","max_age":3600,"failure_fraction":0.01}
origin-agent-cluster: ?1
pragma: no-cache
priority: u=0,i
proxy-status: http_request_error; e_fb_vipaddr="AcPakH6d2BxBWXL5-Kb17IBzRIGRfRsQGeZx5zWKcVf2IRiLAtubpE1kdwN-A4AixaO9CBD8p-5XBE16242IMm0A3VvMuQpueFEa8Q"; e_clientaddr="AcOdiTz38HzMicaHW9XNRpDrkWypeG-EJ64w-daJQdwI2PhDrmoLbpjNZY5JziAURi3MUS1ImYzxQsUIRKJXs7nUPQ_uq-fKf6ThGy57Pt4n7_in"; e_upip="AcPgpLmnuCxm8lP3C3rxvL6s4TDLR0UeOv9Y0GRs2YD_o1L3u1Rs5ULbvUu0yIluOnAgxNXz5K2viIFQR8eQHPcN9HKFTPzNY3g_xSWYCw"; e_fb_zone="AcOSW7B_5seyo7oqj8IDfn--Wq1GUU9QKdPkE8uUoiXfeajD683brF_zPerQrUg7"; e_fb_twtaskhandle="AcP9XC5bz1DJaDSUUeEWWTYZGHMIEIzjMd1cHzs5HUCnfbrVOxgmSAmk1x_XtNcpvNZ_777kVH3p8yxlFO5PlOBfNXbZn9CcxpCrkUo0xPZFPg"; e_proxy="AcNI0sJRc_VefgnAZePwoDlU5uNjsnF29_0mwvjTCiEipZqYI953T2VKxkcUHpzU5yfmNI10xiUivanCOYFq", http_request_error; e_fb_vipaddr="AcNt_5XlAiVvJ6niwBdVg4qnLsEQkWX43d7gxdFJLM8xpH0RiD86QkSQs3OIpzBNohM9AZE"; e_clientaddr="AcOAyffsAmPoCpAyaMmuVNsNyBp8pHZTP1tb1KmsCw4Rpae8pCe5klHDVSRKVnPqYT3o7xSPW8XaFdU"; e_upip="AcMlQ62YOe6_Dwpd4InKYGUTo57npk0Nk8XhGnA-kTJERhhPv8NqlgcGMHif3gSxSEHMGu6n6jOsOXLKhHM-Ql3xfQnNBIkPiZucDQ"; e_fb_zone="AcOyd_YAt6sz-MNclnxKnt6V6oDXbA5AUY1QOnu4kh4h1zoQm8uEc6Lc9_QDrA"; e_fb_twtaskhandle="AcMfWJh79b4oO1UCboVqp0SxxbBPA_4ErDZHkR_KYRQUMGGj_qYwkwhHi2EuR3Dgayyrr-5rAes5tgIkmbMf8G4EVBX4mnCQL4GX"; e_proxy="AcMxmcRC7G7O0zj3pN8kI8Kh3aPwTx5qxT4RLKrzsSXTZTmuHjrxAKUlOXnTh4urWJEt_JEhWtIaSBC2"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719056375783483&cpp=C3e&cv=1030417076&st=1764325205745"}]}, {"max_age":3600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7577719056375783483&cpp=C3e&cv=1030417076&st=1764325205745"}],"group":"network-errors"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7577719056375783483&cpp=C3e&cv=1030417076&st=1764325205745"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=40, mss=1232, tbw=46849, tp=56, tpl=0, uplat=150, ullat=0
x-fb-debug: LwnMShcWAyHrzqoef+0A+rzbR8de5dT7lm4YT7Q7avOnDU5h9BE+E7vLLRvrGFvTw1kv0ZvQEe+CiVLzfUNzsw==
x-frame-options: DENY
x-xss-protection: 0

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame 8EF7 30 B
271 B 69ms
69ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 88C8 325 KB
0 0ms
0ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-logOoN0e' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-logOoN0e' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=4928, tp=8, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HOA9pbCHoSN4FfR9D9kzbas3dA7ejojE0uvQ32a2qFsXMt72E47FU4i8OjZ0L1zPFxHFxdviQ1h1/kE7j0DXCA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 yPX6-M9P-xt.css
static.xx.fbcdn.net/rsrc.php/v5/yu/l/1,cross/ Frame B1C4 22 KB
6 KB 69ms
67ms Stylesheet
text/css 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v5/yu/l/1,cross/yPX6-M9P-xt.css

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d73610ac94d74cfd7fca34601ace54fd29e6729eda78e1808f4eae946934bb09

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: JV15AXVztZ9wDI/OUxvkhw==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 25 Nov 2026 16:47:23 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: D8iKoWxNkYtKT5+ii8wq5fCQFf4MZmu32coUShGs/8GilzNVOOBkZIodFuvEe04/V9nmqgVb6GG/xr9x/pDQiQ==
priority: u=0
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=262992, tp=239, tpl=0, uplat=3, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 5671
origin-agent-cluster: ?1

GET
DATA 200
OK truncated
/ Frame B1C4 1 KB
0 Stylesheet
text/css

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fa4737f35024386f5448fabd53d531f869ab5bc08b741de444bc88363c36c06e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

Content-Type: text/css;charset=utf-8

GET
H3 200 YwXP_-ww9iI.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yh/r/ Frame B1C4 5 KB
2 KB 66ms
65ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yh/r/YwXP_-ww9iI.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

35cec2c7dac91cebfd82679b910cce82e3c852d0366fc6e56c3884be44c6e96b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: 6a37yqawNTTHUYmmvjM1qQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 00:27:43 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: 5KtJmqX5x9s+1oUonv5Yt9Q2DX057Rd5XWkFg4q0auTI+REuWHyHpsAxD203/wOocRNKcQGU3Uh0Pad1A5hKyw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=256336, tp=233, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 1764
origin-agent-cluster: ?1

GET
H3 200 SaX6oTFSjNg.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yl/r/ Frame B1C4 61 KB
16 KB 68ms
66ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/SaX6oTFSjNg.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3089d82fb3b164849c910944fb0d7e7daba3023321fb74c37c586e53b2176db8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: jztf54APjXiemYjSpb/E7A==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 21 Nov 2026 00:50:53 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: QrkRH3UnBZIojgnNLAAR4tkdeTpNd4xp4ooY9JDxABzKc8HDkTOzMXDR1CYkdO4A+HN3CgXenOo9xho+HFLwKg==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=256336, tp=233, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 16338
origin-agent-cluster: ?1

GET
H3 200 atv-3qMDl2i.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yd/r/ Frame B1C4 36 KB
11 KB 70ms
69ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yd/r/atv-3qMDl2i.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5ccb6c69b900610a41f5056880f80d1d0b9cc982957e9b8b47f0d3308e15f4f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: LzFpgJnHDzbwl7iijumFjQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 21:32:19 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: kafm4hvKYoEhtiF88rh/gw+TL99lnwejNvtf3v2sDFsjj2CecYUx0oNZCPI4BJczfH01XEKwmn5bzwB8IfQLLQ==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=262992, tp=239, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 11587
origin-agent-cluster: ?1

GET
H3 200 hM4SycfTajT.js Show response
static.xx.fbcdn.net/rsrc.php/v4izx64/yi/l/zh_TW-j/ Frame B1C4 20 KB
7 KB 72ms
70ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4izx64/yi/l/zh_TW-j/hM4SycfTajT.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f6001b27cd0a72c0ff6490b8661c588d8e8ed5f7dec3cfc464956a4e8fba3f81

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: +rrZFg85ZRW0fV5FFhQnfg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 18:12:28 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: Ebj9i4+DX6gQt275Aej+Y8ymQlHE+2WCpX90ummb4qkaBZDj3KVQfa0UID+8EO/BLKo93TZDH+GQGl4SZFPfBA==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=262992, tp=239, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 7238
origin-agent-cluster: ?1

GET
H3 200 v_kkAv_-wGQ.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yx/r/ Frame B1C4 24 KB
10 KB 73ms
72ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yx/r/v_kkAv_-wGQ.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f1c56a198201b67b6ccb53824985f9c142b0a1600c3696a13879b17b06050197

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: t3zOk8uL6qbnQiZrM32GhA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 00:58:59 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: JIwoqt230Z8nUQmsKmSeC1LTRsigIIH7Ze66tB/GPUqiidD73v+yNyPv9/ahazVReQ2QND1COU6uOcaYWSYFfw==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=61, rtx=0, c=186, mss=1232, tbw=262992, tp=239, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 10408
origin-agent-cluster: ?1

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame C318 325 KB
0 0ms
0ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-logOoN0e' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-logOoN0e' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=4928, tp=8, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HOA9pbCHoSN4FfR9D9kzbas3dA7ejojE0uvQ32a2qFsXMt72E47FU4i8OjZ0L1zPFxHFxdviQ1h1/kE7j0DXCA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame AE3B 0
194 B 35ms
34ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=cf&cid=undefined&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame AE3B 0
177 B 325ms
62ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=cf&referrer=https%3A%2F%2Freurl.cc

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET 302181889_449668210518240_1343224774275673253_n.png
scontent-tpe1-1.xx.fbcdn.net/v/t39.30808-1/ Frame B1C4 0
0

GET 186149949_5378375078904348_5830021147058150167_n.png
scontent-tpe1-1.xx.fbcdn.net/v/t1.6435-9/ Frame B1C4 0
0

GET 126199574_4593091710766026_7412644862123303221_n.jpg
scontent-tpe1-1.xx.fbcdn.net/v/t1.6435-9/ Frame B1C4 0
0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 111F 325 KB
0 0ms
0ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-logOoN0e' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-logOoN0e' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=64, rtx=0, c=23, mss=1232, tbw=4928, tp=8, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: HOA9pbCHoSN4FfR9D9kzbas3dA7ejojE0uvQ32a2qFsXMt72E47FU4i8OjZ0L1zPFxHFxdviQ1h1/kE7j0DXCA==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET jU145U5v66V.png
static.xx.fbcdn.net/rsrc.php/v4/yz/r/ Frame B1C4 0
0

GET MKQzjVd1bVq.png
static.xx.fbcdn.net/rsrc.php/v4/yD/r/ Frame B1C4 0
0

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame AE3B 46 B
418 B 159ms
52ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=zh-TW&ht=1764325205857&evtid=e74bc0bc-0ec7-46cd-a03a-040165c527ce&tid=5&cid=854231-x4NAF9WhAUP0lG1HHj5addSUnL61XlyV&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 373aeee449c2104761cb6bb6147c7763914351e8cdaad1b0bcc7efea126ff027

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:05 GMT
x-cloud-trace-context: 75ede3c1e8e8b905130fb4dbc6e38821
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame F302 46 B
226 B 168ms
63ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=zh-TW&ht=1764325205859&evtid=ba27047c-1d03-4bef-9777-44b2217384aa&tid=5&cid=854231-x4NAF9WhAUP0lG1HHj5addSUnL61XlyV&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:05 GMT
x-cloud-trace-context: 40d1fa4cce89d89e130fb4dbc6e38265
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 1698 46 B
228 B 158ms
54ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=zh-TW&ht=1764325205860&evtid=6992ead3-3c08-47e6-8416-688f889f2d6a&tid=5&cid=854231-x4NAF9WhAUP0lG1HHj5addSUnL61XlyV&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 95732f64b28b2b644a3ac24bdb509a2e8ba9921307b49f9dbcb7e3a84a07d2d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:05 GMT
x-cloud-trace-context: 28e8da917da3da05130fb4dbc6e38082
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 88C8 46 B
227 B 164ms
63ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=zh-TW&ht=1764325205862&evtid=1a7df896-cce1-474f-b09d-468ebd7b05e3&tid=5&cid=854231-x4NAF9WhAUP0lG1HHj5addSUnL61XlyV&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: a18afbee6378c5f4b93e8a6498fe3e081f9cdc9ae07feca9a4ae83744c31565b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: 30131ef581d0ffc5130fb4dbc6e389f1
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame C318 46 B
227 B 156ms
55ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=zh-TW&ht=1764325205863&evtid=f5ee53cc-499f-47bf-9e1c-58accdbc7ec2&tid=5&cid=854231-x4NAF9WhAUP0lG1HHj5addSUnL61XlyV&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 3d56db4864212f69b473b0435915a5e7594b6daac2e23501099d4a2a264998f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:05 GMT
x-cloud-trace-context: 64b80b03eba73e73130fb4dbc6e3880e
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 111F 46 B
228 B 156ms
55ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=zh-TW&ht=1764325205864&evtid=d9118c14-0ba1-4fe7-8618-4ae37fb80809&tid=5&cid=854231-x4NAF9WhAUP0lG1HHj5addSUnL61XlyV&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 2d6b8b10e5e7d0e1502a9f72a01b1c367d098cd0d067f27485af79a68d0bd14a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:05 GMT
x-cloud-trace-context: fbc69762852700a1130fb4dbc6e38e9f
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame B1C4 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B1C4 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame B1C4 155 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

POST
H3 204 AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 255ms
118ms XHR
text/html 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.zh_TW.YuPzVux5xnc.es5.O/d=1/rs=AJlcJMycHAU_RLRhSFgZT8BAU8elzIt3zg/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6rzvYcqxchETV_GEs0Jdfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmJw0ZBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRC3BzX3i09ySbw4tJaGyWXpPzC-OT8vJLUvBLdxJRiXRC7KDOptCS_CIWdWgZSkZOfnp6Zlx5vZGBkamhoaKFnYB5fYAAAO_s09A"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-6rzvYcqxchETV_GEs0Jdfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-D0EgwmfaHHwXjzir2ILiLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw05Bi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRC3BzX3i09ySbwo22apZJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyNTQ0tNAzMI8vMAAAKTg0qA"
content-security-policy: script-src 'report-sample' 'nonce-D0EgwmfaHHwXjzir2ILiLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxVTgxaZbKdyYWkVVObjVu9gKscMZD0JfGQYcmNpQ3VpjsfqB9JFWqy9heaLe4rR2yWLivAgH-YLqnHn3Py-KNR9PG8NAShujMLgKZt4mi0YErrF-Hvpsy1Ce2zDasdK7fB_VV6ucw== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 116ms
115ms Script
application/javascript 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVTgxaZbKdyYWkVVObjVu9gKscMZD0JfGQYcmNpQ3VpjsfqB9JFWqy9heaLe4rR2yWLivAgH-YLqnHn3Py-KNR9PG8NAShujMLgKZt4mi0YErrF-Hvpsy1Ce2zDasdK7fB_VV6ucw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0MzI1MjA1LDk0OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9yZXVybC5jYy9OTnJxNjkiLG51bGwsW1s4LCJZdVB6VnV4NXhuYyJdLFs5LCJ6aC1UVyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

