reurl.cc Open in urlscan Pro
35.229.143.32 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://web.alipearlhair.com/KDP_KFoK#Politique
Effective URL:
https://reurl.cc/7bk8rN
Submission: On November 30 via api (November 30th 2025, 5:32:30 am UTC) from FR — Scanned from CA

Summary HTTP 293 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 51 IPs in 6 countries across 49 domains to perform 293 HTTP transactions. The main IP is 35.229.143.32, located in Taipei, Taiwan and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is reurl.cc. The Cisco Umbrella rank of the primary domain is 255857.
TLS certificate: Issued by E7 on October 30th 2025. Valid for: 3 months.

This is the only time reurl.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	170.106.34.222 170.106.34.222	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
7	35.229.143.32 35.229.143.32	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	151.101.1.229 151.101.1.229	54113 (FASTLY) (FASTLY)
2	151.101.65.55 151.101.65.55	54113 (FASTLY) (FASTLY)
6	142.250.64.104 142.250.64.104	15169 (GOOGLE) (GOOGLE)
28	18.173.132.120 18.173.132.120	16509 (AMAZON-02) (AMAZON-02)
2	203.74.220.3 203.74.220.3	131660 (CHTCDN Da...) (CHTCDN Data Communication Business Group)
10	142.250.80.34 142.250.80.34	15169 (GOOGLE) (GOOGLE)
5	18.173.132.10 18.173.132.10	16509 (AMAZON-02) (AMAZON-02)
14	35.75.180.237 35.75.180.237	16509 (AMAZON-02) (AMAZON-02)
5	18.238.55.90 18.238.55.90	16509 (AMAZON-02) (AMAZON-02)
5	116.50.36.71 116.50.36.71	18046 (DONGFONG-...) (DONGFONG-TW DongFong Technology Co. Ltd.)
10	3.114.255.95 3.114.255.95	16509 (AMAZON-02) (AMAZON-02)
5	34.95.67.231 34.95.67.231	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
5	54.238.82.241 54.238.82.241	16509 (AMAZON-02) (AMAZON-02)
30	203.75.214.136 203.75.214.136	3462 (HINET Dat...) (HINET Data Communication Business Group)
5 10	35.201.76.93 35.201.76.93	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
13 18	142.251.40.130 142.251.40.130	15169 (GOOGLE) (GOOGLE)
5	35.227.249.156 35.227.249.156	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
7	31.13.66.19 31.13.66.19	32934 (FACEBOOK) (FACEBOOK)
13	142.250.80.78 142.250.80.78	15169 (GOOGLE) (GOOGLE)
2	142.250.81.238 142.250.81.238	15169 (GOOGLE) (GOOGLE)
2	74.119.117.47 74.119.117.47	19750 (AS-CRITEO) (AS-CRITEO)
1	103.132.192.30 103.132.192.30	138552 (RTBHOUSE-...) (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD.)
1	210.59.219.34 210.59.219.34	3462 (HINET Dat...) (HINET Data Communication Business Group)
7	31.13.71.36 31.13.71.36	32934 (FACEBOOK) (FACEBOOK)
10	142.250.80.46 142.250.80.46	15169 (GOOGLE) (GOOGLE)
4	192.178.218.154 192.178.218.154	15169 (GOOGLE) (GOOGLE)
4	142.251.40.227 142.251.40.227	15169 (GOOGLE) (GOOGLE)
1	74.119.117.5 74.119.117.5	19750 (AS-CRITEO) (AS-CRITEO)
5	107.178.241.176 107.178.241.176	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	35.185.136.122 35.185.136.122	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4	74.119.117.62 74.119.117.62	19750 (AS-CRITEO) (AS-CRITEO)
11	57.144.180.128 57.144.180.128	32934 (FACEBOOK) (FACEBOOK)
1	31.13.80.12 31.13.80.12	32934 (FACEBOOK) (FACEBOOK)
2 3	52.204.123.3 52.204.123.3	14618 (AMAZON-AES) (AMAZON-AES)
2 2	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
1 2	44.218.64.233 44.218.64.233	14618 (AMAZON-AES) (AMAZON-AES)
1 1	151.101.193.44 151.101.193.44	54113 (FASTLY) (FASTLY)
1	172.67.222.174 172.67.222.174	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.21.96.9 104.21.96.9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.238.55.64 18.238.55.64	16509 (AMAZON-02) (AMAZON-02)
1	108.138.128.34 108.138.128.34	16509 (AMAZON-02) (AMAZON-02)
2	142.250.80.97 142.250.80.97	15169 (GOOGLE) (GOOGLE)
1	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
1	23.57.90.112 23.57.90.112	20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
13	142.250.176.194 142.250.176.194	15169 (GOOGLE) (GOOGLE)
2	142.251.40.193 142.251.40.193	15169 (GOOGLE) (GOOGLE)
2	142.251.40.161 142.251.40.161	15169 (GOOGLE) (GOOGLE)
3 5	104.18.27.193 104.18.27.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 4	68.67.160.76 68.67.160.76	29990 (ASN-APPNEX) (ASN-APPNEX)
1 1	35.212.100.6 35.212.100.6	15169 (GOOGLE) (GOOGLE)
1 1	74.119.117.57 74.119.117.57	19750 (AS-CRITEO) (AS-CRITEO)
1 1	20.33.69.37 20.33.69.37	8069 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
10	35.201.76.198 35.201.76.198	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	34.117.228.201 34.117.228.201	() ()
293	51

1 170.106.34.222 (Ashburn, United States) 1 redirects

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

web.alipearlhair.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 35.229.143.32 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 32.143.229.35.bc.googleusercontent.com

reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 151.101.1.229 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 151.101.65.55 (United States)

ASN54113 (FASTLY, US)

anymind360.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

6 142.250.64.104 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s31-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

28 18.173.132.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-132-120.jfk52.r.cloudfront.net

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 203.74.220.3 (New Taipei City, Taiwan)

ASN131660 (CHTCDN Data Communication Business Group, TW)
PTR: 203-74-220-3.hinet-ip.hinet.net

ad-specs.guoshipartners.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 142.250.80.34 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 18.173.132.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-132-10.jfk52.r.cloudfront.net

cdn.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

14 35.75.180.237 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com

ad.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 18.238.55.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-55-90.jfk52.r.cloudfront.net

tracking-client.91app.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 116.50.36.71 (Taiwan)

ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW)
PTR: 116-50-36-71.dft.tw

cm.lndata.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 3.114.255.95 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com

cm-dev-poc.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 34.95.67.231 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 231.67.95.34.bc.googleusercontent.com

fcm.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 54.238.82.241 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com

fcm2.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

30 203.75.214.136 (Taipei, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 203-75-214-136.hinet-ip.hinet.net

t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
342edee7-5b82-489a-af0c-b9c91dd3c292.t.ssp.hinet.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 35.201.76.93 (Kansas City, United States) 5 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 93.76.201.35.bc.googleusercontent.com

c.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

18 142.251.40.130 (United States) 13 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 35.227.249.156 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 156.249.227.35.bc.googleusercontent.com

m.holmesmind.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 31.13.66.19 (Ashburn, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-iad3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

13 142.250.80.78 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f14.1e100.net

fundingchoicesmessages.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.250.81.238 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s74-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 74.119.117.47 (United States)

ASN19750 (AS-CRITEO, US)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 103.132.192.30 (Singapore)

ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG)
PTR: ip-103-132-192-30.rtbhouse.net

prebid-asia.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 210.59.219.34 (Taichung, Taiwan)

ASN3462 (HINET Data Communication Business Group, TW)
PTR: 210-59-219-34.hinet-ip.hinet.net

prebid.scupio.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 31.13.71.36 (New York, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-lga3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 142.250.80.46 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f14.1e100.net

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 192.178.218.154 (United States)

ASN15169 (GOOGLE, US)
PTR: yuiadtq-in-f154.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 142.251.40.227 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f3.1e100.net

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 74.119.117.5 (United States)

ASN19750 (AS-CRITEO, US)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 107.178.241.176 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 176.241.178.107.bc.googleusercontent.com

onead.onevision.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 35.185.136.122 (Taipei, Taiwan)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 122.136.185.35.bc.googleusercontent.com

re-news.tw	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 74.119.117.62 (United States)

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

11 57.144.180.128 (New York, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-03-lga3.fbcdn.net

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 31.13.80.12 (Toronto, Canada)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-yyz1.fbcdn.net

scontent-yyz1-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

3 52.204.123.3 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-123-3.compute-1.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 15.197.193.217 (Seattle, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 44.218.64.233 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-218-64-233.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 151.101.193.44 (United States) 1 redirects

ASN54113 (FASTLY, US)

trc.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 172.67.222.174 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

nearbymed.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.21.96.9 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

img.gbyhn.com.tw	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 18.238.55.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-55-64.jfk52.r.cloudfront.net

static.wixstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 108.138.128.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-34.jfk50.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.250.80.97 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f1.1e100.net

9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.250.72.98 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 23.57.90.112 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-57-90-112.deploy.static.akamaitechnologies.com

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

13 142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools
ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.251.40.193 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s38-in-f1.1e100.net

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 142.251.40.161 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

5 104.18.27.193 (Ascension Island) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

4 68.67.160.76 (Brooklyn, United States) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 35.212.100.6 (Washington, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 6.100.212.35.bc.googleusercontent.com

mweb.ck.inmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 74.119.117.57 (United States) 1 redirects

ASN19750 (AS-CRITEO, US)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 20.33.69.37 (Washington, United States) 1 redirects

ASN8069 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.temu.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

10 35.201.76.198 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 198.76.201.35.bc.googleusercontent.com

track.91app.io	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 34.117.228.201 (None, )

ASN- ()

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
82	holmesmind.com 5 redirects cdn.holmesmind.com — Cisco Umbrella Rank: 214881 ad.holmesmind.com — Cisco Umbrella Rank: 122483 cm-dev-poc.holmesmind.com — Cisco Umbrella Rank: 202535 fcm.holmesmind.com — Cisco Umbrella Rank: 258207 fcm2.holmesmind.com — Cisco Umbrella Rank: 244704 c.holmesmind.com — Cisco Umbrella Rank: 136701 m.holmesmind.com — Cisco Umbrella Rank: 236279	273 KB
33	doubleclick.net 13 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 308 cm.g.doubleclick.net — Cisco Umbrella Rank: 346 stats.g.doubleclick.net — Cisco Umbrella Rank: 249 googleads.g.doubleclick.net — Cisco Umbrella Rank: 78	301 KB
30	hinet.net t.ssp.hinet.net — Cisco Umbrella Rank: 72255 aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net 342edee7-5b82-489a-af0c-b9c91dd3c292.t.ssp.hinet.net	11 KB
23	google.com fundingchoicesmessages.google.com — Cisco Umbrella Rank: 800 analytics.google.com — Cisco Umbrella Rank: 228 www.google.com Failed	77 KB
15	googlesyndication.com 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 166 tpc.googlesyndication.com — Cisco Umbrella Rank: 242	175 KB
12	fbcdn.net static.xx.fbcdn.net — Cisco Umbrella Rank: 704 scontent-yyz1-1.xx.fbcdn.net — Cisco Umbrella Rank: 39839	242 KB
10	91app.io track.91app.io — Cisco Umbrella Rank: 98921	2 KB
7	facebook.com www.facebook.com — Cisco Umbrella Rank: 144	218 KB
7	facebook.net connect.facebook.net — Cisco Umbrella Rank: 261	193 KB
7	reurl.cc reurl.cc — Cisco Umbrella Rank: 255857	11 KB
6	criteo.com 1 redirects bidder.criteo.com — Cisco Umbrella Rank: 3793 gum.criteo.com — Cisco Umbrella Rank: 594 dis.criteo.com — Cisco Umbrella Rank: 976	16 KB
6	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 77	898 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 804	3 KB
5	onevision.com.tw onead.onevision.com.tw — Cisco Umbrella Rank: 142267	2 KB
5	lndata.com cm.lndata.com — Cisco Umbrella Rank: 188136	2 KB
5	91app.com tracking-client.91app.com — Cisco Umbrella Rank: 172191	17 KB
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 386	4 KB
4	adtrafficquality.google ep2.adtrafficquality.google — Cisco Umbrella Rank: 375 ep1.adtrafficquality.google — Cisco Umbrella Rank: 367	47 KB
4	crwdcntrl.net 2 redirects bcp.crwdcntrl.net — Cisco Umbrella Rank: 1384 tags.crwdcntrl.net — Cisco Umbrella Rank: 1324	14 KB
4	google.ca www.google.ca — Cisco Umbrella Rank: 8841	252 B
3	doubleverify.com cdn.doubleverify.com — Cisco Umbrella Rank: 590 rtb0.doubleverify.com Failed	107 KB
2	eyeota.net 1 redirects ps.eyeota.net — Cisco Umbrella Rank: 1295	2 KB
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 548	1 KB
2	re-news.tw re-news.tw	27 KB
2	criteo.net static.criteo.net — Cisco Umbrella Rank: 1137	59 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 101	21 KB
2	guoshipartners.com ad-specs.guoshipartners.com — Cisco Umbrella Rank: 155222	25 KB
2	anymind360.com anymind360.com — Cisco Umbrella Rank: 15779	174 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 355	56 KB
1	temu.com 1 redirects www.temu.com — Cisco Umbrella Rank: 808	518 B
1	inmobi.com 1 redirects mweb.ck.inmobi.com — Cisco Umbrella Rank: 5707	461 B
1	wixstatic.com static.wixstatic.com — Cisco Umbrella Rank: 7613	1010 KB
1	gbyhn.com.tw img.gbyhn.com.tw	549 KB
1	nearbymed.com nearbymed.com	15 KB
1	taboola.com 1 redirects trc.taboola.com — Cisco Umbrella Rank: 900	546 B
1	scupio.com prebid.scupio.com — Cisco Umbrella Rank: 89569	168 B
1	creativecdn.com prebid-asia.creativecdn.com — Cisco Umbrella Rank: 31120 invstatic101.creativecdn.com Failed	171 B
1	alipearlhair.com 1 redirects web.alipearlhair.com	1 KB
0	contextweb.com Failed bh.contextweb.com Failed
0	3lift.com Failed eb2.3lift.com Failed
0	sonobi.com Failed sync.go.sonobi.com Failed
0	rubiconproject.com Failed pixel.rubiconproject.com Failed
0	2mdn.net Failed s0.2mdn.net Failed
0	33across.com Failed cdn-ima.33across.com Failed
0	openxcdn.net Failed oa.openxcdn.net Failed
0	creditcards.com.tw Failed creditcards.com.tw Failed
0	prnasia.com Failed mma.prnasia.com Failed
0	racingcharger.tw Failed img.racingcharger.tw Failed
0	appier.net Failed gocm.c.appier.net Failed
293	49

	Domain	Requested by
33	cdn.holmesmind.com	reurl.cc cdn.holmesmind.com ad.holmesmind.com
23	t.ssp.hinet.net	cdn.holmesmind.com t.ssp.hinet.net
18	cm.g.doubleclick.net	13 redirects googleads.g.doubleclick.net 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
14	ad.holmesmind.com	cdn.holmesmind.com reurl.cc
13	fundingchoicesmessages.google.com	securepubads.g.doubleclick.net
11	pagead2.googlesyndication.com	reurl.cc 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com securepubads.g.doubleclick.net pagead2.googlesyndication.com
11	static.xx.fbcdn.net	www.facebook.com static.xx.fbcdn.net
10	track.91app.io	tracking-client.91app.com
10	analytics.google.com	www.googletagmanager.com
10	c.holmesmind.com	5 redirects cdn.holmesmind.com
10	cm-dev-poc.holmesmind.com	cdn.holmesmind.com
10	securepubads.g.doubleclick.net	anymind360.com securepubads.g.doubleclick.net reurl.cc
7	www.facebook.com	connect.facebook.net reurl.cc static.xx.fbcdn.net
7	connect.facebook.net	reurl.cc fcm2.holmesmind.com connect.facebook.net
7	reurl.cc	reurl.cc
6	aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net	reurl.cc t.ssp.hinet.net
6	www.googletagmanager.com	reurl.cc www.googletagmanager.com
5	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
5	onead.onevision.com.tw	ad-specs.guoshipartners.com reurl.cc
5	m.holmesmind.com	cdn.holmesmind.com
5	fcm2.holmesmind.com	cdn.holmesmind.com
5	fcm.holmesmind.com	cdn.holmesmind.com
5	cm.lndata.com	cdn.holmesmind.com
5	tracking-client.91app.com	cdn.holmesmind.com
4	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	gum.criteo.com	static.criteo.net gum.criteo.com
4	www.google.ca	reurl.cc
4	stats.g.doubleclick.net	www.googletagmanager.com
3	bcp.crwdcntrl.net	2 redirects tags.crwdcntrl.net
2	ep1.adtrafficquality.google	ep2.adtrafficquality.google 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
2	rtb0.doubleverify.com	cdn.doubleverify.com
2	tpc.googlesyndication.com	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
2	ep2.adtrafficquality.google	reurl.cc ep2.adtrafficquality.google
2	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	ps.eyeota.net	1 redirects reurl.cc
2	match.adsrvr.org	2 redirects
2	re-news.tw	reurl.cc
2	static.criteo.net	cdn.holmesmind.com securepubads.g.doubleclick.net
2	www.google-analytics.com	reurl.cc www.google-analytics.com
2	ad-specs.guoshipartners.com	reurl.cc
2	anymind360.com	reurl.cc
2	cdn.jsdelivr.net	reurl.cc
1	www.temu.com	1 redirects
1	dis.criteo.com	1 redirects
1	mweb.ck.inmobi.com	1 redirects
1	cdn.doubleverify.com	reurl.cc
1	googleads.g.doubleclick.net	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	static.wixstatic.com	reurl.cc
1	img.gbyhn.com.tw	reurl.cc
1	nearbymed.com	reurl.cc
1	trc.taboola.com	1 redirects
1	scontent-yyz1-1.xx.fbcdn.net	www.facebook.com
1	342edee7-5b82-489a-af0c-b9c91dd3c292.t.ssp.hinet.net	cdn.holmesmind.com
1	bidder.criteo.com	static.criteo.net
1	prebid.scupio.com	cdn.holmesmind.com
1	prebid-asia.creativecdn.com	cdn.holmesmind.com
1	web.alipearlhair.com	1 redirects
0	bh.contextweb.com Failed	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
0	eb2.3lift.com Failed	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
0	sync.go.sonobi.com Failed	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
0	pixel.rubiconproject.com Failed	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
0	www.google.com Failed	9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
0	s0.2mdn.net Failed	reurl.cc
0	cdn-ima.33across.com Failed	securepubads.g.doubleclick.net
0	invstatic101.creativecdn.com Failed	securepubads.g.doubleclick.net
0	oa.openxcdn.net Failed	securepubads.g.doubleclick.net
0	creditcards.com.tw Failed	reurl.cc
0	mma.prnasia.com Failed	reurl.cc
0	img.racingcharger.tw Failed	reurl.cc
0	gocm.c.appier.net Failed	reurl.cc
293	71

This site contains links to these domains. Also see Links.

Domain
ad.holmesmind.com
www.multiforce.com.tw
30iptv.net
re-news.tw
youtils.cc
www.comptw.com
stockinfo.tw
adssettings.google.com

Subject Issuer	Validity	Valid
reurl.cc E7	`2025-10-30` - `2026-01-28`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2025 Q2	`2025-06-02` - `2026-07-04`	a year	crt.sh
anymind360.com R13	`2025-10-13` - `2026-01-11`	3 months	crt.sh
*.google-analytics.com WR2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.holmesmind.com Go Daddy Secure Certificate Authority - G2	`2025-03-06` - `2026-04-07`	a year	crt.sh
ad-specs.guoshipartners.com Go Daddy Secure Certificate Authority - G2	`2025-01-08` - `2026-01-21`	a year	crt.sh
*.g.doubleclick.net WR2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.91app.com Amazon RSA 2048 M04	`2025-07-25` - `2026-08-22`	a year	crt.sh
*.lndata.com GeoTrust G5 TLS RSA4096 SHA384 2022 CA1	`2024-11-11` - `2025-12-12`	a year	crt.sh
*.t.ssp.hinet.net HiPKI OV TLS CA - G1	`2025-02-12` - `2026-02-12`	a year	crt.sh
*.facebook.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-09-08` - `2025-12-07`	3 months	crt.sh
*.google.com WR2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-10-16` - `2026-01-18`	3 months	crt.sh
*.creativecdn.com RapidSSL TLS RSA CA G1	`2025-04-17` - `2026-05-02`	a year	crt.sh
*.scupio.com Sectigo RSA Organization Validation Secure Server CA	`2025-09-02` - `2026-10-03`	a year	crt.sh
*.google.ca WR2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-11-14` - `2026-02-11`	3 months	crt.sh
onead.onevision.com.tw R12	`2025-10-01` - `2025-12-30`	3 months	crt.sh
re-news.tw R12	`2025-10-05` - `2026-01-03`	3 months	crt.sh
nearbymed.com WE1	`2025-11-14` - `2026-02-12`	3 months	crt.sh
gbyhn.com.tw WE1	`2025-10-29` - `2026-01-27`	3 months	crt.sh
*.wixstatic.com R12	`2025-11-16` - `2026-02-14`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M04	`2025-08-09` - `2026-09-07`	a year	crt.sh
*.doubleverify.com DigiCert TLS RSA SHA256 2020 CA1	`2025-01-14` - `2026-01-14`	a year	crt.sh
adtrafficquality.google WR2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
tpc.googlesyndication.com WR2	`2025-10-27` - `2026-01-19`	3 months	crt.sh
track.91app.io WR3	`2025-10-28` - `2026-01-26`	3 months	crt.sh

This page contains 32 frames:

Primary Page: https://reurl.cc/7bk8rN
Frame ID: 39881C2900C0BA703D4B997E853B9DC8
Requests: 81 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 4D45D0EC5A54187CBCB26FB6A9FE968D
Requests: 16 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: B2DA1A8A1D4F11B38D354E5E17A95EB1
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 31CE28AE7DF7A56AAF2BF0F0A5EF599B
Requests: 26 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: DA549E99E0ACF0485A5A14653F71DA8F
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 8122F9E3A4999F4405DF293C467433C1
Requests: 9 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: 012CE6693DEA4FD8C501FF31DFD5AEB5
Requests: 16 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/presetfn.js?20231115
Frame ID: D9D03D267C5F3ED71094384D16394B3E
Requests: 8 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: C6510769F9E4E5360553204D7C42A89B
Requests: 11 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: AE7EC89916C0609D057282D18DD03481
Requests: 11 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: 54C6E1A852CA91C23F0FCDF5EE2DBDB4
Requests: 11 HTTP requests in this frame

Frame: https://cdn.holmesmind.com/js/capmapping.htm
Frame ID: CFEBFCA00B7F957983AC1E94635DB66F
Requests: 11 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: F2DB88BAB13EC01B7A1005651A2D989A
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: 1E040F80D49B7CA47199939A0D1FC61C
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: 75508B055BBA8A600D09EB42D7DEF3E3
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: B7D73A482352166630E7FE19E1556E91
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: 8B68DCEE1CBE4F81555482424798F9F7
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: 341B8891985859A64490DC9104E05EFB
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: 0CA1303E76E96A4A97BC34DA02B6E969
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: E4B1FF22A7F0E498E78CD2F5BD1B533A
Requests: 1 HTTP requests in this frame

Frame: https://cm-dev-poc.holmesmind.com/fp
Frame ID: 28D44062B0D4F5E46B5AE4F42BECB614
Requests: 1 HTTP requests in this frame

Frame: https://fcm.holmesmind.com/cm.php
Frame ID: AE207D793EE588D7C67AA3E4D9AD1B4E
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: E1B8DA1BFDC9BF4139ACED86C5D4DA7F
Requests: 3 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 27071D20B61FEC5AA1A4C1A9B3F4EF88
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fhref%3Dhttps%253A%252F%252Fwww.facebook.com%252Freurl.cc%252F%26tabs%3Dtimeline%26width%3D340%26height%3D500%26small_header%3Dfalse%26adapt_container_width%3Dtrue%26hide_cover%3Dfalse%26show_facepile%3Dtrue%26appId
Frame ID: DACAD392581802FE3207EE44532EFC09
Requests: 26 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=reurl.cc
Frame ID: EE0E47D5E2A365D1C1659AD87297ABB3
Requests: 2 HTTP requests in this frame

Frame: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: CC0567685264962104F54683F2186C1D
Requests: 1 HTTP requests in this frame

Frame: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: 644C026AA2581A7DBDCF05F208FB41C2
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CGUQ78nTAhjonsW_AjAB&v=APEucNXXUdA-xptDGQGM1Ak_zs-YC07U0L8JlMHEOPyqJGb_Tm77n-JywmVViWJr_YSfYRyFTTPFLFz1L6qCog_55uG4aLGyIaoCUXODlZive4l8JZMn5hQ
Frame ID: C73F559297A2DCFCB1DFF2DA6A3D59C6
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: DE0DE7F675CFE2E6D8F1A4D177C2AD83
Requests: 9 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Frame ID: CD64B73666F0FDA2156873BE4CA4BCD4
Requests: 3 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=
Frame ID: 512F2B1310848871ACE923EC3FD5D651
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Meilleur IPTV Abonnement en France

Page URL History Show full URLs

https://web.alipearlhair.com/KDP_KFoK HTTP 301
https://reurl.cc/7bk8rN Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Laravel (Web frameworks) Expand

Overall confidence: 100%
Detected patterns

Vue.js (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/vue(?:\.min)?\.js

AppNexus (Advertising) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

293
Requests

84 %
HTTPS

0 %
IPv6

49
Domains

71
Subdomains

51
IPs

6
Countries

4540 kB
Transfer

13396 kB
Size

56
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://ad.holmesmind.com/adserver/c?p=14210:131880:236322:171a2884f9e206fb7b46de5ddbac8cad:14756&dest=https%3A%2F%2Fwww.clickforce.com.tw%2Fedcontent_d.php%3Flang%3Dtw%26tb%3D4%26id%3D7152%26utm_source%3Dmultiforce%26utm_medium%3Dpaid%26utm_campaign%3Dself_operation