01d17ae72ece52947b8a083d56ffc344e092239f56a7ee1e781f85c8c7fffec9

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5pvY0UYIhMEzU5xErkD_Aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJi8NSQYmi9eY51MhB3LTrPOgOIDRUusdoD8Yf6y6w_gLhI4gprAxB_qrrBKlB9gzWJ_SZrARCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwsJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRA3x7V3S0-yCTT8mcqupJGUXxifnJ9XUpSZVFqSX5SWnJZanFpUlloUb2RgZGpoaGihZ2AaX2AAAHukRy4"
content-security-policy: script-src 'report-sample' 'nonce-5pvY0UYIhMEzU5xErkD_Aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 140ms
34ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 665813
x-goog-stored-content-encoding: gzip
expires: Fri, 20 Nov 2026 17:23:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 20 Nov 2025 17:23:13 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AOCedOEKmls_J8dDbgRXiNXmf5dYkWH6BQGbBUXRtF4CKVpqeNscQqxcaSW36qVSZ-uUOLU
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 43 KB
13 KB 264ms
99ms Script
text/javascript 3.173.219.77
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.173.219.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-173-219-77.nrt20.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"a01b40a9ecb8db243294facf32753015"
age: 54314
via: 1.1 91ea4800b714e4bf02bff4b99c0dad5c.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: HAvj_RLrq8Otu5u4ArrOVE5C6aL47vgnOkkTQIDzqQGVtB3aI2QRLA==
date: Thu, 27 Nov 2025 19:14:53 GMT
content-type: text/javascript
last-modified: Thu, 16 Oct 2025 16:30:59 GMT
server: AmazonS3
x-amz-cf-pop: NRT20-P8
x-amz-server-side-encryption: AES256

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 440ms
329ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 8f3ff08ffcd6f109baeda5f08b34c31d

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 98ms
98ms Script
text/javascript 182.161.74.47
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.47 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

730b0155c953fb939df04b102b4a3028c6affd25cbaa7fb2fc9d298eea213c35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
expires: Sat, 29 Nov 2025 10:20:05 GMT
access-control-allow-origin: *
date: Fri, 28 Nov 2025 10:20:05 GMT
content-type: text/javascript
vary: x-geo-country
server: nginx

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 18 KB
7 KB 171ms
64ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8da9b8dc7a16d03966226d79b3ab81fac5710dd28a52a6769568fdd4ac789159

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"68c447fb-47f6"
age: 203305
cf-ray: 9a59217a0959844b-TPE
expires: Mon, 01 Dec 2025 10:20:06 GMT
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/javascript
last-modified: Fri, 12 Sep 2025 16:19:07 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
460 B 434ms
433ms Fetch
text/plain 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=8702320837137164&correlator=2197007447901763&eid=83321072&output=ldjh&gdfp_req=1&vrg=202511120101&ptt=17&impl=fifs&gdpr=0&iu_parts=21787810958%2CTW_reurl.cc_res_all_truvid_1x1%2CTW_reurl.cc_res_allsite_top_avs&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=300x250%7C336x280%7C1x1%2C1x1&ifi=1&didk=3347717449~2825456951&dids=ats-slider-10~ats-insert_ads-8&adfs=2335287240~3992581161&sfv=1-0-45&sc=1&cookie_enabled=1&abxe=1&dt=1764325205965&lmt=1764325205&adxs=15%2C800&adys=33%2C171&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=1%7C2&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Freurl.cc%2FNNrq69&vis=1&psz=1570x0%7C1600x0&msz=1570x0%7C1600x0&fws=0%2C0&ohw=0%2C0&a3p=EhwKDWNyd2RjbnRybC5uZXQYyM_oz6wzSABSAghkEhQKBW9wZW54GMjP6M-sM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjIz-jPrDNIAFICCGQSGwoMMzNhY3Jvc3MuY29tGMjP6M-sM0gAUgIIZBIXCghydGJob3VzZRjIz-jPrDNIAFICCGQ.&psd=WzMxLFtdXQ..&dlt=1764325203919&idt=1432&cust_params=url%3D%252FNNrq69%26ref%3Dnull%26Audience_Segment%3D%25E6%258A%2595%25E8%25B3%2587%25E7%2590%2586%25E8%25B2%25A1%252C%25E9%2581%258B%25E5%258B%2595%25E6%259C%258D%25E9%25A3%25BE%252C%25E5%25BE%25A9%25E5%258F%25A4%25E9%25A2%25A8%25E6%25A0%25BC&adks=3936558959%2C940499867&frm=20&eoidce=1&pgls=CAs.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcnrta-bj-in-f1.1e100.net

Software

cafe /

Resource Hash

241a92004c1d925b41719adaf564c2bc8de9c4d7c82478e6fbdc8eabccc2de77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: dcb
google-lineitem-id: -2,-2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2,-2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -2,-2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 430
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
d1af911928fcd7d038546cecc13fb8b5.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame F782 7 KB
3 KB 247ms
106ms Document
text/html 142.250.193.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://d1af911928fcd7d038546cecc13fb8b5.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.193.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:06 GMT
expires: Fri, 28 Nov 2025 10:20:06 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 did Show response
track.91app.io/ext/v1/ Frame AE3B 46 B
226 B 47ms
45ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: 917a4a87f77e626b130fb4dbc6e3811e
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame F302 46 B
66 B 61ms
44ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: 6b94de38eab3b9a5ad1e4e5a459ad616
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 1698 46 B
66 B 73ms
42ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: 30afeae45c037c8dad1e4e5a459ad774
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 88C8 46 B
66 B 83ms
44ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: 57bc1da1cc26e05aad1e4e5a459ad7cd
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame C318 46 B
66 B 89ms
44ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: dc74f509ab537897ad1e4e5a459add42
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 111F 46 B
66 B 100ms
43ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 763349db206812106fbec967969edf76eaeaa0f7a5b0e5ceb857fa9a599ce8a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Fri, 28 Nov 2025 10:20:06 GMT
x-cloud-trace-context: 1bb9bbc2dacb38dead1e4e5a459ad92e
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 44C5 105 KB
0 0ms
0ms Script
text/javascript 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f95a4fc0dc57f84954907d7ad02624f85dc4134c0df86e6b9ac1bc42d51bd62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 670 / 20420 / m202511120101 / config-hash: 14247479607061606112
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34314
x-xss-protection: 0
server: cafe

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 8EF7 0
187 B 38ms
37ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame 8EF7 0
177 B 231ms
63ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame E26C 105 KB
0 0ms
0ms Script
text/javascript 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f95a4fc0dc57f84954907d7ad02624f85dc4134c0df86e6b9ac1bc42d51bd62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 670 / 20420 / m202511120101 / config-hash: 14247479607061606112
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:04 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34314
x-xss-protection: 0
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame E09D 422 KB
143 KB 115ms
114ms Script
application/javascript 142.250.194.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

42b372b76d5aa329a819e8148803c4bf38d82caaa0dcb23e997a971dbffa0157

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Fri, 28 Nov 2025 10:20:06 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146334
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 main.js Show response
cdn.holmesmind.com/module/product/inner/inner_image/ Frame C3C5 26 KB
27 KB 69ms
68ms Script
application/javascript 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/module/product/inner/inner_image/main.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 651219c93cab2078fb7f9f5f3d091d56009b1108ff95b312d5b518a8639fbf2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 5eDfF61po8mbPAqic7Z9nmad18STHB0v
etag: "9570d1addd7f3b91ecb1c725d51a1458"
age: 258
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 26746
x-amz-cf-id: caTpfBj3P83SjhmHQvtDw--9ayLo1expjZoNTEQo2r9OhhZaEUol1A==
date: Fri, 28 Nov 2025 10:15:49 GMT
content-type: application/javascript
last-modified: Wed, 21 Aug 2024 05:57:19 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame AF89 0
177 B 315ms
32ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame AF89 0
187 B 95ms
65ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame C3C5 0
177 B 390ms
34ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame C3C5 0
187 B 141ms
46ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame EFE4 0
177 B 462ms
33ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame EFE4 0
187 B 176ms
35ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame EAC3 0
177 B 534ms
34ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame EAC3 0
187 B 213ms
37ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame E09D 0
177 B 606ms
33ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame E09D 0
187 B 248ms
35ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame DD91 0
177 B 458ms
33ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:06 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame DD91 0
187 B 311ms
62ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/ Frame B83D 0
177 B 440ms
33ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://2669fed8-2dd3-455e-bd33-425a6a429d3a.t.ssp.hinet.net/pixel?bd=2669fed8-2dd3-455e-bd33-425a6a429d3a&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Fri, 28 Nov 2025 10:20:07 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame B83D 0
187 B 383ms
72ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=257-UdYgWHLJAc9f56H1K4tdcvqaMgKruCKb&mp=2669fed8-2dd3-455e-bd33-425a6a429d3a

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
vary: Origin
server: nginx

GET cm
ad.holmesmind.com/adserver/ Frame AE3B 0
0

GET cm
ad.holmesmind.com/adserver/ Frame F302 0
0

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/ Frame 44C5 608 KB
0 0ms
0ms Script
text/javascript 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 6518253978845184816
age: 68531
x-content-type-options: nosniff
expires: Fri, 27 Nov 2026 15:17:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 27 Nov 2025 15:17:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 196693
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/ Frame E26C 608 KB
0 0ms
0ms Script
text/javascript 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 6518253978845184816
age: 68531
x-content-type-options: nosniff
expires: Fri, 27 Nov 2026 15:17:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 27 Nov 2025 15:17:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 196693
x-xss-protection: 0
server: cafe

GET cm
ad.holmesmind.com/adserver/ Frame 1698 0
0

GET cm
ad.holmesmind.com/adserver/ Frame 88C8 0
0

GET cm
ad.holmesmind.com/adserver/ Frame C318 0
0

GET cm
ad.holmesmind.com/adserver/ Frame 111F 0
0

GET
H2 200 i
ad.holmesmind.com/adserver/ Frame C3C5 0
64 B 70ms
70ms Image
image/png 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ad.holmesmind.com/adserver/i?ut=1764325205&p=14210:182968:282987:03a9ec82ef5c7940f830bd9d0f6db8d6:14756
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: image/png
server: nginx

GET
H2 200 b65c4417ce06f35ec7c966807bbc588d.gif
cdn.holmesmind.com/image/14756/ Frame C3C5 93 KB
93 KB 68ms
68ms Image
image/gif 3.164.121.117
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/image/14756/b65c4417ce06f35ec7c966807bbc588d.gif
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.164.121.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-164-121-117.nrt12.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f18e0f17847679ea2ae00c26f95efeb8d21873e19e46a12d7aa0f921a85d3e35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: dPGBF_qqc2q7TK53fb4nKNeqy92FJ_X_
etag: "43e0987e1e23f0bf50251fa6c427b26f"
age: 68599
via: 1.1 18a61a52bb16676aaaca30bd65a0ca86.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 94959
x-amz-cf-id: _ziPflkq6aDS7KWIEs8wUSsZczDwJwD21kqNFwkvwhgjsjylhfCx_g==
date: Thu, 27 Nov 2025 15:16:48 GMT
content-type: image/gif
last-modified: Thu, 24 Jul 2025 08:39:03 GMT
server: AmazonS3
x-amz-cf-pop: NRT12-P3
x-amz-server-side-encryption: AES256

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 44C5 17 KB
13 KB 232ms
126ms XHR
application/json 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202511120101&st=env&sjk=4171034283416112

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f285d16fb5b91815b8f307703bba600e74577d34367a94b3ef5d294e4114c25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13490
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 44C5 25 KB
2 KB 327ms
327ms Fetch
text/plain 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4171034283416112&correlator=4405843596595548&eid=31093611%2C83321072%2C83322601&output=ldjh&gdfp_req=1&vrg=202511120101&ptt=17&impl=fifs&gdpr=0&iu_parts=128002626%2CMFPB_202505_13861&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&didk=1074775047&dids=div-gpt-ad-1749117348435-0&adfs=3242713779&sfv=1-0-45&sc=1&cookie=ID%3D47edeabd84beb4fd%3AT%3D1764325206%3ART%3D1764325206%3AS%3DALNI_MZIWQLRRfEefErUPWEH1i0FUfCXYQ&gpic=UID%3D000013155af5cb05%3AT%3D1764325206%3ART%3D1764325206%3AS%3DALNI_MaJ6JCGvA8IH4BYN4M8TknMo7a7Bg&abxe=1&dt=1764325206488&lmt=1764325206&adxs=650&adys=525&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=pb7dl8a75zsq&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=2&url=https%3A%2F%2Freurl.cc%2FNNrq69&ref=https%3A%2F%2Freurl.cc%2FNNrq69&top=https%3A%2F%2Freurl.cc%2FNNrq69&vis=1&psz=300x250&msz=300x250&fws=256&ohw=0&psd=WzMxLFtdXQ..&dlt=1764325206243&idt=147&adks=110384004&frm=23&eo_id_str=ID%3De663e5718e10199e%3AT%3D1764325206%3ART%3D1764325206%3AS%3DAA-AfjZ2dued6G-xuoYzr-NeaThT

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c1236bc7ebd08ab0c4bb314bf8855d086bd3f79580c6ac5552795b09bda5f380

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: dcb
google-lineitem-id: 7012400388
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138520038605
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 2514
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 9882 7 KB
3 KB 251ms
111ms Document
text/html 142.250.196.129
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.196.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:06 GMT
expires: Fri, 28 Nov 2025 10:20:06 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame E26C 18 KB
13 KB 211ms
137ms XHR
application/json 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gpt&tv=m202511120101&st=env&sjk=8004782990982145

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c298a7b68745089ff8b057c030c8a837a69001f837712dbc498458867b476679

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13527
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame E26C 80 KB
13 KB 563ms
563ms Fetch
text/plain 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=8004782990982145&correlator=2049596011947371&eid=83321073%2C83322601%2C95340253%2C95340255&output=ldjh&gdfp_req=1&vrg=202511120101&ptt=17&impl=fifs&gdpr=0&iu_parts=128002626%2CMFPB_202505_18535&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x480&ifi=1&didk=3019717991&dids=div-gpt-ad-1747900979112-0&adfs=2697053189&sfv=1-0-45&sc=1&cookie=ID%3D47edeabd84beb4fd%3AT%3D1764325206%3ART%3D1764325206%3AS%3DALNI_MZIWQLRRfEefErUPWEH1i0FUfCXYQ&gpic=UID%3D000013155af5cb05%3AT%3D1764325206%3ART%3D1764325206%3AS%3DALNI_MaJ6JCGvA8IH4BYN4M8TknMo7a7Bg&abxe=1&dt=1764325206516&lmt=1764325206&adxs=640&adys=360&biw=1600&bih=1200&isw=320&ish=480&scr_x=0&scr_y=0&btvi=0&ucis=5o2bzu3zjk95&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&nhd=2&url=https%3A%2F%2Freurl.cc%2FNNrq69&ref=https%3A%2F%2Freurl.cc%2FNNrq69&top=https%3A%2F%2Freurl.cc%2FNNrq69&vis=1&psz=320x480&msz=320x480&fws=256&ohw=0&psd=WzMxLFtdXQ..&dlt=1764325206258&idt=166&adks=2045691737&frm=23&eo_id_str=ID%3De663e5718e10199e%3AT%3D1764325206%3ART%3D1764325206%3AS%3DAA-AfjZ2dued6G-xuoYzr-NeaThT

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0731fa4a9b834517fe17261df6f894bb540498351f2752cc55823d4213eb761d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: x-google-amp-ad-validated-version
content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 13553
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
7f9c288768be60709f146eaabce96031.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 4DC7 7 KB
3 KB 247ms
107ms Document
text/html 142.250.194.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://7f9c288768be60709f146eaabce96031.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

del12s06-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:06 GMT
expires: Fri, 28 Nov 2025 10:20:06 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
analytics.google.com/g/ Frame E09D 0
0 42ms
42ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-M4J67EDHV2&gtm=45je5bi1v9235662620za200zd9235662620&_p=1764325206263&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&cid=359362692.1764325205&ul=zh-tw&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=1&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391252~115583767~115938466~115938468~116184927~116184929~116217636~116217638&sid=1764325206&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1888
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ Frame E09D 0
48 B 40ms
38ms Ping
text/plain 74.125.204.157
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-M4J67EDHV2&cid=359362692.1764325205&gtm=45je5bi1v9235662620za200zd9235662620&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391252~115583767~115938466~115938468~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.125.204.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ti-in-f157.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.com.tw/ads/ Frame E09D 42 B
107 B 111ms
109ms Image
image/gif 172.217.31.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com.tw/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-M4J67EDHV2&cid=359362692.1764325205&gtm=45je5bi1v9235662620za200zd9235662620&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391252~115583767~115938466~115938468~116184927~116184929~116217636~116217638&z=33652536

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.31.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 collect
analytics.google.com/g/ Frame E09D 0
0 37ms
37ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-M4J67EDHV2&gtm=45je5bi1v9235662620za200zd9235662620&_p=1764325206263&_gaz=1&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&cid=359362692.1764325205&ul=zh-tw&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=1&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391252~115583767~115938466~115938468~116184927~116184929~116217636~116217638&sid=1764325206&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=&en=scroll&epn.percent_scrolled=90&tfd=1900
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 ga-audiences
www.google.com.tw/ads/ Frame E09D 42 B
107 B 164ms
163ms Image
image/gif 172.217.31.131
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.com.tw/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-M4J67EDHV2&cid=359362692.1764325205&gtm=45je5bi1v9235662620za200zd9235662620&aip=1&dma=0&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&frm=1&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~105391252~115583767~115938466~115938468~116184927~116184929~116217636~116217638&z=1006717506

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.31.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:06 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame C3C5 351 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f31502bd8b58a334acc32b695f096fde6dd136fa1106f2d2d9fb4825d41b1abb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 47DD 15 KB
6 KB 334ms
171ms Document
text/html 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

b2c8ea897dfa399f29a52d8a0a9cbd5e2dec7f5802ae9be475075fc062d2dcd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:06 GMT
server: Kestrel
server-processing-duration-in-ticks: 1015190
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

POST
H3 204 AGSKWxWAQF7KveOKRogB_sOCF06qYgv4v1kkaS-UbNXXGeeKgbMpCIBypYqkFy6GSW-hXMKT0HJidcKvkNsR3YyatcZDdSAca-x9MrkKz0x0rMNtN0MQzzdwXYqVU9JWpHnCZoJjHRUl3A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 116ms
113ms XHR
text/html 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWAQF7KveOKRogB_sOCF06qYgv4v1kkaS-UbNXXGeeKgbMpCIBypYqkFy6GSW-hXMKT0HJidcKvkNsR3YyatcZDdSAca-x9MrkKz0x0rMNtN0MQzzdwXYqVU9JWpHnCZoJjHRUl3A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-U0iJ77mVzfF5aXiqAWWiIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw1JBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBzX3i09ySaw4MWvR0xKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyNTQ0NBCz8A8vsAAAJFoNb0"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-U0iJ77mVzfF5aXiqAWWiIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXwWd8dvg5s0e9uH3d_HxNC0x1iloSegoSNgfeG2_AWgEPPrDU-szMMUr4wCAHfkLROYwBGjNUeOl95tt5gQSddZ90N9NLW4mGu_S1O8US5eGLqPAGdw44xFOVOi0HQjf4zBpSmQw== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 130ms
130ms Script
application/javascript 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXwWd8dvg5s0e9uH3d_HxNC0x1iloSegoSNgfeG2_AWgEPPrDU-szMMUr4wCAHfkLROYwBGjNUeOl95tt5gQSddZ90N9NLW4mGu_S1O8US5eGLqPAGdw44xFOVOi0HQjf4zBpSmQw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0MzI1MjA2LDY4NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcmV1cmwuY2MvTk5ycTY5IixudWxsLFtbOCwiWXVQelZ1eDV4bmMiXSxbOSwiemgtVFciXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-77-94-58.ap-southeast-1.compute.amazonaws.com

Software

ESF /

Resource Hash

1bcb28a64aef112df6c0abb1b6d517f8740e3e39fffa8d16174b6636edd56bd5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-gXyqlHK7GBzjz4IYn-a0eQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJi8NKQYmi9eY51MhB3LTrPOgOIDRUusdoD8Yf6y6w_gLhI4gprAxB_qrrBKlB9gzWJ_SZrARCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwsJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRAPx7V3S0-yCUx4_v41k5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpoaGhhZ6BaXyBAQDr8Uhr"
content-security-policy: script-src 'report-sample' 'nonce-gXyqlHK7GBzjz4IYn-a0eQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
609 B 197ms
194ms XHR
application/json 52.77.94.58
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://bcp.crwdcntrl.net/6/map?xcid=16589

Requested by

Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.77.94.58 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0b1d1f34dbb631309a62e65d6c1e34422c7133ba181cb416c96b261533595284

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://reurl.cc
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/json;charset=utf-8

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/ Frame 44C5 64 KB
0 0ms
0ms Other
text/plain 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17914686685964197562
age: 65916
x-content-type-options: nosniff
expires: Thu, 04 Dec 2025 16:01:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 27 Nov 2025 16:01:29 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23115
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202511110101"

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/ Frame E26C 64 KB
0 1ms
1ms Other
text/plain 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17914686685964197562
age: 65916
x-content-type-options: nosniff
expires: Thu, 04 Dec 2025 16:01:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 27 Nov 2025 16:01:29 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23115
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202511110101"

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame E26C 20 KB
7 KB 361ms
151ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
etag: "1747411493688989"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 7188
x-xss-protection: 0
server: sffe

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 44C5 20 KB
0 349ms
349ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
etag: "1747411493688989"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 7188
x-xss-protection: 0
server: sffe

GET
H3 200 container.html Show response
8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 1002 7 KB
0 0ms
0ms Document
text/html 142.250.196.129
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.196.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:06 GMT
expires: Fri, 28 Nov 2025 10:20:06 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-45/js/ Frame 1002 23 KB
7 KB 346ms
144ms Script
text/javascript 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-45/js/ext.js

Requested by

Host: 8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com
URL: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c95e84767aed248594e7d485707c7ed904fd2fe4ec3ea98687fc2de59ddf231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 08 May 2025 23:15:48 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6269
x-xss-protection: 0
server: sffe

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1002 158 KB
54 KB 256ms
119ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4126554779393986

Requested by

Host: 8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com
URL: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f38fec79995c845c81d5ae0c9a2a74d80925f47a48084b66347487a622e85793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 15526935779495551405
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 55153
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 1002 223 KB
69 KB 211ms
70ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com
URL: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1ca0d5744e4f39ea464be06f38e214eabd97b2ca934e919a3673f0a62f76368c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11779502037942753168
age: 2933
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:31:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 09:31:14 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 70282
x-xss-protection: 0
server: cafe

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 241ms
103ms Fetch
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.199.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt13s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 47DD 427 B
913 B 97ms
96ms Fetch
application/json 182.161.74.19
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=reurl.cc&sn=ChromeSyncframe&so=0&topUrl=reurl.cc&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.74.19 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

f64534659ad01909cc42a5911b1ed7c861d5b12af9ba826ef28af0f9a38637b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1070098
expires: 0
date: Fri, 28 Nov 2025 10:20:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012509301838000/ Frame 15F7 196 KB
56 KB 364ms
106ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cdn.ampproject.org/rtv/012509301838000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8f53d3b054e3ef69bb8bfaea96a56f27de474b13d1a904a01dcf6c941f26945

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: "0561256f6a7f81fb"
age: 143661
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 18:25:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 18:25:46 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 56062
x-xss-protection: 0
server: sffe

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012509301838000/v0/ Frame 15F7 15 KB
5 KB 420ms
162ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cdn.ampproject.org/rtv/012509301838000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d70504ff3c9e5551a2e1358a46c29a6ce986e878931363b4c35f51b8d408f01

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: "dea7c6f2a6d5c8f5"
age: 92667
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Fri, 27 Nov 2026 08:35:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 27 Nov 2025 08:35:40 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 5223
x-xss-protection: 0
server: sffe

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012509301838000/v0/ Frame 15F7 95 KB
28 KB 424ms
166ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cdn.ampproject.org/rtv/012509301838000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3019d2e56dc3f0f0111a19026974ec78159ffabe5d7b94ca93898c9a08ebccda

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: "c3793ea3b2771ef6"
age: 102439
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Fri, 27 Nov 2026 05:52:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 27 Nov 2025 05:52:48 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 29018
x-xss-protection: 0
server: sffe

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012509301838000/v0/ Frame 15F7 5 KB
2 KB 447ms
189ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cdn.ampproject.org/rtv/012509301838000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2573dafb426ef28094543ed7629313ce3a0bc37819f3efe02cb901d47ba29e11

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: "59bb8566f3e5df7f"
age: 137952
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 20:00:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 20:00:55 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 1918
x-xss-protection: 0
server: sffe

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012509301838000/v0/ Frame 15F7 40 KB
13 KB 441ms
183ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cdn.ampproject.org/rtv/012509301838000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

del12s05-in-f10.1e100.net

Software

sffe /

Resource Hash

76b6b82b657ee6785b93ad5e5a14ea9a5bec880a6c0a9d7e6be5501830f29fc9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: "c62fd38443903192"
age: 137535
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 20:07:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 20:07:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
content-length: 12948
x-xss-protection: 0
server: sffe

GET
H2 200 css
fonts.googleapis.com/ Frame 15F7 11 KB
2 KB 352ms
146ms Stylesheet
text/css 142.250.194.138
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3ae8c189a16cda4e543ffa4da61384d726aeffa701ad4778cad607b8f76462

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 28 Nov 2025 09:45:49 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/17107251658583596651/ Frame 15F7 14 KB
14 KB 310ms
106ms Image
image/jpeg 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17107251658583596651/14763004658117789537?w=400&h=209&tw=1&q=75

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a36865cb6301f59e4203ed9682bda95f3ef84d24bc14926f4e0e7b1c3c71977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

age: 353988
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Tue, 24 Nov 2026 08:00:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Mon, 24 Nov 2025 08:00:19 GMT
last-modified: Tue, 01 Apr 2025 19:28:59 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 14202
x-xss-protection: 0
server: sffe

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/13074634526266887726/ Frame 15F7 2 KB
2 KB 320ms
116ms Image
image/jpeg 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13074634526266887726/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7545b7d7d334604f1b0d058db330a656002cd9cbb5f9a1606ef5cebdff30726

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

age: 94695
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Fri, 27 Nov 2026 08:01:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 27 Nov 2025 08:01:52 GMT
last-modified: Tue, 01 Apr 2025 19:28:59 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 2402
x-xss-protection: 0
server: sffe

GET
DATA 200
OK truncated
/ Frame 15F7 217 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1727d82c091d5aced2d4e7e155b4bf538c47b5547258a8dd12ea8692818781dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 zh_tw.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 15F7 3 KB
3 KB 317ms
119ms Image
image/png 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/zh_tw.png

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a956a6fe1ee57805393bf1781b32486b4ed9ca402a04320280e59a18bc348a87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
etag: 7688947696963022458
age: 77207
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 12:53:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 3430
x-xss-protection: 0
date: Thu, 27 Nov 2025 12:53:20 GMT
content-type: image/png
vary: Accept-Encoding
server: cafe

GET
H2 200 adchoices_blue_wb.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 15F7 209 B
578 B 303ms
105ms Image
image/png 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/adchoices_blue_wb.png

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

135fe1822959b8811afafc20effec079f339c96788df6e47e933a7d0c267921b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: public, max-age=86400
timing-allow-origin: *
etag: 2799713854418114702
age: 33408
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Sat, 29 Nov 2025 01:03:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 209
x-xss-protection: 0
date: Fri, 28 Nov 2025 01:03:19 GMT
content-type: image/png
vary: Accept-Encoding
server: cafe

GET l
www.google.com/ads/measurement/ Frame 15F7 0
0

GET adview
securepubads.g.doubleclick.net/pagead/ Frame 15F7 0
0

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/237/ Frame D980 13 KB
5 KB 305ms
105ms Document
text/html 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 516
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5044
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:11:31 GMT
expires: Fri, 28 Nov 2025 11:01:31 GMT
last-modified: Tue, 13 May 2025 23:17:50 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CE20 829 B
569 B 247ms
113ms Document
text/html 142.251.42.196
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s47-in-f4.1e100.net

Software

ESF /

Resource Hash

4520a369ffd8ae183f2962170044577d9d205b01993a21aa54da1af3f1a6bf0b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PtgFS_Jd5jo0UPX4N9RtzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-PtgFS_Jd5jo0UPX4N9RtzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:07 GMT
expires: Fri, 28 Nov 2025 10:20:07 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/237/ Frame 4BCB 13 KB
0 302ms
302ms Document
text/html 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 516
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5044
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:11:31 GMT
expires: Fri, 28 Nov 2025 11:01:31 GMT
last-modified: Tue, 13 May 2025 23:17:50 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 93ED 829 B
0 244ms
244ms Document
text/html 142.251.42.196
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s47-in-f4.1e100.net