Search URL Search Domain Scan URL

URL: https://www.multiforce.com.tw/home.jsp?lang=tw

Search URL Search Domain Scan URL

URL: https://30iptv.net/Davinci_JKE5
Title: Proceed, I trust this link

Search URL Search Domain Scan URL

URL: https://re-news.tw/racingcharger/61273

Search URL Search Domain Scan URL

URL: https://re-news.tw/nearbymed/taekwondo-athlete-recovering-from-multi-cancer

Search URL Search Domain Scan URL

URL: https://re-news.tw/prnasia/4834652_XG34652_2

Search URL Search Domain Scan URL

URL: https://re-news.tw/gbyhn/70970

Search URL Search Domain Scan URL

URL: https://re-news.tw/creditcard/307231

Search URL Search Domain Scan URL

URL: https://re-news.tw/rich101/2165

Search URL Search Domain Scan URL

URL: https://re-news.tw/zocha/664f06a4333c44b7de8afda5

Search URL Search Domain Scan URL

URL: https://youtils.cc/emoji
Title: Emoji

Search URL Search Domain Scan URL

URL: https://youtils.cc/geoip
Title: Geo IP

Search URL Search Domain Scan URL

URL: https://youtils.cc/big5gb
Title: Big5/GB Converter

Search URL Search Domain Scan URL

URL: https://youtils.cc/qrcode
Title: QR Code

Search URL Search Domain Scan URL

URL: https://youtils.cc/length
Title: Length Converter

Search URL Search Domain Scan URL

URL: https://www.comptw.com/
Title: Taiwan Company

Search URL Search Domain Scan URL

URL: https://stockinfo.tw/
Title: Taiwan Stock

Search URL Search Domain Scan URL

URL: https://youtils.cc/wordcounter/zh-Hants
Title: Word Counter

Search URL Search Domain Scan URL

URL: https://youtils.cc/dateCalculator
Title: Date Calculator

Search URL Search Domain Scan URL

URL: https://youtils.cc/lunarCalendar
Title: Lunar Calendar

Search URL Search Domain Scan URL

URL: https://youtils.cc/utm
Title: UTM tool

Search URL Search Domain Scan URL

URL: https://adssettings.google.com/whythisad?source=display&reasons=AQde936USgfVkLWSZa534wVpoW7A7R0YZW4THHag9whcXCv-G-YTTK88PcJV14WcALrzJ3JKmH2BwYXP4x8fWpsOD17d5VZj5NRAcjcL_DIypnrGLmMhsSnVXelti6LMxZHczyW33e4VuPt7i-B0q3K4ksUmyPwOYxYqkdVZizInTt_1gzAULCTVmXyEfvynCUbJLJqPlIEfFwWRNvIyS7ws7G7FGJ4ue-LDuMI-Px4VA9hE1I91V3XxZ4bIzC0xf4mufdrJt1PJOohCDWLI9FmWNBMuhIolBBurZ3Ca11emAmsQncLKnmEkqhh03e4h_2xb4F1_Y58pcwzdnS0RKkXvJZqgsUQqOSraFF3bBqL06TLh760laDy6_w70IibYCu0yRnrd_CUDvF2GWrZ5xF4HezWC--uMW8BHh4dr0AFbyOSt5zEd2vrAx-t6-Rs5MDGgvBUAZs3Zogdy0xqcyCpPEO1kGsrK3b_q2qX7VBLGqpa03syBPFV8K_1JJsY0Jcxpz_zusgXKI3gEvxLQkBFMd1Jqt4ydsklTjY4JTDQFHXlh3fpKQnQJk_8Q9hcfEJJVxtmkIKY3djyoJDJFXGeucVXpVL0bZ1uEEEwbsAZO7UHRZZVrVALmdr1A6KzgvhdmAoYax_B1WYo5FMQYUWfg7TJcqm4JoxUT-BHj4MNCBrBIM1cVS1unGfeB3Urtu57r5c-Su33JdEcUwzkJJ9EhRCOPprqwIeGDHUyPg4EOeUKRUoVacFKZoSMS531LMnv4qA5JVl8d6oHS7WF7b5DgeUeSw9WC8tXq9uC4stjZJr-we-ArhrZSOPE0ODKzAdNHOg-qn7V6f4pdt3ec8WY8ZvPnvCJmXT3pTylCQn1ZjqihyekrOJzMARHoZGstp05AHuFEna53FIWm8sdYKf6QYdssr2jbTaSWxqOn3tj3G_UDvPf4a1wXwgLsiIUYNQT-PdeqtDVeCVuCMtoqpyldDMIAm7j9U0HhGJPOMk7Vt1yi5emYnViBIf4Y36LVeRio1O1Be5iFkrXPARFZnzpjW8e-Rc4S6Ca-fRTp9oCVbMxrO_X2iHODQHpX-Dg9NmsvP_i4kswGG6O5z5pg-lM84TwAfv1SF6wvGXLQd0UcvbVB1deDfLRG450Ajtfo6r9rTscRzHUiVmg7GwpG-zQ6DUfHEhcyplcvBjz6H56lnnMCBUfaLfw2lmR0DLn65zD-ISNpm0L6LlChDgNwc78TF3zV83xUMMGBg4-pSuvZ2B1hS5V9dyaqN8k3QoO-MTzFIerUmx3wwfm1TQO1kwYmv__emdEK-on6JpP0sbp2r_uXrxKNxtiQYl73LeoJLhZaGsbw4D0RtrC5D-P76xPLofa3WxRdgmDKhr4SWIeQ-U29guuRcnHvWNtskqzr8MgX4hZV4fas4dHWzle7SFl9aFwjdKNBkJqA_Tgxmij57MjTJsgVw4tpwKaF4E0XA61DACh9KNgcVTC9HSZI2gTJQSXewnSnZqxDo09cKGxa1GJ6dIFpuk8jfXqOD4b8t2lLgbRuteBz-ProvKj1bLogz1HtEUlNqhNvHC78U73LLh5gT47l5aOVyyMMpSOWD8OMUq57VS_yTdbYXBKDJ1YdKzFLrK7efZzr26U7-L28sDU7XdL5GfVPGX7d5Tqgo0AIo8M0R7D-2wGxUzSMarXqxSX3rAJhhUAHGNmy-mVdWVXRo5rDrvLaLAO5kIYbj2oFXUeMH7g7_9xZuLKgTy-F11r9b0XnqlUkeZQYdNpPS1eSwTsDFL36ZNDasY-2sZ0CAj0hRauDG_qKoxJFjE_ldkNV8JAXpicZwQZSFsftUXI0uj9xCgTzLTf9vHe89rQh_lu6w9_sESKwUxKir7zJX7xuNFTaRJW4j14klCKGTEWGEZQzYkLX8eGfRXawRKXTCofSAfISFC9cAQRy9JsWsZaENkn9vdJAxzKbQnIkExXRkj6kfuwJ0_czny9voLWldCS9ZwRfIg6SymR5CWI6ad00rkYL7tFbQthguY-5AjzNgmmSiNwPSu_KL0SFmTOAjKA8yAMOs-Cdg8RRqni4ikPqD8tP4VrNuuN7tbgOMZz0Cxom3JfXPoHaaLdRWANAPcMkx8SfEv9hK3DOAxLwrs5q2YxKzC4eZbj7Bzef3QkDAv2Rrx7J0dUoI8Tk0JuZWSPg

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://web.alipearlhair.com/KDP_KFoK HTTP 301
https://reurl.cc/7bk8rN Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 51

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

Request Chain 55

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 59

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

Request Chain 62

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 66

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

Request Chain 69

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 73

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

Request Chain 76

https://c.holmesmind.com/cm HTTP 302
https://c.holmesmind.com/cm?tc=getIn&

Request Chain 80

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc= HTTP 302
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

Request Chain 110

https://ad2.apx.appier.net/v1/prebid/bid HTTP 307
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid

Request Chain 196

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id} HTTP 302
https://onead.onevision.com.tw/v2/pixel/ltm?id=fb7f07780678ec69d6ef9ea37093b314

Request Chain 197

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1 HTTP 302
https://onead.onevision.com.tw/v2/pixel/ttd?id=1478f59a-f97a-4394-91ab-26594eb7c4f1

Request Chain 198

https://ps.eyeota.net/pixel?pid=3m51m51&uid=ff12e431-cdad-11f0-95fe-42010a000008&t=ajs HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=ff12e431-cdad-11f0-95fe-42010a000008&t=ajs

Request Chain 199

https://trc.taboola.com/sg/onedata/1/cm HTTP 302
https://onead.onevision.com.tw/v2/pixel/taboola?id=e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c

Request Chain 252

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1&gdpr=0&C=1

Request Chain 253

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aSvXBdHM6zwABJ12Ak9TgQAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1

Request Chain 254

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEJa99m5Ogcb7tNJ-awfEd6U&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEJa99m5Ogcb7tNJ-awfEd6U%26google_cver%3D1

Request Chain 255

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26gdpr%3D0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAxMTQ3NjEyNzk4OTExNTI5MQ%3D%3D&gdpr=0

Request Chain 258

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESENa1h98yEGHvDaxUxuVoduw&google_cver=1&google_push=AXcoOmQn90lO3A2M9e94vvLG1dq-QI0Z4fUocIIOMhL6BlPlMLV6LSithRKKg4fFFUi8jw1O1avko_kgtkEt54ODklGChSsgs1N6lw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjY2ZjlmOWYtNmM3Ny00ZWZjLTgyZTItZTZjYzNiNjEwMmVl&google_gid=CAESENa1h98yEGHvDaxUxuVoduw&google_cver=1&google_push=AXcoOmQn90lO3A2M9e94vvLG1dq-QI0Z4fUocIIOMhL6BlPlMLV6LSithRKKg4fFFUi8jw1O1avko_kgtkEt54ODklGChSsgs1N6lw

Request Chain 259

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmR9WhS9su5_B2Yf2pl2TqJeKTUyANixeR0V0cZEB9e_xlcjRidPOD8-OrEqDuRaFjpGJSKtcOvWwjQWSCPRk2_99hvFTSfcFA&google_gid=CAESENUyAwTswumQfD0KnF-Q8-s&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1DM280OFd0RnVGb0NzQnBwRjVzeGtYdkF5LXlxclVncHpwblcydw&google_push=AXcoOmR9WhS9su5_B2Yf2pl2TqJeKTUyANixeR0V0cZEB9e_xlcjRidPOD8-OrEqDuRaFjpGJSKtcOvWwjQWSCPRk2_99hvFTSfcFA

Request Chain 264

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESEDsTdIgRO0DabIk8px73jWY&google_cver=1&google_push=AXcoOmSe2ubOHonRbnd9D4-MFL_2aWLyRDDED6jWFba8ZcIVnKYOelTM0Ro5-GwVXaskklMWCuQjg36BGx0rfi1DnDRvJt-_u3yFjRw HTTP 302
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSe2ubOHonRbnd9D4-MFL_2aWLyRDDED6jWFba8ZcIVnKYOelTM0Ro5-GwVXaskklMWCuQjg36BGx0rfi1DnDRvJt-_u3yFjRw&google_nid=whaleco_services_llc

293 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request 7bk8rN Show response
reurl.cc/
Redirect Chain

https://web.alipearlhair.com/KDP_KFoK
https://reurl.cc/7bk8rN

16 KB
5 KB

819ms
282ms

Document
text/html

35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 9dec12836d28734d1512f635b6230a60342f4c84548d5ad1d133fd57531dc59b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Sun, 30 Nov 2025 05:32:34 GMT
Server: nginx/1.22.1
Transfer-Encoding: chunked

Redirect headers

cache-control: no-cache
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:33 GMT
location: https://reurl.cc/7bk8rN
server: nginx
strict-transport-security: max-age=31536000

GET
H2 200 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/ 152 KB
24 KB 218ms
68ms Stylesheet
text/css 151.101.1.229
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/bootstrap@4.3.1/dist/css/bootstrap.min.css

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"2606e-bhA1SChFSJj9qA9V897LNH/Z7SE"
age: 2225740
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Sun, 30 Nov 2025 05:32:34 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-etou8220110-FRA, cache-yul1970059-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24389
x-jsd-version: 4.3.1

GET
H/1.1 200
OK style.css
reurl.cc/asset/stylesheets/ 6 KB
2 KB 279ms
278ms Stylesheet
text/css 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/stylesheets/style.css?v=1
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 351966dece7214af3b43d9a94f07c1c936176ad5dd81f0bbe1f6b319b4cd96d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/7bk8rN

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800
Content-Encoding: gzip
ETag: W/"69159a16-16bb"
Connection: keep-alive
Expires: Sun, 07 Dec 2025 05:32:34 GMT
Date: Sun, 30 Nov 2025 05:32:34 GMT
Content-Type: text/css
Last-Modified: Thu, 13 Nov 2025 08:43:02 GMT
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H2 200 ats.js Show response
anymind360.com/js/9479/ 380 KB
114 KB 430ms
223ms Script
application/javascript 151.101.65.55
FASTLY

General

Check archive.org

Download Go to

Full URL

https://anymind360.com/js/9479/ats.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.65.55 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

a7c26694861bbd926c7d903f707b406aa8eaa6a5065a3acb6c8e0028e8eaee6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 1
access-control-expose-headers: Content-Type
content-encoding: gzip
x-goog-hash: crc32c=+l4scw==, md5=RPhira7MebZTO3yL8IH51w==
etag: "44f862adaecc79b6533b7c8bf081f9d7"
age: 24623
x-goog-stored-content-encoding: gzip
expires: Fri, 28 Nov 2025 22:41:39 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-goog-stored-content-length: 115683
x-cache: HIT, HIT
date: Sun, 30 Nov 2025 05:32:34 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 23 Sep 2025 04:37:48 GMT
x-served-by: cache-tyo11968-TYO, cache-yul1970058-YUL
x-cache-hits: 180, 0
x-guploader-uploadid: AOCedOHyP0e1nlH3ywi0jxhqJfG2VfbrKbYnsKqpUbocC9hzEagW_-ndXN4CfuTJJlaEEGpI
strict-transport-security: max-age=31557600
vary: Accept-Encoding
cache-control: max-age=1200
x-goog-storage-class: STANDARD
x-timer: S1764480755.656194,VS0,VE162
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1758602268219650
content-length: 115683
server: UploadServer

GET
H/1.1 200
OK clickforce_anchor.js Show response
reurl.cc/asset/javascripts/common/ 1 KB
907 B 269ms
264ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/clickforce_anchor.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 873b90cdbff7dcb26e9ea34c647a5d15e83daecca768a816619dd38a503c09b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/7bk8rN

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=604800
Content-Encoding: gzip
ETag: W/"687f3443-4bf"
Connection: keep-alive
Expires: Sun, 07 Dec 2025 05:32:35 GMT
Date: Sun, 30 Nov 2025 05:32:35 GMT
Content-Type: application/javascript
Last-Modified: Tue, 22 Jul 2025 06:48:35 GMT
Server: nginx/1.22.1
Vary: Accept-Encoding

GET
H/1.1 200
OK pixel.js Show response
reurl.cc/asset/javascripts/common/ 470 B
792 B 535ms
263ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/pixel.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 6e9ab8ab1d57a0695a66577e348ae4343e1a92f70cb4835a52c4863f11114037