Software

ESF /

Resource Hash

4520a369ffd8ae183f2962170044577d9d205b01993a21aa54da1af3f1a6bf0b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PtgFS_Jd5jo0UPX4N9RtzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-PtgFS_Jd5jo0UPX4N9RtzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:07 GMT
expires: Fri, 28 Nov 2025 10:20:07 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1002 0
0 246ms
109ms Fetch
image/gif 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst2EphTt1oJZIbNH-WwMY6mNkZyM3qECu0SZokszlm84fFM0CYQiAcOV4h_2mXStB3dr6Hs03RzR1wr37FC2yrFlJ6aG_s9r1u-mllD1lHKWyiT6n3bjAibCLGPJAgsivfD1pW8OsAaUXKtXwftXj6AQXXTBy9dG5IFzq9I3xe7wms_O8fY4JPdcEakthxKHD5tONNOkYiPa4b6zB0v-j314uOLcCmIfo3RU_4ATEBiJI1fsujKqCMUSxqgcVI2BbtffszwoyD3e-HnJKbeNY59uCUOMN5orLteRnvp81VsGefMV4wcKQPqIVGTHZFT2YH6N5ZHrR5pB96Ohr-WhD2ew9ii7t_Z4K6dDucOE4QqDddG_vv2TU44gX8NCfwobXtSqkDg7tefiUhaYKl_-LqKUQxew7USecFL0DhvYLVDiA5s1m_zy0PrSQ&sai=AMfl-YQ_lyQPDLoYa0kfg1tJoKpJ65VfLX9geQCWXquWy19rSSHdVf_p8yRT6eKc6Zd6zyGojvIStb2lmWe2UqG0FRKCjgBVe2-YRLmpA0SNGShPOi5b_olR8zJZ4onCBksWSVFUpRnsfM0yUgR1O4qhTGiYk_6r5xkoR5BVDzXiPKDcX_s3_ssTkVSSKq03olPg0-ELJtg_h0CqpdM_cdL6J113Vf3L2_VgTfgiM6RdgwiP4Cv5P87D2hdZVW6WP0eTvwccOg&sig=Cg0ArKJSzH5_KyyWMPCLEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: 8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com
URL: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html?n=2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1002 0
0 104ms
104ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1002 0
0 106ms
105ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/ Frame 1002 505 KB
166 KB 70ms
69ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4126554779393986

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8bf73cbf11eab9f74ac440180025f241fb9079727ad7592f870843ab1debc852

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 9780944016848928500
age: 10508
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 07:24:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 07:24:59 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 170351
x-xss-protection: 0
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1002 0
0 109ms
109ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 1002 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b58415d06af63d1f37335a7460599767b329a861f6abb3fd1b534db49e5bceb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CE20 0
17 B 107ms
107ms Image
image/ 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=237&li=gpt_m202511120101&jk=8004782990982145&rc=

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 93ED 0
17 B 110ms
110ms Image
image/ 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=237&li=gpt_m202511120101&jk=4171034283416112&rc=

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H3 200 imp Show response
fundingchoicesmessages.google.com/f/AGSKWxUro0YFCxLO-C2CCbZuNCx15YdlkQfq7fw-hMZ9z6ijbWJPnF566W0ezL5MJ7iHlAPIoP2ocMVj481cndnW3Xsh_-QpOUjofRULugNHE7X5pAKEcOjXrzhsBeGfuNxN5WJqT8O2JHRVt2cewzTZQ908VPCjB... 54 B
109 B 113ms
112ms Script
application/javascript 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUro0YFCxLO-C2CCbZuNCx15YdlkQfq7fw-hMZ9z6ijbWJPnF566W0ezL5MJ7iHlAPIoP2ocMVj481cndnW3Xsh_-QpOUjofRULugNHE7X5pAKEcOjXrzhsBeGfuNxN5WJqT8O2JHRVt2cewzTZQ908VPCjBrIqfimav342Eo9FP9q1moV3Lo99NXK2/_/exads-/imp?slot=-adtopbanner-_460x60./js/adv.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.zh_TW.YuPzVux5xnc.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMycHAU_RLRhSFgZT8BAU8elzIt3zg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fb5274cf17ceee50d9bffc98538d8799490cf42e13cb0f9e02ced5a1a9a72ce6

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-6flxNq5Ge5TSzXTCx6-zFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJicNOQYmi9eY51MhB3LTrPOgOIDRUusdoD8Yf6y6w_gLhI4gprAxB_qrrBKlB9gzWJ_SZrARCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwsJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRAPx_V3S0-yCex4Ov85o5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpoaGhhZ6BaXyBAQDhR0g5"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-6flxNq5Ge5TSzXTCx6-zFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 32 KB
12 KB 106ms
104ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.zh_TW.YuPzVux5xnc.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMycHAU_RLRhSFgZT8BAU8elzIt3zg/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f63606a93e83a227e907a26a2d83b916b52bc75bf5c66dd58a7cd9098041550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 17158810801992136094
age: 3269
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:25:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 09:25:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 11965
x-xss-protection: 0
server: cafe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-ri_YOBE8dbI7cgoOFcwFpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw0ZBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBzX3y09ySawYV7zM0Yll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpoaGihZ2AeX2AAAGGfNRM"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-ri_YOBE8dbI7cgoOFcwFpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame 44C5 0
0 107ms
107ms Fetch
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.199.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt13s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame E26C 0
0 104ms
103ms Fetch
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.199.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt13s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

GET
H2 200 av Show response
ad.holmesmind.com/adserver/ Frame C3C5 0
139 B 69ms
69ms Script
text/html 52.197.35.142
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/av?p=14210:182968:282987:03a9ec82ef5c7940f830bd9d0f6db8d6:14756&type=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/drawV2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.197.35.142 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-197-35-142.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx

GET
H3 200 _sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js Show response
pagead2.googlesyndication.com/bg/ Frame D980 53 KB
20 KB 71ms
71ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fec7e21915a572698f670f8c84401660be1cd68d73f16e42cbc505cbe8f8f708

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 203448
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 01:49:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 01:49:19 GMT
last-modified: Tue, 18 Nov 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20897
x-xss-protection: 0
server: sffe

GET
H3 200 _sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js Show response
pagead2.googlesyndication.com/bg/ Frame 4BCB 53 KB
0 71ms
71ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fec7e21915a572698f670f8c84401660be1cd68d73f16e42cbc505cbe8f8f708

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 203448
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 01:49:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 01:49:19 GMT
last-modified: Tue, 18 Nov 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20897
x-xss-protection: 0
server: sffe

GET
H3 200 KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v50/ Frame 15F7 39 KB
39 KB 217ms
71ms Font
font/woff2 172.217.31.163
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v50/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.31.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s22-in-f3.1e100.net

Software

sffe /

Resource Hash

20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://fonts.googleapis.com/

Response headers

age: 226927
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 25 Nov 2026 19:18:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 25 Nov 2025 19:18:00 GMT
last-modified: Tue, 18 Nov 2025 19:00:07 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 40128
x-xss-protection: 0
server: sffe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 1002 0
0 186ms
185ms Fetch
image/gif 172.217.175.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuP4GdhM3xJWn6elAg87hicyWeoHphF9nAAmM3hBfu33UGnRjPUyrfYBLWo-JxFvispwBSDutVDfSK0KgzXxQzvgGv9remSPZsfKy5ddeZn_sNA1CoP1ggEBDpEaRyUCn2wqJjA6Kfn92tixOiZ2YTh6OY__g1NNPnVRPlVh3huGZ0EjdgYkBsw2q6GISu4-YGg1sxdQWrCf4uZEmDYdEjdlw2FItwAJatCUPevVepjyhzwJuXtqKiYKz70MI7JY0esbg1ce48yoGNHHx6CTwRAQn6IyBKymbRkDBWUK4-y9mmZ0KXcwE62kDPe5rmQdaxntdlJscLNG0ekxfdvxEijC8MFY7uXZEe_ESSw4blEO-556cmBpICopVwhZE3f-aALsM8efzQcBnLVVEjHptGeU4yufSofq647sPt8ial96tre6a0PQBDcEseK&sai=AMfl-YR0WKs6UVgtlnbyKvw4yGrv84iopZWNSeW8k0xoI4fZiy0yW3ERkmKwg3FWUaB3J5JcFSZBwib8_jgvULukWI09VJhflanxMcTTzvu-ZleQ-O23u6tiIqjnpgZekBTZXdNwA0NZ12QlVnX9ojzmmgD4VzX7j4HdGXiOiH4sV_gRvGzounDCvJ2BRxUupXgjKZCXHcXATT0JSq0tUkxY8L23oIB8rYVCNVt5Sa1HgH683pwL2_rH3TJifTyPDg_ZLr26OA&sig=Cg0ArKJSzFWM0MaSzHmNEAE&uach_m=%5BUACH%5D&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.175.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:07 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QbtG9JRI6hnH8-o0QoJDRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmII0pBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBzX3y09ySbwof3gHiYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpoaGihZ2AeX2AAAHc-NVc"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-QbtG9JRI6hnH8-o0QoJDRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-lRMyXsDHjylSX6hlDPUREg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmJw0JBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBzX3y09ySZwY9mz3UxKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyNTQ0NBCz8A8vsAAAHlRNXA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-lRMyXsDHjylSX6hlDPUREg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-7aGcGDPbRH5mk7v4nQ4K83ruP0weJ7qHIXRPczqLOzNudMgeL6sjYDWKrmy8C9BgysUKM3atcVk8aWDZf_xNm9H-Ke7IlqHKJbI0JtQB_SOvJmSbypLJiAqUVrhN7vmHpKWhfw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZgwM84b4Wu3WryhntAKHVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmJw05Bi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBzX3y09ySbwYMuMPUxKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyNTQ0NBCz8A8vsAAAG0fNT8"
content-security-policy: script-src 'report-sample' 'nonce-ZgwM84b4Wu3WryhntAKHVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxX7j41ED2Ncge45zTbOkdm5wEDcc2bRoySspY-yzJCuojgMd9hQdAINrnEkSiunHjx5eN8dvYz8UUKrScbMI2xvRJQ8D9c3GWNE1AxTLKo8y3xbY-MUJ5rBaGaOu8ofn0LqPuIb_A== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 125ms
124ms Script
application/javascript 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX7j41ED2Ncge45zTbOkdm5wEDcc2bRoySspY-yzJCuojgMd9hQdAINrnEkSiunHjx5eN8dvYz8UUKrScbMI2xvRJQ8D9c3GWNE1AxTLKo8y3xbY-MUJ5rBaGaOu8ofn0LqPuIb_A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0MzI1MjA3LDYwODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9yZXVybC5jYy9OTnJxNjkiLG51bGwsW1s4LCJZdVB6VnV4NXhuYyJdLFs5LCJ6aC1UVyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4ee067ab1a4cf805c873752baeda9ea951d58f1ec917cd7138c4b0ab5cacdd37

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Li012Sy17tqItkRFsJtJRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsCoxSXF4KYhxXDy1m2mi0DcevMc62Qg7lp0nnUGEBsqXGK1B-IP9ZdZfwBxkcQV1gYg_lR1g1Wg-gZrEvtN1gIgNvO7zWoHxNXuXmzNQGzr78PmCsTfin3ZWEp82fb992U7BsR7c_zYjgJxZqcfWyEQr77px7YZiFd4-bNtAGIhHo7r75aeZBN40PHoCJOSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqaGhoYWegWl8gQEApmdNNQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Li012Sy17tqItkRFsJtJRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20251118/r20190131/ Frame 339D 8 KB
4 KB 70ms
70ms Document
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20251118/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ac2022c2f17a99849888beec2fbecb6aebc2939eb7e0585cde9a7dcff7e9be4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

age: 10255
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 3878
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 07:29:12 GMT
etag: 9949080804817620733
expires: Fri, 12 Dec 2025 07:29:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8583 0
16 B 156ms
156ms Document
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4126554779393986&output=html&adk=1812271804&adf=552093716&plat=1%3A66056%2C2%3A66056%2C3%3A2163200%2C4%3A2163200%2C8%3A66048%2C9%3A66056%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A66048%2C27%3A512%2C30%3A1049088%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Freurl.cc%2F&pra=5&wgl=1&asro=0&aiapm=0.1542&aiapmd=0.1423&aiapmi=0.16&aiapmid=1&aiact=0.5423&aiactd=0.7&aicct=0.7&aicctd=0.5799&ailct=0.5849&ailctd=0.65&aimart=4&aimartd=4&aieuf=1&aicrs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&abgtt=6&dt=1764325207314&bpp=3&bdt=463&idt=233&shv=r20251118&mjsv=m202511120101&ptt=9&saldr=aa&cookie_enabled=1&eoidce=1&nras=1&correlator=3513674888516&frm=8&ife=1&pv=2&nhd=3&u_tz=480&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=2181337166&scr_x=-12245933&scr_y=-12245933&eid=31095752%2C31095809%2C31095812%2C31095814%2C42532523%2C95376707%2C95377335&oid=2&pvsid=5533037149712921&tmod=254187608&uas=0&nvt=1&fsapi=1&etu=AA-V4qOFZUx3N7b15wBkS8o_88eI-ZLvAqq_j1L7vuM02Je6j2eDSmB94VSr-pMIkaXAC0BWuKkcIdFv&brdim=40%2C40%2C40%2C40%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&bz=1&ifi=1&uci=1.bcupvaaesppw&fsb=1&dtd=491

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ Frame 1002 17 KB
13 KB 229ms
125ms XHR
application/json 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20251118&st=env&sjk=5533037149712921

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6955cef91e7cf359158f87ac1f24fc0396e55868393366f3c3924514d529562d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13433
date: Fri, 28 Nov 2025 10:20:07 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H3 204 AGSKWxU8KImAIaK5MgG7mtG7eqRPq1jme9MEC3pAaxW5fwtMOesPJxJADQRvC_YpwGRQBzitPgUfbname5MzzQxm0lwVcK1gPtwQf886cFUt5Smcvy5xNZsjctD8xESCLykyatSZXno3NQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 115ms
114ms XHR
text/html 142.250.207.46
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU8KImAIaK5MgG7mtG7eqRPq1jme9MEC3pAaxW5fwtMOesPJxJADQRvC_YpwGRQBzitPgUfbname5MzzQxm0lwVcK1gPtwQf886cFUt5Smcvy5xNZsjctD8xESCLykyatSZXno3NQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.207.46 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Px4djVCPz9UYoiup1w6z1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:07 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw0JBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBzX3y09ySZwY92NBcxKLkn5hfHJ-XklqXkluokpxbogdlFmUmlJfhEKO7UMpCInPz09My893sjAyNTQ0NBCz8A8vsAAAHTSNVg"
content-security-policy: script-src 'report-sample' 'nonce-Px4djVCPz9UYoiup1w6z1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET view
securepubads.g.doubleclick.net/btr/ Frame 15F7 0
0

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame 1002 0
0 105ms
104ms Fetch
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.199.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt13s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ Frame 1002 0
0 107ms
105ms Fetch
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.199.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt13s52-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 97EE 100 KB
48 KB 728ms
727ms Document
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4126554779393986&output=html&h=250&slotname=9166168250&adk=1798104457&adf=758603020&pi=t.ma~as.9166168250&w=300&fwrn=16&format=300x250&url=https%3A%2F%2Freurl.cc%2F&wgl=1&aieuf=1&aicrs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&abgtt=6&dt=1764325207314&bpp=2&bdt=463&idt=252&shv=r20251118&mjsv=m202511120101&ptt=9&saldr=aa&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=3513674888516&frm=8&ife=1&pv=1&nhd=3&u_tz=480&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=2181337166&scr_x=-12245933&scr_y=-12245933&eid=31095752%2C31095809%2C31095812%2C31095814%2C42532523%2C95376707%2C95377335&oid=2&pvsid=5533037149712921&tmod=254187608&uas=0&nvt=1&xatf=1&etu=AA-V4qOFZUx3N7b15wBkS8o_88eI-ZLvAqq_j1L7vuM02Je6j2eDSmB94VSr-pMIkaXAC0BWuKkcIdFv&brdim=40%2C40%2C40%2C40%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&ifi=2&uci=2.4a47el7hnmpu&fsb=1&dtd=556

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b29fa4471aa26accb377c05e1276ab22ebdaa5e2bc481e820452c06454f5738a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 48900
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:08 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame D980 0
40 B 70ms
69ms Image
text/plain 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?RZYMcg
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.42.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt12s47-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
cross-origin-resource-policy: cross-origin

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame 4BCB 0
38 B 106ms
105ms Image
text/plain 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?btGGMA
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.42.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt12s47-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:07 GMT
cross-origin-resource-policy: cross-origin

GET
H3 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ Frame 1002 20 KB
7 KB 117ms
116ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202511120101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7f65c0446b6cac3175458f6388304d0c23e70d11fa0db20920a619f1bc18623

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
etag: "1747411493688989"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:08 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 7188
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/237/ Frame 622D 13 KB
0 0ms
0ms Document
text/html 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14b660a511e14a9a481c6fe43c576f36c61b656cfd379728c54f1128e1855966

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 516
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5044
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:11:31 GMT
expires: Fri, 28 Nov 2025 11:01:31 GMT
last-modified: Tue, 13 May 2025 23:17:50 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C360 829 B
0 0ms
0ms Document
text/html 142.251.42.196
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.196 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s47-in-f4.1e100.net

Software

ESF /

Resource Hash

4520a369ffd8ae183f2962170044577d9d205b01993a21aa54da1af3f1a6bf0b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PtgFS_Jd5jo0UPX4N9RtzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-PtgFS_Jd5jo0UPX4N9RtzQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:07 GMT
expires: Fri, 28 Nov 2025 10:20:07 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C360 0
17 B 104ms
104ms Image
image/ 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=237&li=gda_r20251118&jk=5533037149712921&rc=

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.google.com/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H3 200 _sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js Show response
pagead2.googlesyndication.com/bg/ Frame 622D 53 KB
0 71ms
71ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/_sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fec7e21915a572698f670f8c84401660be1cd68d73f16e42cbc505cbe8f8f708

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 203448
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 01:49:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 01:49:19 GMT
last-modified: Tue, 18 Nov 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20897
x-xss-protection: 0
server: sffe

GET
H3 204 generate_204
ep2.adtrafficquality.google/ Frame 622D 0
10 B 71ms
71ms Image
text/plain 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?grIyUw
Requested by: Host: reurl.cc
URL: https://reurl.cc/NNrq69
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.42.193 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: nrt12s47-in-f1.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/237/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
cross-origin-resource-policy: cross-origin

GET
H3 204 sodar
ep1.adtrafficquality.google/pagead/ Frame 44C5 0
17 B 178ms
176ms Image
image/ 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=237&t=2&li=gpt_m202511120101&jk=4171034283416112&bg=!KyilKGfNAAZKVVKRalU7ADQBe5WfOLSGs9d_i5DK-A0dMncBitKOOO_Z8YfZNea14ijNv5xLMwSCEf9Cd8g9gC0xn7OBAgAAAV9SAAAABWgBB34ANyB-p-wlxYYgyhueF45CI2IF8HjnZ6mu-4t-rmUT8jfcbxt-590c3AycVa928hyJcjLroBSJWquZAmIVyF4rPJVp2kqMzvH4Bhj6Hdtfr1HM4W6ITtf388jb6dVzjhUu_iOg7d2_0eWY0F3tB7rNdp49Cw0wgzej19Nk5cdxNHUlKIWU4j4srksFgq38SGFb_W_MGa4_Fh91yY7qtwS8jK4gu84vILyTZC0q3iZBBK0aYlKsMNUlnZbSLizve_qbegUiE5pc_MZ71l6ghOQzsNQQK0Ai_lLZK2SIppjh3l3v6meyV1kun-MGr-hhZKAHJQ1RIZ0ivbWiSmHmjLNrCrC5SxtDqIa2ztxKEDR8CDwbU5FxJCBhSor1ob3J49hry3cZu3m8tpINqtt25jokjIp1XNsMUdoUgimjqoBhXDN9l756cWVRw4mSn5U1FNTSOPT1pBiPQHc6oisvHENMO56090lz4dpRUxT287-wQOwb6R38Xp_aOKCZKegAzlvFT8m1R6WF5oDfZqFQkFbox4z_vd0MpySEPi4VnaxRe8au2IzAjRo3EMP2FxnbUzOB6ZrgLJPUgsbxzIBMLI-XoU8sBJOvgLpcBzvP7f2iGO_PPmJrmjQkh4gL6N0_phxQDMjXIeg4LapR8SUCcrl603g9uCtQ29Z55-ax0p-41YEBcDjKph5LGIzZNI5qGv3ZAP2NpenLD-jmtT6r0ULiylJoIIOpy1XydHrQu2qBaHnviLHvXE1QmVykhq_98bCYiJzsBbij7J278A96ynmFoukXgYwJkfVgG0w-KLCI1JAG_-CnDtzlMEPtk7Z86Phb5H_iJQd3Bq9hIOLYAGAaGntAEPn8o8H6nG7mXMWj1NPsd14E5-gnOE6xKdja

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H3 204 sodar
ep1.adtrafficquality.google/pagead/ Frame E26C 0
17 B 176ms
175ms Image
image/ 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=237&t=2&li=gpt_m202511120101&jk=8004782990982145&bg=!fn2lfTLNAAZKVVKRalU7ADQBe5WfOEX39yf9gr8VNApgl9Razrrj9egIFIfRyUTN0A0DP0IXSuAKxTcjIHxkQ3cJdtCtAgAAAXZSAAAABWgBB34AN0v7v35_2nZoGSTkJvOUyDjegvE7ktw5DEaQqtVFNS_H72m2ASXd2jySEFwryIBAN3DvbkIczb0KAEF7W57prxkgn1m5weweqpFoMUx9FCSPYWnFvHUxy8Lj08bjqmpKoog0y19baiPS1gd3A8MUVjhEh5Dudancn6jjHJkCc8tAXU6y2VWPcKNTpO4vqFRK_Q7WavUbUU5je07T7I3OvZOD_X361Q8XOfQnZzIUStK0os9aTTGfHMB5AKD0Vtrh8eVvr6lF7oLwF6JpU7QQ6Zs8nsihXwZrGvyZgMjzZTV-sZm8N_nXaVqtqyVUkVgSPVRVoGVcC2Y5Jpdm9c4VZGZSen89t7T6H-PbL5yfzLwX_Vw1TpimJ998v88SRcsJ4m-5ufF_FHNWYj3Ym_mDLleNuVoAHhuQb8Halb-_0LdFNyPIHPKyp5dctD6MuoZavKYoDqhUC16bphtDxks6Nzk9QEj-BTlTRbNOkai1ubBvc06u-757RlK-cOk9jBJ-TQ8TrGY4eDJPv1rVmJ0GM7FA23b-PCaoLykA0FSuu_V0O7Ox5qRCfBJ6GRf2CGX_ib9vYWRClT_Lj-crexfvkM97-DcCqAr6MxqGNbyqzEg3q7MkM-7dspOgpzV4lLFX6vJnBvTQTrEpFuO_mIMKOxvm4KFEeFJrlzj0wIG7174hyBkUkTAmVznsLbb9sFnlO_fivvr7mO4upfEvdnQN09QKDQqpeuVxWvklHjh1elWRNFQ1ncZo1YAbfrKM21rQbNrZaIUaIE-xX5jKn4rIonAYkY0FMniqQLAE-UUqJSy3lnTNbW_M2Z40ak6dlgzw7OCuxDuHu76hC3JV0qrQPaup-VYdJX3kZdGWz-vhMstVLg_PpworNJdDNgFtlvkmiLWX5PQGGyjZ9sQiSqHKWnCTlo8CJQFBUIQkyjqRJR-nYljucHSp2dx9249xD0jeGIl6jmcORMZcNryEsIl_9OaTVIo05SAyPI6Jl84GR3ohGw

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 97EE 42 B
63 B 109ms
109ms Image
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AwjdzNKTiQWCQ0rAhp2_BDDku2fc0lUZ7v8svgQkx1JOE_BoYcXLHL0myYftXMiRoFuEPzxq96_-m91BzkDjfumgh7Nnicx-cQLMDt8wnvwLaHo54

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4126554779393986&output=html&h=250&slotname=9166168250&adk=1798104457&adf=758603020&pi=t.ma~as.9166168250&w=300&fwrn=16&format=300x250&url=https%3A%2F%2Freurl.cc%2F&wgl=1&aieuf=1&aicrs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&abgtt=6&dt=1764325207314&bpp=2&bdt=463&idt=252&shv=r20251118&mjsv=m202511120101&ptt=9&saldr=aa&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=3513674888516&frm=8&ife=1&pv=1&nhd=3&u_tz=480&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=2181337166&scr_x=-12245933&scr_y=-12245933&eid=31095752%2C31095809%2C31095812%2C31095814%2C42532523%2C95376707%2C95377335&oid=2&pvsid=5533037149712921&tmod=254187608&uas=0&nvt=1&xatf=1&etu=AA-V4qOFZUx3N7b15wBkS8o_88eI-ZLvAqq_j1L7vuM02Je6j2eDSmB94VSr-pMIkaXAC0BWuKkcIdFv&brdim=40%2C40%2C40%2C40%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&ifi=2&uci=2.4a47el7hnmpu&fsb=1&dtd=556

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6F3C 652 B
259 B 117ms
116ms Document
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKHWuQIQpajS3xwYosa8xwIwAQ&v=APEucNWETt0sSyK_vR51jGIPojFujvH26k8Pi5lrstCqBfvkQNY1qG-K9GwmYulqFrCqXG0JpUFQrtTFJ2UT4w91JlLscphCYXYvjWslTnLqQvQF7LRSajQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&client=ca-pub-4126554779393986&output=html&h=250&slotname=9166168250&adk=1798104457&adf=758603020&pi=t.ma~as.9166168250&w=300&fwrn=16&format=300x250&url=https%3A%2F%2Freurl.cc%2F&wgl=1&aieuf=1&aicrs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&abgtt=6&dt=1764325207314&bpp=2&bdt=463&idt=252&shv=r20251118&mjsv=m202511120101&ptt=9&saldr=aa&cookie_enabled=1&eoidce=1&prev_fmts=0x0&nras=1&correlator=3513674888516&frm=8&ife=1&pv=1&nhd=3&u_tz=480&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=300&ish=250&ifk=2181337166&scr_x=-12245933&scr_y=-12245933&eid=31095752%2C31095809%2C31095812%2C31095814%2C42532523%2C95376707%2C95377335&oid=2&pvsid=5533037149712921&tmod=254187608&uas=0&nvt=1&xatf=1&etu=AA-V4qOFZUx3N7b15wBkS8o_88eI-ZLvAqq_j1L7vuM02Je6j2eDSmB94VSr-pMIkaXAC0BWuKkcIdFv&brdim=40%2C40%2C40%2C40%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&ifi=2&uci=2.4a47el7hnmpu&fsb=1&dtd=556
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:20:08 GMT
expires: Fri, 28 Nov 2025 10:20:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1002 42 B
65 B 110ms
110ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvu5052BGvj4kDLQEN-XtYnpy8qd4hB4e4RsmFaTlUihonO2ZHSVWf0xZ48lB5at2Xp0irZXqySQE-l_g7iMiKHXCSCJkorz7Rau21qsWc7LnBwY63oVMpiiOqhVuqCpCml2cdeIgkWoegOsjda9W6BDg3TV3VKAUlF3exu48itRGSo0oU7ODpgs2g&sig=Cg0ArKJSzAZlT8AqQDnYEAE&id=lidar2&mcvt=1009&p=525,650,775,950&tm=1325.1999969482422&tu=316.0999984741211&mtos=1009,1009,1009,1009,1009&tos=1009,0,0,0,0&v=20251105&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=110384004&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6025800700&rst=1764325206841&rpt=728&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/ Frame 97EE 21 KB
8 KB 71ms
71ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 11386605814003084292
age: 36600
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 00:10:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 00:10:08 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/elements/html/ Frame 97EE 8 KB
3 KB 71ms
70ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcnrta-bk-in-f6.1e100.net

Software

cafe /

Resource Hash

d4441ece945f2f14f46d1c462345ee2ba1c2e028e13137da40824116ee90b0f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 14517498748587259827
age: 16468
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 05:45:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 05:45:40 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3198
x-xss-protection: 0
server: cafe