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/7bk8rN

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-1d6"
Connection: keep-alive
Expires: Sun, 07 Dec 2025 05:32:35 GMT
Accept-Ranges: bytes
Content-Length: 470
Date: Sun, 30 Nov 2025 05:32:35 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H/1.1 200
OK ga.js Show response
reurl.cc/asset/javascripts/common/ 566 B
888 B 793ms
256ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/ga.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 3774a7ce325859b32b6b0b01bde2879c75b81131fafe4a584b18b744711bd75d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/7bk8rN

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-236"
Connection: keep-alive
Expires: Sun, 07 Dec 2025 05:32:35 GMT
Accept-Ranges: bytes
Content-Length: 566
Date: Sun, 30 Nov 2025 05:32:35 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 430 KB
145 KB 1249ms
92ms Script
application/javascript 142.250.64.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0ee151ada12b93957bcf5c7247f51a778b859b267c686651564cb17bccc6e45c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 30 Nov 2025 05:32:36 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148268
date: Sun, 30 Nov 2025 05:32:36 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 490 KB
161 KB 1348ms
192ms Script
application/javascript 142.250.64.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

414dce8a0db9728e64e0b5fdcbc98179039f70813b2de2797e3c3594d4583e99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 30 Nov 2025 05:32:36 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164448
date: Sun, 30 Nov 2025 05:32:36 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 init.js Show response
cdn.holmesmind.com/js/ 9 KB
10 KB 264ms
72ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/init.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ab187b70940d331c60646d5731fa8e86d6958ba69dfa241361e39d30d81c2d31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: PKBfBRh_ckEc5dxIcFkl8Hvvqrcpi_Dy
etag: "daceea64521f6f981e4b58edc119028a"
age: 45
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 9646
x-amz-cf-id: C9LcQHNXN82VNETKKfel6VI2guRW_PMhVPofRQWWQIu5H1Mng5KKCw==
date: Sun, 30 Nov 2025 05:31:58 GMT
content-type: application/javascript
last-modified: Fri, 09 May 2025 03:01:34 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 ad-serv.min.js Show response
ad-specs.guoshipartners.com/static/js/ 52 KB
17 KB 9256ms
310ms Script
application/javascript 203.74.220.3
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL

https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

203.74.220.3 New Taipei City, Taiwan, ASN131660 (CHTCDN Data Communication Business Group, TW),

Reverse DNS

203-74-220-3.hinet-ip.hinet.net

Software

HiNetCDN / OneAD

Resource Hash

57e3fef09cab4680c25c4a06c9c1ce195325f5d502d4d75b5d53a7c2f14e2916

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: W/"68c28bcb-cfd3"
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
x-varnish: 24594342
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:43 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Thu, 11 Sep 2025 08:43:55 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 onead-lib.min.js Show response
ad-specs.guoshipartners.com/static/js/ 25 KB
8 KB 9327ms
382ms Script
application/javascript 203.74.220.3
CHTCDN Data Commu...

General

Check archive.org

Download Go to

Full URL

https://ad-specs.guoshipartners.com/static/js/onead-lib.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

203.74.220.3 New Taipei City, Taiwan, ASN131660 (CHTCDN Data Communication Business Group, TW),

Reverse DNS

203-74-220-3.hinet-ip.hinet.net

Software

HiNetCDN / OneAD

Resource Hash

620a382665ff035abb643a19e12f088aef2bc27b55398d4ae3f131b773be6355

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: W/"68c0e8bd-65e4"
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
x-varnish: 130662986
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:43 GMT
content-type: application/javascript
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified: Wed, 10 Sep 2025 02:55:57 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=360
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: *
x-powered-by: OneAD
server: HiNetCDN

GET
H2 200 vue.min.js Show response
cdn.jsdelivr.net/npm/vue@2.5.16/dist/ 84 KB
32 KB 58ms
55ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.5.16/dist/vue.min.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"151b4-KLsckeN7U/TrtIzkgtzLJAAD4Hg"
age: 1462888
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230088-FRA, cache-yul1970059-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 32610
x-jsd-version: 2.5.16

GET
H/1.1 200
OK renews.js Show response
reurl.cc/asset/javascripts/common/ 690 B
1012 B 1055ms
262ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/common/renews.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 100d72a28123bcee974e8642b8bf1c0865bf1034c9b59f59597d53809e192fdc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/7bk8rN

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-2b2"
Connection: keep-alive
Expires: Sun, 07 Dec 2025 05:32:35 GMT
Accept-Ranges: bytes
Content-Length: 690
Date: Sun, 30 Nov 2025 05:32:35 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H/1.1 200
OK loading.js Show response
reurl.cc/asset/javascripts/redirect/ 240 B
561 B 1323ms
260ms Script
application/javascript 35.229.143.32
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://reurl.cc/asset/javascripts/redirect/loading.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 35.229.143.32 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 32.143.229.35.bc.googleusercontent.com
Software: nginx/1.22.1 /
Resource Hash: 25355805f44af99037c6b951f9afd762f5fd74eb126aba4b2f82cafa563c0f90

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/7bk8rN

Response headers

Cache-Control: max-age=604800
ETag: "680babe3-f0"
Connection: keep-alive
Expires: Sun, 07 Dec 2025 05:32:36 GMT
Accept-Ranges: bytes
Content-Length: 240
Date: Sun, 30 Nov 2025 05:32:36 GMT
Content-Type: application/javascript
Last-Modified: Fri, 25 Apr 2025 15:36:03 GMT
Server: nginx/1.22.1

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 105 KB
34 KB 268ms
102ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: anymind360.com
URL: https://anymind360.com/js/9479/ats.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

72c0aa484ed554c7f385deb14edc6fa6afe7eedf0d04d3235a3dff61cf408f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 931 / 20422 / m202511120101 / config-hash: 14247479607061606112
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 05:32:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34313
x-xss-protection: 0
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 422 KB
143 KB 1232ms
78ms Script
application/javascript 142.250.64.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5618883e3468f8daa896fc9604056aaf627d804aa06b8e7ff9417b4ec2ecf82e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 30 Nov 2025 05:32:36 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146320
date: Sun, 30 Nov 2025 05:32:36 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 4D45 12 KB
12 KB 193ms
63ms Document
text/html 18.173.132.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-10.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 52
content-length: 12184
content-type: text/html
date: Sun, 30 Nov 2025 05:31:58 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
x-amz-cf-id: 1qJmdy4EAnFtOJehZCYzJgB23LZGfPLBTJ7ELnzUaYhhFw_LFRIEdw==
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame B2DA 11 KB
11 KB 70ms
69ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 17
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: 64g6RCsaAxNSrLibuDp-MBzI6APG7na50DMd6SvUIfY4gfWr1jw2cw==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 31CE 11 KB
0 60ms
60ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 17
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: 64g6RCsaAxNSrLibuDp-MBzI6APG7na50DMd6SvUIfY4gfWr1jw2cw==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame DA54 11 KB
0 52ms
52ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 17
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: 64g6RCsaAxNSrLibuDp-MBzI6APG7na50DMd6SvUIfY4gfWr1jw2cw==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 8122 11 KB
0 40ms
40ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 17
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: 64g6RCsaAxNSrLibuDp-MBzI6APG7na50DMd6SvUIfY4gfWr1jw2cw==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame 012C 11 KB
0 24ms
24ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 17
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: 64g6RCsaAxNSrLibuDp-MBzI6APG7na50DMd6SvUIfY4gfWr1jw2cw==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 presetfn.js Show response
cdn.holmesmind.com/js/ Frame D9D0 11 KB
0 14ms
14ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: rmz9OdLbHPf__eUT0CPixnVBdq1QxTyB
etag: "1ff97ce94c5a1127f915e6bf2a02c6a9"
age: 17
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 10957
x-amz-cf-id: 64g6RCsaAxNSrLibuDp-MBzI6APG7na50DMd6SvUIfY4gfWr1jw2cw==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Thu, 16 Jan 2025 06:05:08 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame C651 12 KB
0 110ms
110ms Document
text/html 18.173.132.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-10.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 52
content-length: 12184
content-type: text/html
date: Sun, 30 Nov 2025 05:31:58 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
x-amz-cf-id: 1qJmdy4EAnFtOJehZCYzJgB23LZGfPLBTJ7ELnzUaYhhFw_LFRIEdw==
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame AE7E 12 KB
0 112ms
112ms Document
text/html 18.173.132.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-10.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 52
content-length: 12184
content-type: text/html
date: Sun, 30 Nov 2025 05:31:58 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
x-amz-cf-id: 1qJmdy4EAnFtOJehZCYzJgB23LZGfPLBTJ7ELnzUaYhhFw_LFRIEdw==
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame 54C6 12 KB
0 117ms
116ms Document
text/html 18.173.132.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-10.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 52
content-length: 12184
content-type: text/html
date: Sun, 30 Nov 2025 05:31:58 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
x-amz-cf-id: 1qJmdy4EAnFtOJehZCYzJgB23LZGfPLBTJ7ELnzUaYhhFw_LFRIEdw==
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 capmapping.htm Show response
cdn.holmesmind.com/js/ Frame CFEB 12 KB
0 118ms
118ms Document
text/html 18.173.132.10
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/capmapping.htm
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-10.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 52
content-length: 12184
content-type: text/html
date: Sun, 30 Nov 2025 05:31:58 GMT
etag: "313c12f57383ae26248323c3b33af799"
last-modified: Mon, 17 Mar 2025 05:33:47 GMT
server: AmazonS3
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
x-amz-cf-id: 1qJmdy4EAnFtOJehZCYzJgB23LZGfPLBTJ7ELnzUaYhhFw_LFRIEdw==
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256
x-amz-version-id: rSOjRFL3ruqyCRzzCV6Gk2MSJ9yPXZwf
x-cache: Hit from cloudfront

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame B2DA 2 KB
635 B 689ms
219ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13858
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5dc19081cdce4b73414b31adbb769fb102317dc1b313d001fa29575e703057ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame B2DA 30 KB
30 KB 72ms
69ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 16
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: LmYBxPMJM9zW9lFZAZnOCreHhkcsyc6p0O1X0NzEViG31OCrselPvA==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 31CE 2 KB
854 B 879ms
417ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=14210
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 00a7ef012629016b7f2394532363ae619fe50c67b2b02f2e6f3d041f41abaf9f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 31CE 30 KB
0 65ms
64ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 16
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: LmYBxPMJM9zW9lFZAZnOCreHhkcsyc6p0O1X0NzEViG31OCrselPvA==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame DA54 2 KB
635 B 676ms
221ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13860
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5dc19081cdce4b73414b31adbb769fb102317dc1b313d001fa29575e703057ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame DA54 30 KB
0 60ms
60ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 16
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: LmYBxPMJM9zW9lFZAZnOCreHhkcsyc6p0O1X0NzEViG31OCrselPvA==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 012C 820 B
508 B 524ms
216ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=18535
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ca85f617678aa83dca8799aafc5569c3f6b99149e03ac742644b21436151c074

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 012C 30 KB
0 59ms
59ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 16
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: LmYBxPMJM9zW9lFZAZnOCreHhkcsyc6p0O1X0NzEViG31OCrselPvA==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame 8122 1 KB
610 B 270ms
221ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=13861
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b370b8d683152966f79b803de60d576023a93a975436e766409283f7de7b6d34

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame 8122 30 KB
0 62ms
62ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 16
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: LmYBxPMJM9zW9lFZAZnOCreHhkcsyc6p0O1X0NzEViG31OCrselPvA==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 Preset.js Show response
ad.holmesmind.com/adserver/ Frame D9D0 820 B
507 B 224ms
210ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/Preset.js?z=22213
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ca85f617678aa83dca8799aafc5569c3f6b99149e03ac742644b21436151c074

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 js-md5.js Show response
cdn.holmesmind.com/js/ Frame D9D0 30 KB
0 59ms
59ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/js-md5.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: GJjk5mkGsSOM8o1hDQLuy7m.Hsc3NZ3.
etag: "ab3f6a2aedec7585237d5fb727bebcbb"
age: 16
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 30621
x-amz-cf-id: LmYBxPMJM9zW9lFZAZnOCreHhkcsyc6p0O1X0NzEViG31OCrselPvA==
date: Sun, 30 Nov 2025 05:32:24 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:04:56 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/ 608 KB
192 KB 70ms
69ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 6518253978845184816
age: 1377
x-content-type-options: nosniff
expires: Mon, 30 Nov 2026 05:09:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:09:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 196693
x-xss-protection: 0
server: cafe

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 4D45 42 KB
17 KB 356ms
55ms Script
application/javascript 18.238.55.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-90.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b638cc2de9f4bf30cd980830ebfba0b586d5ce5da10903f126d0dd4350e5aea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 27
via: 1.1 c079338af747d912717239089fea0484.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D1yQrsk5QViUVStGvtClRGq0rniCtYukDPCiM_keQrXU6aSUo61tFg==
date: Sun, 30 Nov 2025 05:32:12 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P4
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame C651 42 KB
0 347ms
347ms Script
application/javascript 18.238.55.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-90.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b638cc2de9f4bf30cd980830ebfba0b586d5ce5da10903f126d0dd4350e5aea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 27
via: 1.1 c079338af747d912717239089fea0484.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D1yQrsk5QViUVStGvtClRGq0rniCtYukDPCiM_keQrXU6aSUo61tFg==
date: Sun, 30 Nov 2025 05:32:12 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P4
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame AE7E 42 KB
0 343ms
342ms Script
application/javascript 18.238.55.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-90.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b638cc2de9f4bf30cd980830ebfba0b586d5ce5da10903f126d0dd4350e5aea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 27
via: 1.1 c079338af747d912717239089fea0484.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D1yQrsk5QViUVStGvtClRGq0rniCtYukDPCiM_keQrXU6aSUo61tFg==
date: Sun, 30 Nov 2025 05:32:12 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P4
x-amz-server-side-encryption: AES256

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame 54C6 42 KB
0 336ms
336ms Script
application/javascript 18.238.55.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-90.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b638cc2de9f4bf30cd980830ebfba0b586d5ce5da10903f126d0dd4350e5aea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 27
via: 1.1 c079338af747d912717239089fea0484.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D1yQrsk5QViUVStGvtClRGq0rniCtYukDPCiM_keQrXU6aSUo61tFg==
date: Sun, 30 Nov 2025 05:32:12 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P4
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 4D45 35 B
470 B 1610ms
286ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Content-Length: 35
P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Date: Sun, 30 Nov 2025 05:32:36 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Connection: keep-alive
Server: TornadoServer/1.2.1

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame F2DB 0
218 B 1953ms
218ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:37 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 cm.php Show response
fcm.holmesmind.com/ Frame 1E04 39 B
192 B 3438ms
3073ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:38 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 4D45 409 B
633 B 722ms
204ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 4D45 5 KB
3 KB 4621ms
571ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:40 GMT
date: Sun, 30 Nov 2025 05:32:40 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 4D45 0
219 B 1975ms
220ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

cm
c.holmesmind.com/ Frame 4D45
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
500 B

83ms
78ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 4D45
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

0
456 B

664ms
223ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Sun, 30 Nov 2025 06:32:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOGLeJW6Lh_GZ6-sZymlvvDFcj2Lknywko2iarhHa5hj-vmrHRehuwoN492MHsftnITG
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Sun, 30 Nov 2025 05:32:51 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 nineyi.tracking.client.iife.js Show response
tracking-client.91app.com/1.2.0/ Frame CFEB 42 KB
0 321ms
321ms Script
application/javascript 18.238.55.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.55.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-90.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b638cc2de9f4bf30cd980830ebfba0b586d5ce5da10903f126d0dd4350e5aea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

vary: accept-encoding
cache-control: max-age=no-cache
content-encoding: br
etag: W/"3087e8bcd78cce0b2b4e3454c1fcd923"
age: 27
via: 1.1 c079338af747d912717239089fea0484.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: D1yQrsk5QViUVStGvtClRGq0rniCtYukDPCiM_keQrXU6aSUo61tFg==
date: Sun, 30 Nov 2025 05:32:12 GMT
content-type: application/javascript
last-modified: Mon, 20 Jan 2025 10:42:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P4
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK /
cm.lndata.com/ Frame C651 35 B
394 B 1850ms
253ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Sun, 30 Nov 2025 05:32:37 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame C651 0
218 B 2188ms
220ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame C651
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
17 B

176ms
78ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 7550 0
218 B 2164ms
219ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:37 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H2 502 cm.php Show response
fcm.holmesmind.com/ Frame B7D7 332 B
418 B 9493ms
6062ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: /
Resource Hash: 8128514a9917b6dcdf20f7ee24d6b00a27b2a6aa0f971acb988f358f25ac4005

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:45 GMT
referrer-policy: no-referrer

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame C651 409 B
632 B 910ms
201ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame C651
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

0
0

602ms
602ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Sun, 30 Nov 2025 06:32:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOGLeJW6Lh_GZ6-sZymlvvDFcj2Lknywko2iarhHa5hj-vmrHRehuwoN492MHsftnITG
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Sun, 30 Nov 2025 05:32:51 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame AE7E 35 B
394 B 2124ms
280ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Sun, 30 Nov 2025 05:32:37 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame AE7E 0
218 B 2403ms
219ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame AE7E
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
17 B

372ms
79ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:57 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 8B68 0
218 B 2378ms
214ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:37 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 cm.php Show response
fcm.holmesmind.com/ Frame 341B 39 B
52 B 12592ms
3101ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:48 GMT
server: Apache/2.4.29 (Ubuntu)
via: 1.1 google

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame AE7E 409 B
632 B 1132ms
212ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame AE7E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

0
0

534ms
534ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Sun, 30 Nov 2025 06:32:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOGLeJW6Lh_GZ6-sZymlvvDFcj2Lknywko2iarhHa5hj-vmrHRehuwoN492MHsftnITG
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Sun, 30 Nov 2025 05:32:51 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame 54C6 35 B
394 B 2377ms
256ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Sun, 30 Nov 2025 05:32:37 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame 54C6 0
218 B 2618ms
215ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame 54C6
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
17 B

287ms
99ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:57 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 0CA1 0
218 B 2593ms
212ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:38 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 502 cm.php Show response
fcm.holmesmind.com/ Frame E4B1 332 B
347 B 18667ms
6082ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: /
Resource Hash: 8128514a9917b6dcdf20f7ee24d6b00a27b2a6aa0f971acb988f358f25ac4005

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:54 GMT
referrer-policy: no-referrer

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame 54C6 409 B
632 B 1341ms
209ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame 54C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

0
0

449ms
449ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Sun, 30 Nov 2025 06:32:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOGLeJW6Lh_GZ6-sZymlvvDFcj2Lknywko2iarhHa5hj-vmrHRehuwoN492MHsftnITG
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Sun, 30 Nov 2025 05:32:51 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK /
cm.lndata.com/ Frame CFEB 35 B
394 B 2634ms
258ms Image
image/gif 116.50.36.71
DONGFONG-TW DongF...

General

Check archive.org

Download Go to Show image

Full URL: https://cm.lndata.com/?tid=4084&uid=media_cookie_id
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 116.50.36.71 , Taiwan, ASN18046 (DONGFONG-TW DongFong Technology Co. Ltd., TW),
Reverse DNS: 116-50-36-71.dft.tw
Software: TornadoServer/1.2.1 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

P3P: CP=CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR
Content-Length: 35
Date: Sun, 30 Nov 2025 05:32:38 GMT
Etag: "0f4e929dd5bb2564f7ab9c76338e04e292a42ace"
Content-Type: image/gif
Server: TornadoServer/1.2.1

GET
H2 200 fp
cm-dev-poc.holmesmind.com/ Frame CFEB 0
218 B 2842ms
225ms Image
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.18.0 (Ubuntu)

GET
H3

200

cm
c.holmesmind.com/ Frame CFEB
Redirect Chain

https://c.holmesmind.com/cm
https://c.holmesmind.com/cm?tc=getIn&

0
17 B

452ms
76ms

Image
text/html

35.201.76.93
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://c.holmesmind.com/cm?tc=getIn&
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Server: 35.201.76.93 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 93.76.201.35.bc.googleusercontent.com
Software: nginx/1.10.3 (Ubuntu) / PHP/7.0.18-0ubuntu0.17.04.1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:57 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

Redirect headers

location: https://c.holmesmind.com/cm?tc=getIn&
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:56 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/7.0.18-0ubuntu0.17.04.1
server: nginx/1.10.3 (Ubuntu)

GET
H2 200 fp Show response
cm-dev-poc.holmesmind.com/ Frame 28D4 0
218 B 2822ms
224ms Document
text/html 3.114.255.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cm-dev-poc.holmesmind.com/fp
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.114.255.95 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-114-255-95.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:32:38 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 502 cm.php Show response
fcm.holmesmind.com/ Frame AE20 332 B
347 B 24758ms
6095ms Document
text/html 34.95.67.231
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://fcm.holmesmind.com/cm.php
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.67.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 231.67.95.34.bc.googleusercontent.com
Software: /
Resource Hash: 8128514a9917b6dcdf20f7ee24d6b00a27b2a6aa0f971acb988f358f25ac4005

Request headers

Referer: https://cdn.holmesmind.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 332
content-type: text/html; charset=UTF-8
date: Sun, 30 Nov 2025 05:33:00 GMT
referrer-policy: no-referrer

GET
H2 200 cm.js Show response
fcm2.holmesmind.com/ Frame CFEB 409 B
632 B 1555ms
218ms Script
application/javascript 54.238.82.241
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fcm2.holmesmind.com/cm.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.238.82.241 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-238-82-241.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: application/javascript; charset=utf-8
server: nginx/1.18.0 (Ubuntu)

GET
H2

200

google
m.holmesmind.com/ml/ Frame CFEB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm&cf_uid=undefined&uu_m=undefined
https://cm.g.doubleclick.net/pixel?google_nid=clickforce_dmp&google_cm=&cf_uid=undefined&uu_m=undefined&google_tc=
https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1

0
0

367ms
367ms

Image
image/png

35.227.249.156
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm
Protocol: H2
Server: 35.227.249.156 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 156.249.227.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=AAAAAA==, md5=1B2M2Y8AsgTpgAmY7PhCfg==
etag: "d41d8cd98f00b204e9800998ecf8427e"
x-goog-stored-content-encoding: identity
expires: Sun, 30 Nov 2025 06:32:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 0
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: image/png
last-modified: Wed, 21 Feb 2018 07:36:41 GMT
x-guploader-uploadid: AOCedOGLeJW6Lh_GZ6-sZymlvvDFcj2Lknywko2iarhHa5hj-vmrHRehuwoN492MHsftnITG
cache-control: public, max-age=3600
x-goog-storage-class: REGIONAL
accept-ranges: bytes
x-goog-generation: 1519198601160228
content-length: 0
server: UploadServer

Redirect headers

cache-control: no-cache, must-revalidate
location: https://m.holmesmind.com/ml/google?cf_uid=undefined&uu_m=undefined&google_gid=CAESEA9omryIfvoENsr4ExuyATc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 328
date: Sun, 30 Nov 2025 05:32:51 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 325 KB
84 KB 121ms
56ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/pixel.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-aCObTBy9' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-aCObTBy9' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4965, tp=9, tpl=0, uplat=1, ullat=-1
pragma: public
x-fb-debug: ChuGAZr8YX+CjQfcOVDiZRbgcSv8FylE6k9XLYJu0f9EYJrszINikUvvgJ4qSCQUiVv5MmfodCinXBFL/9Hp1Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/ 64 KB
23 KB 67ms
64ms Other
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17914686685964197562
age: 1776
x-content-type-options: nosniff
expires: Sun, 07 Dec 2025 05:02:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:02:59 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23115
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202511110101"

GET
H2 200 128002626 Show response
fundingchoicesmessages.google.com/i/ 214 KB
69 KB 15949ms
142ms Script
application/javascript 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/128002626?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

88bbcb7b270d247e3df12b221bfe724c3f82b50faac44496fda002026121694f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-uakArkxuiTnwiEO-NjL6mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:51 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJicNaQYmi9eY51OhB3LTrPOgeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWJ_SZrCRCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwcJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRAPR_O69SfZBDo2Tb3ArKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRqaGhooWdgGl9gAAC7g0dG"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-uakArkxuiTnwiEO-NjL6mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 1335ms
135ms Script
text/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/ga.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
age: 3399
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 06:35:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 04:35:58 GMT
last-modified: Tue, 15 Jul 2025 00:44:26 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20737
server: Golfe2

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 012C 3 KB
1 KB 249ms
245ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=218&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fe9e76db635452c2538363c0891c91976d44c183947c365b19bd053c6fc01490

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame DA54 0
202 B 228ms
227ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13860&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=641&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 8122 2 KB
1 KB 228ms
227ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13861&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=393&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1b3784d7c83388d37f8b129a71e16ba4e4ea1c5b81a72aaaa90e1357ad7fa4e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame B2DA 1 KB
852 B 226ms
225ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=13858&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=350&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5d22fcaeba7c8a239fb38bd4458dd20b275b1251463be32cc6dbc741fece3dc3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 4D45 325 KB
84 KB 124ms
68ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-mMcV35LQ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-mMcV35LQ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: DohHBtcIz7szM/3rUGcgELr1EtTBs82GTPPPeEAjvLrsTX+ENWp/Bak3AxUiGOycgarhxSK4uiUOobImFZBYCw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame 31CE 4 KB
1 KB 240ms
235ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=66&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 03ea453e540e7075dbd901d5e2b48b9e1a57d2ad6e65f06c553ba4e020531417

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 rtbhouseV2.js Show response
cdn.holmesmind.com/js/ Frame 31CE 3 KB
3 KB 70ms
65ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: BhYfibf8ln9C4F8AF59WvZqelYblDtF0
etag: "519bf06eca29382b4ee4cc4f1dace214"
age: 55
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2905
x-amz-cf-id: A6hJcji7VkwMKMj33okafEPFYSqCa4TsW2MlVqN_qYsPT3vlQ4r75w==
date: Sun, 30 Nov 2025 05:31:47 GMT
content-type: application/javascript
last-modified: Mon, 04 Sep 2023 03:28:50 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 publishertag.js Show response
static.criteo.net/js/ld/ Frame 31CE 128 KB
46 KB 1290ms
86ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

26d3d203e8d69454f28e5a533b1655d0d9c72b3c65ac2d3b2992fba82ae2f96c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: public, max-age=86400
timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
expires: Mon, 01 Dec 2025 05:32:37 GMT
access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/javascript
vary: x-geo-country, Accept-Encoding
server: Kestrel

GET
H2 200 criteoV2.js Show response
cdn.holmesmind.com/js/ Frame 31CE 3 KB
4 KB 72ms
67ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/criteoV2.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ScZOn53LDZH9EqQBQtTybn_n.yFFnixh
etag: "13519f9e63c9828d93a698c47992e115"
age: 55
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3197
x-amz-cf-id: rYczFjSnXXT6Z63x8ph1AKWUEiwwvG03v7WaF7-u8CyurtjgXPNzHg==
date: Sun, 30 Nov 2025 05:32:16 GMT
content-type: application/javascript
last-modified: Thu, 27 Jul 2023 02:29:01 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 bridgewellV3.js Show response
cdn.holmesmind.com/js/ Frame 31CE 3 KB
4 KB 68ms
64ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: DID93KRiG7PHJMF22E9BP3B26tce7ZQK
etag: "41ecd67a1e57b2a3aa7cf0c876da0a59"
age: 55
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 3470
x-amz-cf-id: ctppfDrmaEMUcYGKg1EJ7owJhYLZOYqSWFtL7-jNP4013RCmgSN-kw==
date: Sun, 30 Nov 2025 05:31:46 GMT
content-type: application/javascript
last-modified: Mon, 02 Oct 2023 08:50:04 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 appier_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 31CE 5 KB
6 KB 69ms
66ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/appier_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: ku3H1MOUSfLuWtW9r59UrEXWrMCJMqc1
etag: "ec9ddd169f5fd01f28f9b31866cd4701"
age: 55
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 5467
x-amz-cf-id: oXsDGrvzZZAY3laKatyAQDSecn6r-CJ-AqDlnrZLYInMDTYWK5grBQ==
date: Sun, 30 Nov 2025 05:31:47 GMT
content-type: application/javascript
last-modified: Tue, 14 Nov 2023 14:15:25 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 teads_mainV3.js Show response
cdn.holmesmind.com/js/ Frame 31CE 46 KB
46 KB 70ms
66ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/teads_mainV3.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6d4c444108925dc2ec8fe761f55a6760241c123740591e1348f0f94a653a3985