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 97EE 0
0 220ms
115ms Fetch
image/png 142.250.194.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssQRnQ59oAgwR6xaEw0ODh7j7q8_qJ1ecE54eygu1zM2n6hdcEAK6i-TzftmQDbF0vKKh7xJCcR4Ap3VgPhUuCq87ESP9DOOk85dnNhdlI0g6J6Hc7wXC1WKvwkOXnFnoWHmtLjLx15Memgo1Xy54oMKO-KgEQHDJExnaX_A_E7m7DqixClpS_UGzRiyBv3BQgzvPE24NP-2xxMofHT3ZUAEaHfVFVjgcNdLDMmroxNV0pghSkHrRUROwk_U1mZfx8j6k0DRyovSH-TlVITntdhZp3OPozmz2IxtLFcwlrYgWV_YWiDyY59oAxyyT9okVY4IetTDhz2eyPm5s-Dx-LBBD-67B2tFM-tUEsqb-sQoqbZylKPrROO7HWhhXIX0eiT6yu83rZfOJ2K201jWpCbuNw9WMI2icyX6tlP2PxpNMb96_ZQn8mFb0LdXPWBpBKk2Wb-zqFcmUXPWef9olVb89oNVd2bzkpF1OhoMF8JV8msKVBSVRWwX90_rGlVhn9qd7unHTo8r9r0KcWDA51epcALCc35J-sOwR_X5sQ-9go9w0EDmWucoqcoMfGO6Y4RzHYFxIAnACVNTCLN6IQRSTNQhwezOsiy4C2-p_VOVn8-yDXLEIpNn6QfWE-gZSMjEUX3UBOxlK1vX7JMsLBTWQEv9Eg7Zf1SHjf5dAzVurT8bs_ePc8DFgfYTVW0Cu0jqskRYp65O3mM0BIEDmoDvVduhNUbByP4GaMA9ZZPgmN93i2aoAwMu9wWcXbzlAPD43dbh92ZwgAkdg7x8AMcMk-0LBmPe1ab3b63-5Lk9S9zxs4H4p-CLyWjfRtQJzwlvh8kKxUHLTgh-9YPn0W-WtCd_Tt0HtQZsBYwxIlUr6ad_-Ik2pZlLCe22oZLRnpagCAhfuOmm2Lo810uonlauaMoSGlkzQ4XiEkZZSOIx71I0_3f_tx-gNEqD4I4Dy1tZrZcnIElm96-OcWammGobFlkOflsYDVR8dQjeisBNRAlcfSuio4ni0z8KC8pw4dUm1VW7KBWZWjuwAH0ZIjTx6pYiPuoCIj7xB_KrObHHl9F-p_ziPBu_iem8CbD11k4zQbF7zN89EQYKV6c5twabU3fIupO3ehdhSjKoeXr4sVR4q4Tam8AkMHfCaFqN7j0JE4Z7_ihZXYyzPHKTSs0QsDb8j0jSU7IOKHctt_nI-RSAuziLk7FZHQsqjmcJODEL8zx2LBWhCRibmxJhyx3r4J-WonO7aGqB80myk8cBjIf5UZqGXITzlW4NoltyXAgXdF0KKL4Gv1N0SCIkdKJiG3K9TxJwkVFSmm6ENjOt2abRznd8jP9vhO_GV-7dSHdedTRY6e96xUNRWM5Kk7TJJBJ--PFGy1K97GT9RWkRgIF_WArJh7NErowIMYM5AQP5CJxZBkC-wY1JJfxUkwLDSKuI4eWRoU7vLEkuNeDxCQp2uW9Xw_ft8XJ2Yp2ShZVYSn51ist7s8dlxYxXHr1ZtRjd0LsXeffbScZ_1PrVI0FN6Nfy-HwUqMViAzk2xVL_ObyK-fn9PlIP116hpEUdIeDogdcXhMPrJzJDB-BIDOyelv9zqCVzH4iXqCat4JBs4ykPCyBBIY2xH_Ibiki5zeN7Q&sai=AMfl-YSaD_vHrDc1uEgnP_5IybfQ0MvdoZwjLXz48tdrQF3nOT7NMkfDvq288R0fFEyVPmZPM-_-C0Dpi-QCUaUmbR3S8c4OXe4Ul4eBHKlfFjCvCPeugs_7IZRGpAn3rcepqKSJpvsPtRyxdYGMETmqbrEx556fmQIa0X07H2tiLoaVbzUZCVYJUEM5kO4jKAxP9wI29qVJxRcoiwhxabS6Itp2ZJsHNYIvBjcLphP8L-yxGyJnaiw-x-Z9NVSzQ42wQA6GJnNft8uFy8dBe1gsS_5TRmnNUCTxsuftKYXnvjOml6hZXBOznwD0M_TEzonosNbp02eqrR9BfBMkb48q25EIMvhNdoMvOKRPm6pNj7vEMEEfvGZe0OfZiYl3fq4SK8rM7JBTtIq3wCcsAUmu3Kv_TgX8FYx-x1JPRclqaAQjOh87roywJLZXnAmONXnXUoUv1zt6kfDySnCmcUiCtHKB4X9TNL-EPjsOvytxIeJJBRdXcdWxMIL6q4KC-mxnS-HYb28JXk3W1kNEjEbc7CLjVSh04_GAIwJjQboVylkpSmgc1zl5eXxU-Wdg82A9iP-Bn0X_besnpbfoXIhoJuv4LgKudOVrDpxWBKlPkWpPgrkpMwvJONMISrMyYRhgVgY-9mbBzT9fWx9fVhX3fPAypG9h3L_wCHZUNLATJIbhawjw5GwaoaNMZAwB8Jnm0VpcoPJ30KLblmT215SMhJscJYvBWG59u9Ru6fkfl-IYgqQUv_ccRXApawbfQeP1Pwz_ZyugN73334yOuX1mLn3AON3QEayqcnm6F2mhy_xQllOj__O1r_BNBcKuw2Cq5LCL5So7amXOwCTovBougalfX3WjUWE81WCXX93njvhp5LT6m6cTh_MSXvnQnDyyfUN7W0znPJEAzVtKSZ8wD4XNbB-DLFa8BKBDayJTAFw&sig=Cg0ArKJSzGONoQC09EAsEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9zaGFuZ3JpLWxhLmNvbQ&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=3&cbvp=1&cstd=0&cisv=r20251117.78706&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Fri, 28 Nov 2025 10:20:08 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"39664348":"0x310cbdc78a40c3320000000000000000","39664349":"0x78ffc627b1bdb5a70000000000000000","39664350":"0x9379b6812337f5850000000000000000"},"debug_key":"10958393419276407625","debug_reporting":true,"destination":["https://shangri-la.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["4521189","4524190","1612996"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4378683"]},"max_event_level_reports":2,"priority":"0","source_event_id":"13469177575689898877"}
server: cafe

GET
H3 200 VFc2VJAc.js Show response
ep2.adtrafficquality.google/sodar/ Frame 97EE 43 KB
14 KB 72ms
71ms Script
text/javascript 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcnrta-bf-in-f6.1e100.net

Software

sffe /

Resource Hash

54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
age: 394
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 11:03:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:13:34 GMT
last-modified: Thu, 13 Mar 2025 04:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 14328
x-xss-protection: 0
server: sffe

GET
H2 200 1371770296088595415
s0.2mdn.net/simgad/ Frame 97EE 127 KB
128 KB 324ms
109ms Image
image/jpeg 142.250.194.102
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/1371770296088595415

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.194.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08ea9cca7504bef27a3aa45db67a23d4bea3db2d7b02145c90c67adf42f6466e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

age: 22983
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sat, 28 Nov 2026 03:57:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Fri, 28 Nov 2025 03:57:05 GMT
last-modified: Fri, 28 Nov 2025 02:44:15 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 130191
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/ Frame 97EE 3 KB
1 KB 69ms
68ms Script
text/javascript 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 6538
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 08:31:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 08:31:10 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8229 1 KB
838 B 72ms
71ms Document
text/html 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

age: 10501
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 812
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 07:25:07 GMT
etag: 9725182468138058862
expires: Sat, 29 Nov 2025 07:25:07 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/ Frame 97EE 21 KB
9 KB 104ms
103ms Script
text/javascript 142.250.207.33
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.207.33 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3539a82b4664c18c51201b6b35a296282250e6cfb16f3355c61d949797c56529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 2622203621575094117
age: 6698
x-content-type-options: nosniff
expires: Fri, 12 Dec 2025 08:28:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 08:28:30 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8688
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 97EE 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 97EE 223 KB
69 KB 70ms
70ms Script
text/javascript 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1ca0d5744e4f39ea464be06f38e214eabd97b2ca934e919a3673f0a62f76368c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

content-encoding: br
etag: 11779502037942753168
age: 2934
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:31:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Fri, 28 Nov 2025 09:31:14 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 70282
x-xss-protection: 0
server: cafe

GET
H3 200 Klz6NWr5.html Show response
ep2.adtrafficquality.google/sodar/ Frame F799 35 KB
12 KB 74ms
72ms Document
text/html 142.251.42.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 695
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 12007
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 28 Nov 2025 10:08:33 GMT
expires: Fri, 28 Nov 2025 10:58:33 GMT
last-modified: Thu, 13 Mar 2025 04:28:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_cver=1&google_push=AXcoOmQgMA2VJvuXpNAsXiOVGQZmi7eP3E3FgnNNOd-QcJL-XwiPwZN...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=1b7a846b53992112&is_secure=true&networkId=14000&version=1&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_cver=1&google_push=AXcoOmQgMA2V...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAKfwkudaeD5wJWgTbYAQEBAQEBAQCbyPs0TQEBAJvI-zRN&expiration=1764411609&google_cver=1&is_secure=true&google_gid=CAES...

170 B
188 B

118ms
117ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAKfwkudaeD5wJWgTbYAQEBAQEBAQCbyPs0TQEBAJvI-zRN&expiration=1764411609&google_cver=1&is_secure=true&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_push=AXcoOmQgMA2VJvuXpNAsXiOVGQZmi7eP3E3FgnNNOd-QcJL-XwiPwZN-K4sp0tjGV-pPSGAnpMCAZrQGS3Auty3iRYEPrdteQ7KACK28qnkgJB9dtJ-Ta9rCK4ppFsXcIA_vcvc1RETEKZA-WIdWXVqLQYQU2Vk

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAKfwkudaeD5wJWgTbYAQEBAQEBAQCbyPs0TQEBAJvI-zRN&expiration=1764411609&google_cver=1&is_secure=true&google_gid=CAESEE3sJaNON3htuEeChFg2IG4&google_push=AXcoOmQgMA2VJvuXpNAsXiOVGQZmi7eP3E3FgnNNOd-QcJL-XwiPwZN-K4sp0tjGV-pPSGAnpMCAZrQGS3Auty3iRYEPrdteQ7KACK28qnkgJB9dtJ-Ta9rCK4ppFsXcIA_vcvc1RETEKZA-WIdWXVqLQYQU2Vk
content-length: 0
date: Fri, 28 Nov 2025 10:20:09 GMT
pragma: no-cache
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEOqR6mdFOAnKBeetFWY-MWU&google_cver=1&google_push=AXcoOmRsnPDY2mjSoBw05oVhZE0Uz5BG79fW7_DmdM2EazVpCHMknL1dqH21DGS8HavD4n6hwH7Q9...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRsnPDY2mjSoBw05oVhZE0Uz5BG79fW7_DmdM2EazVpCHMknL1dqH21DGS8HavD4n6hwH7Q9bWJLoA_0dxNKuQgPefM_fDBBa_KCeE4DLmVZHgHLdIR1TPRmvALE_...

170 B
188 B

114ms
113ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRsnPDY2mjSoBw05oVhZE0Uz5BG79fW7_DmdM2EazVpCHMknL1dqH21DGS8HavD4n6hwH7Q9bWJLoA_0dxNKuQgPefM_fDBBa_KCeE4DLmVZHgHLdIR1TPRmvALE_WWozHpoauKukF0Aigi2AJfaC9p4S0

Requested by

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmRsnPDY2mjSoBw05oVhZE0Uz5BG79fW7_DmdM2EazVpCHMknL1dqH21DGS8HavD4n6hwH7Q9bWJLoA_0dxNKuQgPefM_fDBBa_KCeE4DLmVZHgHLdIR1TPRmvALE_WWozHpoauKukF0Aigi2AJfaC9p4S0
x-msedge-ref: Ref A: F992948A1EBC4C1E81D0BE517DFD7F0E Ref B: TPE201050222025 Ref C: 2025-11-28T10:20:08Z
x-li-fabric: prod-lor1
x-li-uuid: AAZEpPlZWuUVxshpXyoBPw==
x-li-proto: http/2
alt-svc: h3=":443"; ma=86400
x-cache: CONFIG_NOCACHE
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESELMBojeg_sd-xbmbcJ2fSIk&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjI1OWU3MTYtY2RlNS00NmM3LTkxZGItZTEwZjE4MDNkMDQ2&google_gid=CAESELMBojeg_sd-xbmbcJ2fSIk&google_cver=1&google_push=AXcoOmSi...

170 B
188 B

110ms
109ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjI1OWU3MTYtY2RlNS00NmM3LTkxZGItZTEwZjE4MDNkMDQ2&google_gid=CAESELMBojeg_sd-xbmbcJ2fSIk&google_cver=1&google_push=AXcoOmSi-EuHDvLwvHnFbs5Qu3P5qYv-HX6Wd-K6OvlqVh-fIXSKQ7P0k8hrsxED4ffGIIYbfGcN6Ov8zmzWK5phqgPH4lgEbal0VeAZYEEUwQYlBO7IcglxysIXxR_qBwQOb1ZC5xZO5LnIym7oUR0gEU-KD20

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjI1OWU3MTYtY2RlNS00NmM3LTkxZGItZTEwZjE4MDNkMDQ2&google_gid=CAESELMBojeg_sd-xbmbcJ2fSIk&google_cver=1&google_push=AXcoOmSi-EuHDvLwvHnFbs5Qu3P5qYv-HX6Wd-K6OvlqVh-fIXSKQ7P0k8hrsxED4ffGIIYbfGcN6Ov8zmzWK5phqgPH4lgEbal0VeAZYEEUwQYlBO7IcglxysIXxR_qBwQOb1ZC5xZO5LnIym7oUR0gEU-KD20
content-length: 0
date: Fri, 28 Nov 2025 10:20:09 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESEGb8C6lTCrMQkAkWZpz1rdo&google_cver=1&google_push=AXcoOmRKu791M9QmYmTYcmBrbnLE8rZn34FVEqKCOJUAfT2QvpHfBEL00g4lmDODNCNvGQw8KgVevjAyf37p1C2nU0HzCyvdzSUaueQKn...
https://cm.g.doubleclick.net/pixel?google_hm=bGxoc2ZzMnBEakcwN3dvelZYY3BhUQ%3D%3D&google_nid=appier&google_push=AXcoOmRKu791M9QmYmTYcmBrbnLE8rZn34FVEqKCOJUAfT2QvpHfBEL00g4lmDODNCNvGQw8KgVevjAyf37p1...