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 0GyqAf7LKhNiqEjX8VRsAWlYH_I2gXHI
etag: "a7e4fcfdedcaf972df92c41e4c9dc6b0"
age: 50
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 46892
x-amz-cf-id: J7sQ0LLvELkNauMwNhvzxEYa1kUHRJbXUv5VEAr1yWgSqWv4-8Sw4w==
date: Sun, 30 Nov 2025 05:32:16 GMT
content-type: application/javascript
last-modified: Thu, 16 May 2024 06:07:06 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 ucfunnel.js Show response
cdn.holmesmind.com/js/ Frame 31CE 2 KB
3 KB 70ms
67ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/ucfunnel.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 7FnOHKe__pwg0dVwIyTfAcdImUIZ6pwv
etag: "8ebabc4e0b1d40fe52514166c7db7048"
age: 45
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2166
x-amz-cf-id: T9nVsDA4LXjvxgqc0zYH-jel0poefX-8EUMPxEgR4a0gBb0Pr1Zqkg==
date: Sun, 30 Nov 2025 05:32:16 GMT
content-type: application/javascript
last-modified: Fri, 21 Jul 2023 03:54:43 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 012C 5 KB
3 KB 835ms
282ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/utag.js

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:36 GMT
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame DA54 5 KB
0 839ms
839ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:36 GMT
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 8122 5 KB
0 835ms
835ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:36 GMT
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame B2DA 5 KB
0 795ms
795ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:36 GMT
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 1675200226052423 Show response
connect.facebook.net/signals/config/ 100 KB
25 KB 84ms
82ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1675200226052423?v=2.9.243&r=stable&domain=reurl.cc&hme=fdfab1132115f4ac7aabc9fd7eee63947594f6e6f1735b47a225dd71217525d3&ex_m=89%2C147%2C127%2C18%2C65%2C66%2C120%2C61%2C41%2C121%2C70%2C60%2C134%2C78%2C13%2C88%2C26%2C115%2C108%2C68%2C71%2C114%2C131%2C97%2C136%2C7%2C3%2C4%2C6%2C5%2C2%2C79%2C87%2C137%2C214%2C158%2C55%2C216%2C217%2C48%2C173%2C25%2C67%2C222%2C221%2C161%2C28%2C54%2C8%2C57%2C83%2C84%2C85%2C90%2C111%2C27%2C24%2C113%2C110%2C109%2C128%2C69%2C130%2C129%2C43%2C53%2C105%2C12%2C133%2C38%2C203%2C205%2C168%2C21%2C22%2C23%2C15%2C16%2C37%2C33%2C35%2C34%2C74%2C80%2C82%2C95%2C119%2C122%2C39%2C96%2C19%2C17%2C101%2C62%2C31%2C124%2C123%2C125%2C116%2C20%2C30%2C52%2C94%2C132%2C63%2C14%2C126%2C29%2C183%2C154%2C275%2C201%2C145%2C186%2C179%2C155%2C92%2C112%2C73%2C103%2C47%2C40%2C102%2C107%2C51%2C58%2C42%2C98%2C46%2C49%2C45%2C86%2C135%2C0%2C106%2C11%2C104%2C9%2C1%2C50%2C81%2C56%2C59%2C100%2C77%2C76%2C44%2C117%2C75%2C72%2C64%2C99%2C91%2C36%2C118%2C32%2C93%2C10%2C138

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

40eaab61bd7f8b876f54d3cf16fda515c06a2b41544bd9ebf7fb7b6b75938558

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-7mBSeNEP' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-7mBSeNEP' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=88, mss=1232, tbw=96395, tp=87, tpl=0, uplat=4, ullat=-1
pragma: public
x-fb-debug: 0B3cn6JKBdHcB410NXsLzW9+4WyApOOamkFhhbKaTngPpLo6MTHrY0A+lTimfP07aenWdPeMAl4ffCmEluIE9Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 25503
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 ads.js Show response
ad.holmesmind.com/adserver/ Frame D9D0 0
202 B 249ms
248ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/ads.js?z=22213&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=708&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-allow-origin: https://reurl.cc
content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx
access-control-allow-credentials: true

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame B2DA 13 KB
13 KB 74ms
74ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13858&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=350&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 13
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: LsgNm-xB7qiIu0c8xE3y63PM0AtrZxUk3B8WE7eSex7mhMhtTqtRgw==
date: Sun, 30 Nov 2025 05:32:25 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 8122 13 KB
0 77ms
77ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=13861&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=393&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 13
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: LsgNm-xB7qiIu0c8xE3y63PM0AtrZxUk3B8WE7eSex7mhMhtTqtRgw==
date: Sun, 30 Nov 2025 05:32:25 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 012C 13 KB
0 78ms
78ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=218&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 13
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: LsgNm-xB7qiIu0c8xE3y63PM0AtrZxUk3B8WE7eSex7mhMhtTqtRgw==
date: Sun, 30 Nov 2025 05:32:25 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 f.js Show response
cdn.holmesmind.com/js/ Frame 012C 12 KB
12 KB 72ms
69ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/f.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=18535&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=218&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f8bcd058a4fbee6f8b68a5ff2930470c1890fc714914c226cf950b4e11ffdcdb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: I0L11em9y2rEWUbgZZxQXYLhoIMX8Pv6
etag: "1d98c42a6ebd67d5137147fbb5ad912f"
age: 13
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 12254
x-amz-cf-id: _bOifReotmzOVpUr28jAk5OoK0QGdK5NrSYMYLWm_Na9Tfao36idGw==
date: Sun, 30 Nov 2025 05:32:25 GMT
content-type: application/javascript
last-modified: Fri, 14 Jun 2024 08:45:07 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

POST
H2 204 bids Show response
prebid-asia.creativecdn.com/bidder/prebid/ Frame 31CE 0
171 B 8737ms
530ms XHR
text/plain 103.132.192.30
RTBHOUSE-AS-AP RT...

General

Check archive.org

Download Go to

Full URL: https://prebid-asia.creativecdn.com/bidder/prebid/bids
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/rtbhouseV2.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 103.132.192.30 , Singapore, ASN138552 (RTBHOUSE-AS-AP RTB HOUSE PTE. LTD., SG),
Reverse DNS: ip-103-132-192-30.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

access-control-max-age: 3600
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:45 GMT
vary: Origin
access-control-allow-credentials: true
access-control-allow-methods: POST

POST
H/1.1 204
No Content prebid.aspx Show response
prebid.scupio.com/recweb/ Frame 31CE 0
168 B 1123ms
259ms XHR
text/plain 210.59.219.34
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://prebid.scupio.com/recweb/prebid.aspx?cb=0.47338020567777206
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/bridgewellV3.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 210.59.219.34 Taichung, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 210-59-219-34.hinet-ip.hinet.net
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

Access-Control-Allow-Origin: https://reurl.cc
Date: Sun, 30 Nov 2025 05:32:37 GMT
Server: Kestrel
Access-Control-Allow-Credentials: true

POST

apnet
gocm.c.appier.net/ Frame 31CE
Redirect Chain

https://ad2.apx.appier.net/v1/prebid/bid
https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid

0
0

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame C651 325 KB
0 12ms
12ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-mMcV35LQ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-mMcV35LQ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: DohHBtcIz7szM/3rUGcgELr1EtTBs82GTPPPeEAjvLrsTX+ENWp/Bak3AxUiGOycgarhxSK4uiUOobImFZBYCw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame 31CE 5 KB
0 540ms
540ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:36 GMT
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H2 200 close_btn.png
cdn.holmesmind.com/image/creative/20200629/ 23 KB
23 KB 69ms
69ms Image
image/png 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/image/creative/20200629/close_btn.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0e83a8ffdd161a80e179732ca1f514ee08dcc3c4a128baa9c92bcffebc2a7c52

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: eftIHNkZLvs_zrsThuw3iZTYVcb2Z_86
etag: "e08deb6b87983b314d88a24c09f4d13f"
age: 82972
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 23254
x-amz-cf-id: niDJQvcTvwuw6PoXK8yeDbY0OGabah-CP6L6rvJN04-bTcKny9O-vA==
date: Sat, 29 Nov 2025 06:29:45 GMT
content-type: image/png
last-modified: Thu, 15 Jun 2023 01:01:51 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H3 200 /
www.facebook.com/privacy_sandbox/topics/registration/ 67 B
0 221ms
128ms Fetch
image/png 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/privacy_sandbox/topics/registration/?id=1675200226052423

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/signals/config/1675200226052423?v=2.9.243&r=stable&domain=reurl.cc&hme=fdfab1132115f4ac7aabc9fd7eee63947594f6e6f1735b47a225dd71217525d3&ex_m=89%2C147%2C127%2C18%2C65%2C66%2C120%2C61%2C41%2C121%2C70%2C60%2C134%2C78%2C13%2C88%2C26%2C115%2C108%2C68%2C71%2C114%2C131%2C97%2C136%2C7%2C3%2C4%2C6%2C5%2C2%2C79%2C87%2C137%2C214%2C158%2C55%2C216%2C217%2C48%2C173%2C25%2C67%2C222%2C221%2C161%2C28%2C54%2C8%2C57%2C83%2C84%2C85%2C90%2C111%2C27%2C24%2C113%2C110%2C109%2C128%2C69%2C130%2C129%2C43%2C53%2C105%2C12%2C133%2C38%2C203%2C205%2C168%2C21%2C22%2C23%2C15%2C16%2C37%2C33%2C35%2C34%2C74%2C80%2C82%2C95%2C119%2C122%2C39%2C96%2C19%2C17%2C101%2C62%2C31%2C124%2C123%2C125%2C116%2C20%2C30%2C52%2C94%2C132%2C63%2C14%2C126%2C29%2C183%2C154%2C275%2C201%2C145%2C186%2C179%2C155%2C92%2C112%2C73%2C103%2C47%2C40%2C102%2C107%2C51%2C58%2C42%2C98%2C46%2C49%2C45%2C86%2C135%2C0%2C106%2C11%2C104%2C9%2C1%2C50%2C81%2C56%2C59%2C100%2C77%2C76%2C44%2C117%2C75%2C72%2C64%2C99%2C91%2C36%2C118%2C32%2C93%2C10%2C138

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-7EjsMNYW' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7578387143335847510&cpp=C3&cv=1030435471&st=1764480756676"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
observe-browsing-topics: ?1
expires: Sat, 01 Jan 2000 00:00:00 GMT
access-control-allow-methods: OPTIONS
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: image/png
vary: Origin, Accept-Encoding
x-fb-debug: T5e/YRf0ppQ+QWIOagpjICPkGmwFPLOlACjdmUnneAEg6sW1ielWmjG0xeZniEzDqDuoWy1Eu3fxP4ODLXZuPQ==
priority: u=1,i
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7578387143335847510&cpp=C3&cv=1030435471&st=1764480756676", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-7EjsMNYW' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=72, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=36, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: same-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 /
www.facebook.com/tr/ 0
19 B 162ms
86ms Image
text/plain 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&rl=&if=false&ts=1764480756523&sw=1600&sh=1200&v=2.9.243&r=stable&ec=0&o=4124&fbp=fb.1.1764480756518.716817845210233222&cs_est=true&ler=empty&cdl=API_unavailable&it=1764480756353&coo=false&expv2[0]=pl0&expv2[1]=el2&expv2[2]=bc1&expv2[3]=mr0&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=71, rtx=0, c=23, mss=1232, tbw=5014, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
197 B 256ms
196ms Image
image/png 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&rl=&if=false&ts=1764480756523&sw=1600&sh=1200&v=2.9.243&r=stable&ec=0&o=4124&fbp=fb.1.1764480756518.716817845210233222&cs_est=true&ler=empty&cdl=API_unavailable&it=1764480756353&coo=false&expv2[0]=pl0&expv2[1]=el2&expv2[2]=bc1&expv2[3]=mr0&rqm=FGET

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-6lYjBIJD' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7578387142271187594&cpp=C3&cv=1030435471&st=1764480756700"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: evkc5ICIjWiJBx0+wnGrUikxvEtUb93H9VieXdjaHJhTWG4LJsOlrLWieWGzeSDIbHDynYcEOVgHd3A4NHGusA==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7578387142271187594&cpp=C3&cv=1030435471&st=1764480756700", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-6lYjBIJD' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=73, rtx=0, c=24, mss=1232, tbw=5382, tp=13, tpl=0, uplat=117, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
cross-origin-opener-policy-report-only: restrict-properties;report-to="coop_report"
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 drawV2.js Show response
cdn.holmesmind.com/js/ Frame 31CE 13 KB
0 78ms
78ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/js/drawV2.js
Requested by: Host: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/ads.js?z=14210&rf=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&n=66&o=4&fc=undefined&d=1&b=2&ts=1&ii=3&FPCK=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&fp_uuid=4227-b0ca5392653471f39ae4271cc53733de&initver=230627P
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: MSt.illVoQb3pO8IADvHgNboFaeniBxV
etag: "dcf480340ca4b65dc9aa76bd9e677036"
age: 13
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 13033
x-amz-cf-id: LsgNm-xB7qiIu0c8xE3y63PM0AtrZxUk3B8WE7eSex7mhMhtTqtRgw==
date: Sun, 30 Nov 2025 05:32:25 GMT
content-type: application/javascript
last-modified: Tue, 19 Dec 2023 06:01:02 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 430 KB
145 KB 116ms
86ms Script
application/javascript 142.250.64.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1&cx=c&gtm=4e5bi1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e84a7bc53b8aab520d59e605a9c0d50617c03029688e099ece2422aa00ff2b47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 30 Nov 2025 05:32:36 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 148289
date: Sun, 30 Nov 2025 05:32:36 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 490 KB
161 KB 200ms
172ms Script
application/javascript 142.250.64.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0&cx=c&gtm=4e5bi1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9d35f3cb72814df4a7a25ad51fc38b7b850e2fff9f097098d8f6840dd9cb5aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 30 Nov 2025 05:32:36 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 164456
date: Sun, 30 Nov 2025 05:32:36 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