170 B
188 B

116ms
115ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=bGxoc2ZzMnBEakcwN3dvelZYY3BhUQ%3D%3D&google_nid=appier&google_push=AXcoOmRKu791M9QmYmTYcmBrbnLE8rZn34FVEqKCOJUAfT2QvpHfBEL00g4lmDODNCNvGQw8KgVevjAyf37p1C2nU0HzCyvdzSUaueQKng3V31oNfh_TYax9kzxFAat-0eoWwmQrTmo-fUGolF1mM-ixcYoadQ0

Requested by

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-store
Location: https://cm.g.doubleclick.net/pixel?google_hm=bGxoc2ZzMnBEakcwN3dvelZYY3BhUQ%3D%3D&google_nid=appier&google_push=AXcoOmRKu791M9QmYmTYcmBrbnLE8rZn34FVEqKCOJUAfT2QvpHfBEL00g4lmDODNCNvGQw8KgVevjAyf37p1C2nU0HzCyvdzSUaueQKng3V31oNfh_TYax9kzxFAat-0eoWwmQrTmo-fUGolF1mM-ixcYoadQ0
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Fri, 28 Nov 2025 10:20:09 GMT
Server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQyVw...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1OREQ3ckJHd3ZMVEcxOXdnVjBzMm5BU3NVMFdHZzRHOXVSVWNtUQ&google_push=AXcoOmQyVwshbXPA-9sFRZzZK1lHxoqyL6zPoU51wYRbeDAlw0TWIxkg8YwR2W9rXMeGm6...

170 B
188 B

113ms
112ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1OREQ3ckJHd3ZMVEcxOXdnVjBzMm5BU3NVMFdHZzRHOXVSVWNtUQ&google_push=AXcoOmQyVwshbXPA-9sFRZzZK1lHxoqyL6zPoU51wYRbeDAlw0TWIxkg8YwR2W9rXMeGm64jPNY0_P5FRkwYGdxOtzO9w1TFqF3ttUrYxhl3ROdAv_57DH518fTkOz4CQBwogkBmDZgg9ErWraH6phAjw0eFlHg

Requested by

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1OREQ3ckJHd3ZMVEcxOXdnVjBzMm5BU3NVMFdHZzRHOXVSVWNtUQ&google_push=AXcoOmQyVwshbXPA-9sFRZzZK1lHxoqyL6zPoU51wYRbeDAlw0TWIxkg8YwR2W9rXMeGm64jPNY0_P5FRkwYGdxOtzO9w1TFqF3ttUrYxhl3ROdAv_57DH518fTkOz4CQBwogkBmDZgg9ErWraH6phAjw0eFlHg
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1099640
expires: Fri, 28 Nov 2025 00:00:00 GMT
x-errorlevel: 0
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Fri, 28 Nov 2025 10:20:08 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://pixelfnt-us.dsp-api.moloco.com/v1/cm/adxpm?google_gid=CAESEOo7oS98w6BhGY3d-pRD3sc&google_cver=1&google_push=AXcoOmQ07N42cRWOnOhgOaPSVJA9GEo56cE6j6q_BoQTDaaUy5nL4GhZd-1Gg9XovzKhSu3Z__8UOlqt8...
https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=-tAJHr2-SHiaAXKEk94CIg&google_push=AXcoOmQ07N42cRWOnOhgOaPSVJA9GEo56cE6j6q_BoQTDaaUy5nL4GhZd-1Gg9XovzKhSu3Z__8UOlqt8P8o1_3MST9N09A...

170 B
188 B

117ms
116ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=-tAJHr2-SHiaAXKEk94CIg&google_push=AXcoOmQ07N42cRWOnOhgOaPSVJA9GEo56cE6j6q_BoQTDaaUy5nL4GhZd-1Gg9XovzKhSu3Z__8UOlqt8P8o1_3MST9N09AFGD_MG2G7-jQDlmoPso6TGqjwwyeOMSvphbQDnW4y0ByTDqwOPxzA7mnB482v1MI

Requested by

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=-tAJHr2-SHiaAXKEk94CIg&google_push=AXcoOmQ07N42cRWOnOhgOaPSVJA9GEo56cE6j6q_BoQTDaaUy5nL4GhZd-1Gg9XovzKhSu3Z__8UOlqt8P8o1_3MST9N09AFGD_MG2G7-jQDlmoPso6TGqjwwyeOMSvphbQDnW4y0ByTDqwOPxzA7mnB482v1MI
content-length: 292
date: Fri, 28 Nov 2025 10:20:08 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8229
Redirect Chain

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESEJrJYcAsFviXhx-r8-9gv_0&google_cver=1&google_push=AXcoOmSD_tah0VDokYdSre-X8XKdOD8_pU40xZFd8FK6FbjVxv8p7zUBlZmnSHCLWFjgMRZ5PiFIWN6fh9gBGvJlB-7UTs...
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSD_tah0VDokYdSre-X8XKdOD8_pU40xZFd8FK6FbjVxv8p7zUBlZmnSHCLWFjgMRZ5PiFIWN6fh9gBGvJlB-7UTs2teX9uqOwL-qGzH6E5OEV0rvCcP3HmnVpvV6E-LRTPpms_z3wyboNyYV...

170 B
188 B

114ms
113ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSD_tah0VDokYdSre-X8XKdOD8_pU40xZFd8FK6FbjVxv8p7zUBlZmnSHCLWFjgMRZ5PiFIWN6fh9gBGvJlB-7UTs2teX9uqOwL-qGzH6E5OEV0rvCcP3HmnVpvV6E-LRTPpms_z3wyboNyYV_DRjoKTUx2&google_nid=whaleco_services_llc

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1764325209562|2
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSD_tah0VDokYdSre-X8XKdOD8_pU40xZFd8FK6FbjVxv8p7zUBlZmnSHCLWFjgMRZ5PiFIWN6fh9gBGvJlB-7UTs2teX9uqOwL-qGzH6E5OEV0rvCcP3HmnVpvV6E-LRTPpms_z3wyboNyYV_DRjoKTUx2&google_nid=whaleco_services_llc
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1764325209562-00001039399071640000000002915651-20
cip: 2.58.241.74
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Fri, 28 Nov 2025 10:20:09 GMT
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8229 0
12 B 110ms
109ms Image
text/html 142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IepG2rr4-jzSTqNNEuZ8Nk1JNnKg7Sa-JSxXmQlVDvRUlP2Na_0r69US7uMWPaM5xM60Fojw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6F3C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1&gdpr=0&C=1

43 B
724 B

78ms
78ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKHWuQIQpajS3xwYosa8xwIwAQ&v=APEucNWETt0sSyK_vR51jGIPojFujvH26k8Pi5lrstCqBfvkQNY1qG-K9GwmYulqFrCqXG0JpUFQrtTFJ2UT4w91JlLscphCYXYvjWslTnLqQvQF7LRSajQ
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=G40%2F%2BD7%2F1iJtOQoOLshmdFni%2BXSK8NG8Ysfm%2FlC%2FD2zkGFq4mgDmLa%2F337trxkbpoTeZHNmNyblzYEiDKnJ8GhuET7QH8Au2uRb%2F8JaXn6UmbivWhw%3D%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 28 Nov 2025 10:20:09 GMT
content-type: image/gif
vary: accept-encoding
priority: u=2,i
cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma: no-cache
cf-ray: 9a59218c0b9b6a9c-TPE
content-length: 43
server: cloudflare

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bX%2Fo6lu%2BdsupM8E7zRZjEyg37Akn3leeCTlBntKJlngo043N5JbVHZ2cC%2FboGodIFymZYB%2FuRPFWKucxGTywDuSuLAS6f4QD0zHwpWIwot%2FJFLrdxA%3D%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 28 Nov 2025 10:20:08 GMT
vary: accept-encoding
priority: u=2,i
cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1&gdpr=0&C=1
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma: no-cache
cf-ray: 9a59218b8b4d6a9c-TPE
content-length: 0
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6F3C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aSl3WBdaRKwAEkFYBD2RBgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1

43 B
727 B

80ms
79ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKHWuQIQpajS3xwYosa8xwIwAQ&v=APEucNWETt0sSyK_vR51jGIPojFujvH26k8Pi5lrstCqBfvkQNY1qG-K9GwmYulqFrCqXG0JpUFQrtTFJ2UT4w91JlLscphCYXYvjWslTnLqQvQF7LRSajQ
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8H%2BqQjxoKi9WJ4AOtDe8ZDW%2FGD%2Bh7IFLGzOz%2FTbeWqW7%2B277fv9jPHuXj0%2FfH5OnD2r0F7n7crCSp%2B6IqQRX2aWhoQgfEYfbS1F%2FV%2FSXyx7kZgVhbg%3D%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Fri, 28 Nov 2025 10:20:09 GMT
content-type: image/gif
vary: accept-encoding
priority: u=2,i
cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma: no-cache
cf-ray: 9a59218cfc4c6a9c-TPE
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEP0ahwfg0SHs_eMYBsYyrY4&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bounce
ib.adnxs.com/ Frame 6F3C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESELHJYbUwo6V-zQOHft70vDE&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESELHJYbUwo6V-zQOHft70vDE%26google_cver%3D1

43 B
1 KB

230ms
230ms

Image
image/gif

103.43.90.53
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESELHJYbUwo6V-zQOHft70vDE%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKHWuQIQpajS3xwYosa8xwIwAQ&v=APEucNWETt0sSyK_vR51jGIPojFujvH26k8Pi5lrstCqBfvkQNY1qG-K9GwmYulqFrCqXG0JpUFQrtTFJ2UT4w91JlLscphCYXYvjWslTnLqQvQF7LRSajQ

Protocol

Server

103.43.90.53 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.25.5 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 2.58.241.74; 2.58.241.74; 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 488b1a4a-3e43-46f2-836e-1746400e352d
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.25.5

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESELHJYbUwo6V-zQOHft70vDE%26google_cver%3D1
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 2.58.241.74; 2.58.241.74; 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 54d44dae-8d0c-495d-b2e5-241818b64e82
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6F3C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26gdpr%3D0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQxMTc1OTA5NDU2Njc1MTM2OA%3D%3D&gdpr=0

170 B
188 B

115ms
115ms

Image
image/png

142.251.42.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQxMTc1OTA5NDU2Njc1MTM2OA%3D%3D&gdpr=0

Requested by

Protocol

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDQxMTc1OTA5NDU2Njc1MTM2OA%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 2.58.241.74; 2.58.241.74; 594.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ac3606a0-070d-41d7-a038-92b9a2be8b0e
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 97EE 0
0 108ms
107ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 97EE 0
0 103ms
102ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-fallback2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 97EE 0
0 107ms
106ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 97EE 0
0 108ms
107ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 97EE 217 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 251ef131884b15a4a9278a28f1d328ad8099a632f76063d9d574fe2b3debb790

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 sodar
ep1.adtrafficquality.google/pagead/ Frame 1002 0
17 B 144ms
142ms Image
image/ 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=237&t=2&li=gda_r20251118&jk=5533037149712921&bg=!xsWlxYrNAAZKVVKRalU7ADQBe5WfOFwj6tarPvNQe9mU_8oZbykMOZyC4OedTaC0oX00VnvHh1fCq8yaWH-xM1YCAor6AgAAAE9SAAAABGgBB34AN8mc8eBx2bERkqz72UJZBVrO_h4mlN6AaIdEr_U2Lq4clXM-1LjTmBpUvq_sqTCEJANHnfqDUmqZArPfKYU4T92Myp4dJcAAZjLwkqMTSMJLczVFON6FbA13GJHlfZP4AhglMm2u2P8Yp6KbZyBQ2q6qdfG3w5lEoEokib0K1NojK2pigbuxbuvx9m53jLXXpbxDJZpmtL32934IdJs58hM1guGQP0vVrHOs7ZeCqvwg0Oj_hwmD15pu9dITFIOr8p9ajqWj5zfEUthuXT33C1qO31d3G7ZG55aEExdY3SL6QRQmrJG93L5ovw9ze8t04HPx3qq23_kErtS_SQuxwVUsaha0WjzURFjopKK8GhGXcuQsC__nCEfK-UaoU9NpG9_qvcE_L7GjyBmgr9vCTw_DbqaApYa3IUht9H3rptPRsi-_K1sGLdRLEJaPLO4wbc3MVH2AbCg-rTcnIcWxew-yJEifS1zK18iY0JvcITUWOxkOY8YmscMPxuWHhnq3SirI5Tto2_Jc2riTSmQRNGwWh73PX8OqkclBdPkUWtB-G1W2gkgi7rSACyaucwbbU0oK2vTrIRl1PAgr8nkJNBTmFfVDSD7eZ8AdO3dS9mIV2Mr4GKJnxOThT0wBVJwblJYsoxL8YsjKXMNspJQzg0Nk3xnghDLZQwJm4Oie3KiZT-j2u_QE-P8CeqY7mPXh6SwabC4-YeVjCrE6Q1FhKnAlmu7gIl_kWUYnCTdg-5hB3GdJdhr-1B3N4uei69cTvF1H6PCeoc_62nPbKo4xs9YNocuS8O4qDn3eGoe5pULOE0jmzuHo-fs9vXMpy3kRTOkIYNks6cmqWdygvo6YdY69Wep-0LC-d-5OLT5F77LwE1l0Q1FpojO45pq6tiiiLlHmiVHKV_HDqCyBQSOK2HMGkHVusb_blvHt-KEdc6OoVPWcIz4wRo11_NyVeeE-CSUVaJsuaJailc6wH_VJe-PJ5qosi_j_bqi_s763

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://8d2654c69c7aa5a8ea5b0e5c5d8fa818.safeframe.googlesyndication.com/