POST
H2 204 collect
analytics.google.com/g/ 0
0 577ms
81ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-S9B9ZLEX4D&gtm=45je5bi1v9235665865za200zd9235665865&_p=1764480754983&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480756&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4987
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
554 B 996ms
72ms Ping
text/plain 192.178.218.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-S9B9ZLEX4D&cid=800170221.1764480757&gtm=45je5bi1v9235665865za200zd9235665865&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.178.218.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yuiadtq-in-f154.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 285ms
189ms Image
image/gif 142.251.40.227
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-S9B9ZLEX4D&cid=800170221.1764480757&gtm=45je5bi1v9235665865za200zd9235665865&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638&z=535130988

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 30 Nov 2025 05:32:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 utag.js Show response
t.ssp.hinet.net/ Frame D9D0 5 KB
0 260ms
260ms Script
application/javascript 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL: https://t.ssp.hinet.net/utag.js
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/presetfn.js?20231115
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),
Reverse DNS: 203-75-214-136.hinet-ip.hinet.net
Software: nginx /
Resource Hash: 73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: max-age=600
content-encoding: gzip
etag: W/"65e6c0fa-15e4"
expires: Sun, 30 Nov 2025 05:42:36 GMT
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/javascript
last-modified: Tue, 05 Mar 2024 06:51:38 GMT
server: nginx
vary: Accept-Encoding

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame AE7E 325 KB
0 12ms
12ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-mMcV35LQ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-mMcV35LQ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: DohHBtcIz7szM/3rUGcgELr1EtTBs82GTPPPeEAjvLrsTX+ENWp/Bak3AxUiGOycgarhxSK4uiUOobImFZBYCw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 collect
analytics.google.com/g/ 0
0 413ms
79ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5bi1v9181474282za200zb9235665865zd9235665865&_p=1764480754983&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ecid=140072146&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_s=1&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115616986~115938465~115938469~116184927~116184929~116217636~116217638~116251938~116251940&sid=1764480756&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=page_view&_fv=1&_ss=1&_ee=1&tfd=5148
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
49 B 651ms
75ms Ping
text/plain 192.178.218.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-ZDFZCDVDK1&cid=800170221.1764480757&gtm=45je5bi1v9181474282za200zb9235665865zd9235665865&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115616986~115938465~115938469~116184927~116184929~116217636~116217638~116251938~116251940
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.178.218.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yuiadtq-in-f154.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 262ms
260ms Image
image/gif 142.251.40.227
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-ZDFZCDVDK1&cid=800170221.1764480757&gtm=45je5bi1v9181474282za200zb9235665865zd9235665865&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115616986~115938465~115938469~116184927~116184929~116217636~116217638~116251938~116251940&z=374287694

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 30 Nov 2025 05:32:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
analytics.google.com/g/ 0
0 370ms
78ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5bi1v9181474282za200zb9235665865zd9235665865&_p=1764480754983&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ecid=140072146&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=gAAAAAQ&_s=2&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115616986~115938465~115938469~116184927~116184929~116217636~116217638~116251938~116251940&sid=1764480756&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=1&ep.event_category=pause&ep.event_label=ODYuMTA2LjkwLjIxNA&epn.value=1&_et=32&tfd=5191
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 54C6 325 KB
0 12ms
12ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-mMcV35LQ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-mMcV35LQ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: DohHBtcIz7szM/3rUGcgELr1EtTBs82GTPPPeEAjvLrsTX+ENWp/Bak3AxUiGOycgarhxSK4uiUOobImFZBYCw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 collect
analytics.google.com/g/ 0
0 275ms
80ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5bi1v897965293za200zb9235665865zd9235665865&_p=1764480754983&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480757&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=page_view&_fv=1&_ss=1&_ee=1&tfd=5274
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
58 B 645ms
73ms Ping
text/plain 192.178.218.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-N394QBRGC0&cid=800170221.1764480757&gtm=45je5bi1v897965293za200zb9235665865zd9235665865&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115938465~115938468~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.178.218.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yuiadtq-in-f154.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ 42 B
63 B 402ms
399ms Image
image/gif 142.251.40.227
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-N394QBRGC0&cid=800170221.1764480757&gtm=45je5bi1v897965293za200zb9235665865zd9235665865&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115938465~115938468~116184927~116184929~116217636~116217638&z=1527016485

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 30 Nov 2025 05:32:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 collect
analytics.google.com/g/ 0
0 266ms
82ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5bi1v897965293za200zb9235665865zd9235665865&_p=1764480754983&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=gAAAAAQ&_s=2&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480757&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=1&ep.event_category=pause&ep.event_label=ODYuMTA2LjkwLjIxNA&epn.value=1&_et=11&tfd=5293
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame E1B8 105 KB
0 0ms
0ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

72c0aa484ed554c7f385deb14edc6fa6afe7eedf0d04d3235a3dff61cf408f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 931 / 20422 / m202511120101 / config-hash: 14247479607061606112
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 05:32:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34313
x-xss-protection: 0
server: cafe

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame 2707 105 KB
0 0ms
0ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

72c0aa484ed554c7f385deb14edc6fa6afe7eedf0d04d3235a3dff61cf408f28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 931 / 20422 / m202511120101 / config-hash: 14247479607061606112
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 05:32:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:32:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34313
x-xss-protection: 0
server: cafe

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 012C 422 KB
143 KB 83ms
82ms Script
application/javascript 142.250.64.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

9efa10def9440708715bcf0cb1456c74c1a413b17622d8f2675a2260679489b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
content-encoding: zstd
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 30 Nov 2025 05:32:37 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 146358
date: Sun, 30 Nov 2025 05:32:37 GMT
x-xss-protection: 0
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Google Tag Manager
access-control-allow-headers: Cache-Control

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 012C 37 B
402 B 264ms
259ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

86a34eac25d67a687571efa9bed73b4b3c06a046793da56e628b22e2f90c9c85

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame DA54 37 B
403 B 540ms
276ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

60c40f5a2b4a1bda580470e816bb3996eb9ce9e8d2f689604856ecb5bf75036d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 8122 37 B
402 B 809ms
266ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

b03f03d95ea5dbeee74fab42fb0c534164191a9998c5aa7b6d898b462ebd077f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame CFEB 325 KB
0 12ms
12ms Script
application/x-javascript 31.13.66.19
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: fcm2.holmesmind.com
URL: https://fcm2.holmesmind.com/cm.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.66.19 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-iad3.fbcdn.net

Software

Resource Hash

e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-mMcV35LQ' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:36 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-mMcV35LQ' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=57, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=3, ullat=-1
pragma: public
x-fb-debug: DohHBtcIz7szM/3rUGcgELr1EtTBs82GTPPPeEAjvLrsTX+ENWp/Bak3AxUiGOycgarhxSK4uiUOobImFZBYCw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
content-length: 85645
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame B2DA 37 B
403 B 1079ms
260ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

c6fe9e62123588f4b2647f97b8ba61cef5cc4b1ffaf8f74b033236c2a8af023f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 31CE 37 B
403 B 1353ms
271ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

5d14cef2e46d075101b98d83e530a9255ce5cc10258f4c12caabc91a3237aa34

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame D9D0 37 B
403 B 1634ms
281ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

b7f74d42b2dec65c32cd2b08bd521b2f3d470ebd19e6659b32c9602174279240

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 main.js Show response
cdn.holmesmind.com/module/product/inner/inner_image/ Frame 31CE 26 KB
27 KB 56ms
55ms Script
application/javascript 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.holmesmind.com/module/product/inner/inner_image/main.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 651219c93cab2078fb7f9f5f3d091d56009b1108ff95b312d5b518a8639fbf2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-version-id: 5eDfF61po8mbPAqic7Z9nmad18STHB0v
etag: "9570d1addd7f3b91ecb1c725d51a1458"
age: 42
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 26746
x-amz-cf-id: HQngLUTvT0Rn2eRIEGImVp5fRuQyg7Nf6hWjzQMN5blnIywbZqyrxg==
date: Sun, 30 Nov 2025 05:32:26 GMT
content-type: application/javascript
last-modified: Wed, 21 Aug 2024 05:57:19 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H2 200 cf.png
cdn.holmesmind.com/ Frame 31CE 2 KB
3 KB 50ms
50ms Image
image/png 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/cf.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bca7ee31fc622c935a1ba3d3d012111f3aab926dc898ed011513fc7a9145f90e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: JXDsYp0MpCsC07xlgs6M6Edv23lP_HUM
etag: "7cb0cc414e01c6f48a9eefee02d81959"
age: 59226
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 2399
x-amz-cf-id: 35219iqeymeRIBGULFrRp5flt6DFGcTJdUFisFPsDgdDD3ITz1WzjA==
date: Sat, 29 Nov 2025 13:11:14 GMT
content-type: image/png
last-modified: Mon, 19 Jun 2023 03:09:39 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/ Frame E1B8 608 KB
0 1ms
1ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 6518253978845184816
age: 1377
x-content-type-options: nosniff
expires: Mon, 30 Nov 2026 05:09:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:09:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 196693
x-xss-protection: 0
server: cafe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/ Frame 2707 608 KB
0 16ms
16ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://reurl.cc
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 6518253978845184816
age: 1377
x-content-type-options: nosniff
expires: Mon, 30 Nov 2026 05:09:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:09:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 196693
x-xss-protection: 0
server: cafe

GET
H2 200 i
ad.holmesmind.com/adserver/ Frame 31CE 0
65 B 236ms
218ms Image
image/png 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ad.holmesmind.com/adserver/i?ut=1764480756&p=14210:131880:236322:171a2884f9e206fb7b46de5ddbac8cad:14756
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: image/png
server: nginx

GET
H2 200 5cf10104f128d8b4524b2f34f4e23082.jpg
cdn.holmesmind.com/image/14756/ Frame 31CE 49 KB
49 KB 77ms
59ms Image
image/jpeg 18.173.132.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.holmesmind.com/image/14756/5cf10104f128d8b4524b2f34f4e23082.jpg
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-120.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 834b68c690ad07a8043013788c16c639128d421a11df1b3732956360c81463a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: accept-encoding
x-amz-version-id: wrbWxuSFb_RR5JAbnYA.vTVJ4FB5f189
etag: "553b2a6b6a5ae232dd73e2833e61f6bb"
age: 58015
via: 1.1 be85287d15abd3cfecdfa319493ba256.cloudfront.net (CloudFront)
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 49962
x-amz-cf-id: PSuzzbBFacPrwdYYSw-0rhDlMnGhTv31Wo5IhAkg_lsJcZrYeBne6g==
date: Sat, 29 Nov 2025 13:28:28 GMT
content-type: image/jpeg
last-modified: Thu, 11 Jul 2024 03:03:25 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P2
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/ Frame E1B8 64 KB
0 7ms
7ms Other
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17914686685964197562
age: 1776
x-content-type-options: nosniff
expires: Sun, 07 Dec 2025 05:02:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:02:59 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23115
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202511110101"

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/ Frame 2707 64 KB
0 11ms
11ms Other
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202511110101/gpt

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 17914686685964197562
age: 1776
x-content-type-options: nosniff
expires: Sun, 07 Dec 2025 05:02:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:02:59 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23115
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202511110101"

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame 012C 30 B
272 B 273ms
272ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

POST
H2 204 collect
analytics.google.com/g/ Frame 012C 0
0 89ms
81ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-M4J67EDHV2&gtm=45je5bj0h2v9235662620za200zd9235662620&_p=1764480757130&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=1&pscdl=noapi&_s=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480757&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2226
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ Frame 012C 0
49 B 218ms
76ms Ping
text/plain 192.178.218.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-M4J67EDHV2&cid=800170221.1764480757&gtm=45je5bj0h2v9235662620za200zd9235662620&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116217636~116217638
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.178.218.154 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: yuiadtq-in-f154.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0
report-to: {"group":"ascnsrsggc:138:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:138:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:138:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 ga-audiences
www.google.ca/ads/ Frame 012C 42 B
63 B 138ms
134ms Image
image/gif 142.251.40.227
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-M4J67EDHV2&cid=800170221.1764480757&gtm=45je5bj0h2v9235662620za200zd9235662620&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=1&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116217636~116217638&z=397544537

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 30 Nov 2025 05:32:37 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
447 B 81ms
77ms XHR
text/plain 142.250.81.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j102&a=1676852341&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&ul=en-ca&dt=Meilleur%20IPTV%20Abonnement%20en%20France&sr=1600x1200&vp=1600x1200&_u=IADAAEABAAAAACAAI~&jid=1786489230&gjid=783419214&cid=800170221.1764480757&tid=UA-102456694-1&_gid=1141108092.1764480758&_r=1&_slc=1&z=1049692415

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.81.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s74-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

report-to: {"group":"ascnsrsgac:211:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:211:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:37 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:211:0
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:211:0
content-length: 3
server: Golfe2

GET
DATA 200
OK truncated
/ Frame 31CE 351 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f31502bd8b58a334acc32b695f096fde6dd136fa1106f2d2d9fb4825d41b1abb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 012C 0
188 B 276ms
271ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T&mp=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/ Frame 012C 0
177 B 2486ms
284ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/pixel?bd=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9&t=50ef57&referrer=

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:40 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame DA54 0
188 B 272ms
269ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:37 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 8122 0
188 B 543ms
263ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame B2DA 0
188 B 828ms
269ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 31CE 0
188 B 1101ms
267ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame D9D0 0
188 B 1352ms
250ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=50ef57&cid=4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/ Frame DA54 0
177 B 3044ms
285ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/pixel?bd=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:40 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 31CE 0
463 B 1511ms
96ms XHR
text/plain 74.119.117.5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://bidder.criteo.com/cdb?ptv=164&profileId=184&cb=6022644065

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://reurl.cc/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:39 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H/1.1 200
OK pixel
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/ Frame 8122 0
177 B 3323ms
262ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/pixel?bd=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:41 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H/1.1 200
OK pixel
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/ Frame B2DA 0
177 B 3577ms
257ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/pixel?bd=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:41 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 av Show response
ad.holmesmind.com/adserver/ Frame 31CE 0
140 B 219ms
215ms Script
text/html 35.75.180.237
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ad.holmesmind.com/adserver/av?p=14210:131880:236322:171a2884f9e206fb7b46de5ddbac8cad:14756&type=1
Requested by: Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/drawV2.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.75.180.237 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-75-180-237.ap-northeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
date: Sun, 30 Nov 2025 05:32:38 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
server: nginx

GET
H/1.1 200
OK pixel
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/ Frame 31CE 0
177 B 3809ms
259ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/pixel?bd=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:42 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H/1.1 200
OK pixel
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/ Frame D9D0 0
177 B 4094ms
279ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net/pixel?bd=aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9&t=50ef57&referrer=

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:42 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

GET
H2 200 / Show response
t.ssp.hinet.net/ Frame 4D45 36 B
408 B 290ms
289ms XHR
text/html 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

8101a269966f8ab95a4be6dcf7822960e4f375c3c5b91ecfaf5179f5d5378620

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Sun, 30 Nov 2025 05:32:40 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 emome2 Show response
t.ssp.hinet.net/ Frame 4D45 30 B
278 B 303ms
301ms XHR
application/json 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/emome2?u=342edee7-5b82-489a-af0c-b9c91dd3c292

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Sun, 30 Nov 2025 05:32:40 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: nginx

GET
H2 200 cm Show response
t.ssp.hinet.net/ Frame 4D45 0
194 B 301ms
300ms XHR
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to

Full URL

https://t.ssp.hinet.net/cm?c=cf&cid=undefined&mp=342edee7-5b82-489a-af0c-b9c91dd3c292

Requested by

Host: t.ssp.hinet.net
URL: https://t.ssp.hinet.net/utag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

strict-transport-security: max-age=0
cache-control: no-cache, private
access-control-allow-credentials: true
access-control-allow-origin: https://cdn.holmesmind.com
date: Sun, 30 Nov 2025 05:32:40 GMT
content-type: image/png
vary: Origin
server: nginx

GET
H/1.1 200
OK pixel
342edee7-5b82-489a-af0c-b9c91dd3c292.t.ssp.hinet.net/ Frame 4D45 0
177 B 1818ms
261ms Image
image/png 203.75.214.136
HINET Data Commun...

General

Check archive.org

Download Go to Show image

Full URL

https://342edee7-5b82-489a-af0c-b9c91dd3c292.t.ssp.hinet.net/pixel?bd=342edee7-5b82-489a-af0c-b9c91dd3c292&t=cf&referrer=https%3A%2F%2Freurl.cc

Requested by

Host: cdn.holmesmind.com
URL: https://cdn.holmesmind.com/js/capmapping.htm

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

203.75.214.136 Taipei, Taiwan, ASN3462 (HINET Data Communication Business Group, TW),

Reverse DNS

203-75-214-136.hinet-ip.hinet.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

Strict-Transport-Security: max-age=0
Content-Length: 0
Date: Sun, 30 Nov 2025 05:32:42 GMT
Content-Type: image/png
Server: nginx
Connection: keep-alive

POST
H3 204 collect
analytics.google.com/g/ 0
0 76ms
75ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-S9B9ZLEX4D&gtm=45je5bi1v9235665865za200zd9235665865&_p=1764480754983&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527906~104528500~104684208~104684211~115583767~115616986~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480756&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=scroll&epn.percent_scrolled=90&_et=15&tfd=10009
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S9B9ZLEX4D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:41 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
analytics.google.com/g/ 0
0 98ms
98ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-ZDFZCDVDK1&gtm=45je5bi1v9181474282za200zb9235665865zd9235665865&_p=1764480754983&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ecid=140072146&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=3&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115616986~115938465~115938469~116184927~116184929~116217636~116217638~116251938~116251940&sid=1764480756&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=scroll&epn.percent_scrolled=90&_et=2&tfd=10193
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZDFZCDVDK1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:42 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
analytics.google.com/g/ 0
0 74ms
73ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-N394QBRGC0&gtm=45je5bi1v897965293za200zb9235665865zd9235665865&_p=1764480754983&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=3&tag_exp=103116026~103200004~104527906~104528501~104684208~104684211~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480757&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=Meilleur%20IPTV%20Abonnement%20en%20France&en=scroll&epn.percent_scrolled=90&_et=1&tfd=10294
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-N394QBRGC0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:42 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
analytics.google.com/g/ Frame 012C 0
0 89ms
88ms Fetch
text/plain 142.250.80.46
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-M4J67EDHV2&gtm=45je5bj0h2v9235662620za200zd9235662620&_p=1764480757130&gcd=13l3l3l3l1l1&npa=0&dma=0&cid=800170221.1764480757&ul=en-ca&sr=1600x1200&_ng=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=1&pscdl=noapi&_eu=AEAAAAQ&_s=2&tag_exp=103116026~103200004~104527907~104528500~104684208~104684211~105391253~115583767~115938465~115938468~116184927~116184929~116217636~116217638&sid=1764480757&sct=1&seg=0&dl=https%3A%2F%2Freurl.cc%2F7bk8rN&dt=&en=scroll&epn.percent_scrolled=90&tfd=7294
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-M4J67EDHV2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.80.46 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s34-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:169:0
report-to: {"group":"ascnsrsggc:169:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:169:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://reurl.cc
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:169:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:42 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 oid Show response
onead.onevision.com.tw/v2/et/ 371 B
1 KB 399ms
219ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://onead.onevision.com.tw/v2/et/oid?cb=window.text_etag_callback_4m9bh

Requested by

Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

5a7cab09518c7073fc12ca5cde808431a4d77ad7901d6a63565328758b3034ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
etag: ff12e427-cdad-11f0-95fe-42010a000008
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 74065851
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/javascript
last-modified: Sun, 30 Nov 2025 05:32:44 GMT
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: max-age=600
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 371
x-onead-backend: onead-http-event-035s-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 page.php Show response
www.facebook.com/plugins/ Frame DACA 59 KB
22 KB 200ms
140ms Document
text/html 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

a67f70f5267c6b49abda64f77b70c38610c06060a56253aaab4dbab53860d093

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-fShruXOo' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-fShruXOo' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:32:43 GMT
document-policy: force-load-at-top include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
pragma: no-cache
priority: u=0,i
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7578387171520645857&cpp=C3&cv=1030435471&st=1764480763919"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7578387171520645857&cpp=C3&cv=1030435471&st=1764480763919", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=51, rtx=0, c=23, mss=1232, tbw=4916, tp=8, tpl=0, uplat=83, ullat=0
x-fb-debug: tgdH7/+L/HVmCn6BLcEHulb+mMITlT8EVm0mYBaIezjZdVFEKRV/AZZV5DCFOxrrlNr/Pd63h0+s6iTFNE2KLw==
x-xss-protection: 0

GET
H2 200 feeds Show response
re-news.tw/ 6 KB
3 KB 758ms
241ms XHR
text/html 35.185.136.122
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://re-news.tw/feeds
Requested by: Host: reurl.cc
URL: https://reurl.cc/asset/javascripts/common/renews.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.136.122 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 122.136.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) / Express
Resource Hash: 034a343ec2e700d84a251d2657c40db2206eac06c5da8d6e25be2fd8ce7f33d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
etag: W/"1734-MVSK3d0Hk5nQuOWxPVVhsFkqd2E"
access-control-allow-origin: https://reurl.cc
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: text/html; charset=utf-8
x-powered-by: Express
server: nginx/1.18.0 (Ubuntu)
vary: Origin

GET
H3 200 keywordCategories.json Show response
anymind360.com/ 148 KB
60 KB 70ms
40ms Fetch
application/json 151.101.65.55
FASTLY

General

Check archive.org

Download Go to

Full URL

https://anymind360.com/keywordCategories.json

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.65.55 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

UploadServer /

Resource Hash

9aa92a9a076fd2e55f339cd82c8b540e96ea0a4e4c7c12da6602edfadf2a0819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-goog-metageneration: 2
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=hYq3+w==, md5=ZJdPIhH4R+FB2zz6x81gJg==
content-encoding: gzip
etag: "64974f2211f847e141db3cfac7cd6026"
age: 83688
x-goog-stored-content-encoding: identity
expires: Wed, 27 Aug 2025 11:36:24 GMT
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-goog-stored-content-length: 151503
x-cache: HIT, HIT
date: Sun, 30 Nov 2025 05:32:43 GMT
content-type: application/json
last-modified: Wed, 27 Aug 2025 06:51:59 GMT
x-served-by: cache-tyo11981-TYO, cache-yul1970075-YUL
x-cache-hits: 246713, 77
x-guploader-uploadid: ABgVH8_WbYCDB2LaOxaydMbIBmzZEeTdmD__y3SdRPYQiipklanNaJ-DP_0DBH49PGWyFZEEI1nzUSM
strict-transport-security: max-age=31557600
vary: Accept-Encoding
cache-control: max-age=1200
x-goog-storage-class: STANDARD
x-timer: S1764480764.953155,VS0,VE0
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1756277519403323
content-length: 61163
server: UploadServer

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame EE0E 15 KB
6 KB 211ms
63ms Document
text/html 74.119.117.62
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=reurl.cc

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

dac56831476fb5f3f2c40c74e494002b792f5797910296d14c354be48995e136

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:32:43 GMT
server: Kestrel
server-processing-duration-in-ticks: 658627
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 iXGJEr7Orjl.css
static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/ Frame DACA 20 KB
6 KB 142ms
65ms Stylesheet
text/css 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

60280ebcf60053f7d378a772ecfabb60b0b69b9634e19105cb2307b126918447

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: z/mgktkHqyjk5kjdOFxmUA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sun, 22 Nov 2026 17:29:28 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: DZCAFGh4Dq6OJsagjzTR1ozhdLkeZz3eqkR/0gOlHTHyGRYjf13VbEcmHFSvF14Y/6EORdKSncgbZNH+XO6XMg==
priority: u=0
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=5011, tp=10, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 5633
origin-agent-cluster: ?1

GET
H3 200 8WauLuHIUmG.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yl/r/ Frame DACA 339 KB
90 KB 247ms
159ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

d7627bee7b263ac39dc5cf783096e2581b6f03eccdd4e9b403a2e7f0689aa81a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: dp+8OK3lvj4Szd2zfWeXdQ==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 03:11:44 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: COb2KLHpKfADeKH9kjAnKBiJ6Nph0RiZXkREGWYOZEhOFnjHTymab4cRu/GH0p4/Hm1Ws2OGj+fcJfzp2SJdFQ==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=33731, tp=35, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 92041
origin-agent-cluster: ?1

GET
H3 200 WQMqdoxbuA9.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yB/r/ Frame DACA 8 KB
3 KB 244ms
157ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yB/r/WQMqdoxbuA9.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

fdef8acb7e3dbb6cb32783cb67afbe528299489fd6d5eb5ec6e72ea0677c2daf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: fTj0Tupj/XcAbrs5fBnZhA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 07:43:58 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: iR94GoRtGp1Fim7KE+3AccjRRoiCMvQuvY3Tbza80pfIHR4eq4HALqNuNOOs2f07aj3UfEzxx3ycvCJHnRez4g==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=33731, tp=35, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 2672
origin-agent-cluster: ?1

GET
H3 200 gJtoJCnaERC.js Show response
static.xx.fbcdn.net/rsrc.php/v4iEpO4/yW/l/en_US-j/ Frame DACA 185 KB
50 KB 143ms
67ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yW/l/en_US-j/gJtoJCnaERC.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

bc321999eef0d543e7a78351fb9bc32c7a6175165a80a9fc106a93c865053400

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: JRyXXvni6Ry/GTANAQPKgw==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Tue, 24 Nov 2026 14:51:56 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: 7rJCfshq5CV//PpAk2QIYeNBCIOQhc6aNXXpQxW2jp7ji4uBm57D5LWh3OyuqjlVq141g39d/dAQbjP1svAmhA==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=19027, tp=22, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 50798
origin-agent-cluster: ?1

GET
H3 200 4O9wHg-5OUU.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yh/r/ Frame DACA 32 KB
11 KB 142ms
67ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yh/r/4O9wHg-5OUU.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

b2eb8d16fc7f414112b0ac4fa8d6d946fd133dc7480c7e4b05fc2822b3b4fae6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: X/Mz95bvlXexgrB+u9fkFA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 18 Nov 2026 21:03:31 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: Oxdu00+uCPMTcU5doByisA48+4csWtrbtkBJXWfOSS0H+PgPgfiUrWQd6qTjlm0n3ibtXT07R+leYQGz+cQF7Q==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=5011, tp=10, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 10901
origin-agent-cluster: ?1

GET
H3 200 8wypiAW_bfk.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yb/r/ Frame DACA 557 B
465 B 241ms
155ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yb/r/8wypiAW_bfk