Response headers

timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/
server: cafe

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 15F7 42 B
65 B 111ms
111ms Image
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssI35CYVdXg5hbQidXKv6VDPAZ8e1EBR-GQ90-QYq8ByW4sL-fcek7duHeyn1VI1hMlxY-MnhDwkceoOHwY65VMB4An3cFpmDEnv5HZZqrrTYgU24crxt-vOwW5j6Y_SLyOCLoMHiholeA0SMfkE5otHWu_ohT_QsoasDAlcQ5UeFAmBHnVrg9JGjMT-BLdsy85L2-3Q_TEiKDhFZEE&sai=AMfl-YTXp9RHPcJbj3iAQQE0ubDW8g_CvNEP0gn4XvjEQAmQoBAeHr2xpJoonBI9JhTINmgeLuR6omjb7zyMZqJ-7xbJ-zoOhPdYIdp55a69WiqHO3sl3-aP2IVKx0S6HdHrAalXtBq5ozWuU5xKZqimLNJrgs71Bg8rW-mLAhxGgKJ2bwd4i4obAW74Ne0SJBTZBiaqoPbr7m_zcXhBdHvp9OQUdmnQGkYTlG-YOyWwoRdcrc5BM9kXTh4sRLcluu6Pr6DZOQ&sig=Cg0ArKJSzDxhx1yyXUrrEAE&cid=CAQSnwEAwksa0S56NL-jANFDV84O4zP4m-kmpKDBAO7W-496kEyMdkfFcmnxs37lLTU8sxw8LDSzy-JNARU2QCm2MGWjGsrY811hYVmXHnSrEIrwjOb39G30XbmbAWBUV5ULF-hFkLVFRv0jyofZ2teb81XHjk6nZtP7jN4NTm_0EjWJVHdvaoqQNPNIXhvpuOIsyJ_SwSO2VQZ7lfxfIpeJMDEYAQ&id=ampim&o=640,360&d=320,480&ss=1600,1200&bs=1600,1200&mcvt=1009&mtos=0,0,1009,1009,1009&tos=0,0,1009,0,0&tfs=736&tls=1745&g=100&h=100&tt=1745&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Requested by

Host: reurl.cc
URL: https://reurl.cc/NNrq69

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Fri, 28 Nov 2025 10:20:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 _sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js Show response
ep1.adtrafficquality.google/bg/ Frame F799 53 KB
20 KB 98ms
98ms Script
text/javascript 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/bg/_sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fec7e21915a572698f670f8c84401660be1cd68d73f16e42cbc505cbe8f8f708

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 203127
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 01:54:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 01:54:41 GMT
last-modified: Tue, 18 Nov 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20897
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
ep1.adtrafficquality.google/pagead/ Frame F799 0
20 B 106ms
106ms Image
image/gif 142.250.194.66
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar&v=46&t=2&bgai=BgN6GV3cpaYOlOeeaid4P48CH6QwAAAAAOAHgBAI&bg=!nJ-ln9DNAAZKVVKRalU7ADQBe5WfOHQyQmlFhpwgcECk-jnQPuXlo1jlHR3UOLyRaqHsyDgS-ya9bvaKxOLUgOv9nOP2AgAAAENSAAAAA2gBB34ANW5kJC4iqo5sLbFiSZR8LUU6phf_jtruBKrjKuTwhzkTZ8fCXnILRGYzAwUL1RAmK7OYpeTyCgACAx-ZAvG6VtolXM5MwsiF8vLmK-Z1ryxwGV79KSjDtp_W4mnX5uKAzhV8o0-fyGeqQe69YrtYsuoNixgA0teFA_kWwU6d7EbEV4UEuNJ_dH9krebT-GNCQiDggkfdzOnlAgOm7d89DCwoNmYWrQ7ncPfQRTUHPtcPzF1HDEEpJPf9x5XZ29XOpviiXSfp6scOyDRUUxRgEE1M1OoTn4yCZIMegEw9eJ4S9p0sGbEBJh7H0NgKL9QnnIdLTm3nKSs2MppzuCdFCrXhaZ_1Um9t-UA0EN6E9TajjL6lVqlaPJokdfqv3y-4r5wsOzZ07gErXR6jS0o30fdZO6MJKe8YHfLObh74-drkOMk_ZEwJU5U9C0YqNEEUgvlO0KF7uYYeOMDli1AKDDHrNsXJQZQ0vo0l6_i5kelGg9wLtAynLB38JXyvyjM2iW14U8khsn0ZpVdpdkz45A322TykRtuze4rDy0ZxC9VEMJu8jraJ5FWNy3e0e6MmQf8JgsgxmWi15-pDZW5ZXd6S_8usc_SP_gbAmeYd77dGPprjNWvCcf-zPm7fZmzS9jIS8JNeVz-ipGsgOIkNs1pRSTfbA2Tror2g7fqU8c8P8wfZHP0jJ7Ox_Lj8bBQrlDvBO2U2zSCwuyXMxrWldjL2dMYrupicTt92ojL4rqD7gGa7Jqb5Zn5OJURJZ8HqYZp25j2H1QeTg-u3RfdZRRAV4Wk8yKDlDvOnwvih1ZWT4DEadLFIDYS0N7LsQL-Kioh33kT92I_uXPGh-Rez0r7AIp6boMF8sw_6ZeSEThDrG3DFO77km3Ww43BAM0EK0tLdqv1OzM2gR8yfnoS2AWnZFbX5SzqlxbkYjvpH_JQX0nU5LbRDlWsMQ4uX6KmwiNwnkgsP89O_W17oqG7sFseJgngGbsPRz7CJiDVCtopiM4QaMDOcV5_xNgYLaFCGDQp7gbXHP5oRUmxTSZejgIOMZwCM1-PIVC6CmUygvNX2D44PXwujYbp8fVNWxpQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lcnrta-bk-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 97EE 0
0 113ms
113ms Fetch
image/png 142.250.194.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssQRnQ59oAgwR6xaEw0ODh7j7q8_qJ1ecE54eygu1zM2n6hdcEAK6i-TzftmQDbF0vKKh7xJCcR4Ap3VgPhUuCq87ESP9DOOk85dnNhdlI0g6J6Hc7wXC1WKvwkOXnFnoWHmtLjLx15Memgo1Xy54oMKO-KgEQHDJExnaX_A_E7m7DqixClpS_UGzRiyBv3BQgzvPE24NP-2xxMofHT3ZUAEaHfVFVjgcNdLDMmroxNV0pghSkHrRUROwk_U1mZfx8j6k0DRyovSH-TlVITntdhZp3OPozmz2IxtLFcwlrYgWV_YWiDyY59oAxyyT9okVY4IetTDhz2eyPm5s-Dx-LBBD-67B2tFM-tUEsqb-sQoqbZylKPrROO7HWhhXIX0eiT6yu83rZfOJ2K201jWpCbuNw9WMI2icyX6tlP2PxpNMb96_ZQn8mFb0LdXPWBpBKk2Wb-zqFcmUXPWef9olVb89oNVd2bzkpF1OhoMF8JV8msKVBSVRWwX90_rGlVhn9qd7unHTo8r9r0KcWDA51epcALCc35J-sOwR_X5sQ-9go9w0EDmWucoqcoMfGO6Y4RzHYFxIAnACVNTCLN6IQRSTNQhwezOsiy4C2-p_VOVn8-yDXLEIpNn6QfWE-gZSMjEUX3UBOxlK1vX7JMsLBTWQEv9Eg7Zf1SHjf5dAzVurT8bs_ePc8DFgfYTVW0Cu0jqskRYp65O3mM0BIEDmoDvVduhNUbByP4GaMA9ZZPgmN93i2aoAwMu9wWcXbzlAPD43dbh92ZwgAkdg7x8AMcMk-0LBmPe1ab3b63-5Lk9S9zxs4H4p-CLyWjfRtQJzwlvh8kKxUHLTgh-9YPn0W-WtCd_Tt0HtQZsBYwxIlUr6ad_-Ik2pZlLCe22oZLRnpagCAhfuOmm2Lo810uonlauaMoSGlkzQ4XiEkZZSOIx71I0_3f_tx-gNEqD4I4Dy1tZrZcnIElm96-OcWammGobFlkOflsYDVR8dQjeisBNRAlcfSuio4ni0z8KC8pw4dUm1VW7KBWZWjuwAH0ZIjTx6pYiPuoCIj7xB_KrObHHl9F-p_ziPBu_iem8CbD11k4zQbF7zN89EQYKV6c5twabU3fIupO3ehdhSjKoeXr4sVR4q4Tam8AkMHfCaFqN7j0JE4Z7_ihZXYyzPHKTSs0QsDb8j0jSU7IOKHctt_nI-RSAuziLk7FZHQsqjmcJODEL8zx2LBWhCRibmxJhyx3r4J-WonO7aGqB80myk8cBjIf5UZqGXITzlW4NoltyXAgXdF0KKL4Gv1N0SCIkdKJiG3K9TxJwkVFSmm6ENjOt2abRznd8jP9vhO_GV-7dSHdedTRY6e96xUNRWM5Kk7TJJBJ--PFGy1K97GT9RWkRgIF_WArJh7NErowIMYM5AQP5CJxZBkC-wY1JJfxUkwLDSKuI4eWRoU7vLEkuNeDxCQp2uW9Xw_ft8XJ2Yp2ShZVYSn51ist7s8dlxYxXHr1ZtRjd0LsXeffbScZ_1PrVI0FN6Nfy-HwUqMViAzk2xVL_ObyK-fn9PlIP116hpEUdIeDogdcXhMPrJzJDB-BIDOyelv9zqCVzH4iXqCat4JBs4ykPCyBBIY2xH_Ibiki5zeN7Q&sai=AMfl-YSaD_vHrDc1uEgnP_5IybfQ0MvdoZwjLXz48tdrQF3nOT7NMkfDvq288R0fFEyVPmZPM-_-C0Dpi-QCUaUmbR3S8c4OXe4Ul4eBHKlfFjCvCPeugs_7IZRGpAn3rcepqKSJpvsPtRyxdYGMETmqbrEx556fmQIa0X07H2tiLoaVbzUZCVYJUEM5kO4jKAxP9wI29qVJxRcoiwhxabS6Itp2ZJsHNYIvBjcLphP8L-yxGyJnaiw-x-Z9NVSzQ42wQA6GJnNft8uFy8dBe1gsS_5TRmnNUCTxsuftKYXnvjOml6hZXBOznwD0M_TEzonosNbp02eqrR9BfBMkb48q25EIMvhNdoMvOKRPm6pNj7vEMEEfvGZe0OfZiYl3fq4SK8rM7JBTtIq3wCcsAUmu3Kv_TgX8FYx-x1JPRclqaAQjOh87roywJLZXnAmONXnXUoUv1zt6kfDySnCmcUiCtHKB4X9TNL-EPjsOvytxIeJJBRdXcdWxMIL6q4KC-mxnS-HYb28JXk3W1kNEjEbc7CLjVSh04_GAIwJjQboVylkpSmgc1zl5eXxU-Wdg82A9iP-Bn0X_besnpbfoXIhoJuv4LgKudOVrDpxWBKlPkWpPgrkpMwvJONMISrMyYRhgVgY-9mbBzT9fWx9fVhX3fPAypG9h3L_wCHZUNLATJIbhawjw5GwaoaNMZAwB8Jnm0VpcoPJ30KLblmT215SMhJscJYvBWG59u9Ru6fkfl-IYgqQUv_ccRXApawbfQeP1Pwz_ZyugN73334yOuX1mLn3AON3QEayqcnm6F2mhy_xQllOj__O1r_BNBcKuw2Cq5LCL5So7amXOwCTovBougalfX3WjUWE81WCXX93njvhp5LT6m6cTh_MSXvnQnDyyfUN7W0znPJEAzVtKSZ8wD4XNbB-DLFa8BKBDayJTAFw&sig=Cg0ArKJSzGONoQC09EAsEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9zaGFuZ3JpLWxhLmNvbQ&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=455&vt=11&dtpt=452&dett=2&cstd=0&cisv=r20251117.78706&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.194.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 28 Nov 2025 10:20:09 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Fri, 28 Nov 2025 10:20:09 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"39664348":"0x310cbdc78a40c3320000000000000000","39664349":"0x78ffc627b1bdb5a70000000000000000","39664350":"0x9379b6812337f5850000000000000000"},"debug_key":"13904989645752669726","debug_reporting":true,"destination":["https://shangri-la.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["4521189","4524190","1612996"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4378683"]},"max_event_level_reports":2,"priority":"0","source_event_id":"9723327684198841635"}
server: cafe

POST
H3 204 collect
analytics.google.com/g/ 0
0 41ms
40ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5bi1v9181474282za200zd9181474282&_p=1764325204366&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=359362692.1764325205&ecid=9452089&ul=zh-tw&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=gAAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528501~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764325204&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=reteam%27s%20Campsite.bio&en=3&ep.event_category=pause&ep.event_label=Mi41OC4yNDEuNzQ&epn.value=1&_et=35&tfd=6256
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:10 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
analytics.google.com/g/ 0
0 39ms
38ms Fetch
text/plain 216.239.34.181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5bj0h2v897965293za200zb9181474282zd9181474282&_p=1764325204366&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=359362692.1764325205&ul=zh-tw&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=gAAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105322304~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764325205&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2FNNrq69&dt=reteam%27s%20Campsite.bio&en=3&ep.event_category=pause&ep.event_label=Mi41OC4yNDEuNzQ&epn.value=1&_et=30&tfd=6490
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 28 Nov 2025 10:20:10 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 97EE 42 B
65 B 117ms
117ms Fetch
image/gif 142.250.199.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvV8oTpnSyiCcjXq0BKYnFdUVmtoyRTTQoTHIbKNBGKi7bcwnmarlYnsEfhsgml2xz1NM5MIko1XDzZWMd0_Ruq8nOpnkvUs80p7u37RP5qscHYq_nuf-mHSIwedsER8WVEzJBasQmwZW79x__vLu2fZkVgfCfxzFzQTVThWBG0cOClIuYnRCDwEMDDQQ9dC1HYjKv0HsJXYyv6wrC6&sai=AMfl-YQ-c_a1YFBv-H39i-xq52-SvckOws6y_va0ipy6lhc2A5gMscpJl97hDVQ-YLa8Y7PdOP68X8AZD32EnQF3LQNxQKzLmewuNrRIJLdydaFXrmws800exhn60pfAv0Cu1rd8DnyCZTHRmDbnvlEiVbkAypgCzPpOJyqHta6dk6ApAKbusB8xT_3IQEVHokHsF2YO4wnqZNplssg6phJval9KVSOl5vAueDabwjxlLIcrgKGyxD2wPYll3BrRNbrutGK0hTU&sig=Cg0ArKJSzLCpte8m12l1EAE&cid=CAQSoAEAwksa0W1kZffA4jWnAHQuADCrON2Tm8eMrY_x-HS1yBjnqX9P769BHHG3H4fbB9Lp7XSHpM3BJU7USvOF34xY1irrgFTdZxHrigvaF1q3SIdUMhTgr6hhb3vzgMm7h-EknF8q7GVDlGgG2qzdpaOQ6lQ3beWckyHJmYnlvYbZ64ZRoPxK42E9Rz1-J4FNSJcRO9nB5n3P7pcI8JsZvic2GAE&id=lidar2&mcvt=1000&p=0,0,250,300&tm=1577.3999938964844&tu=577.2999954223633&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20251105&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1798104457&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6025800800&rst=1764325207871&rpt=1510&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.199.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS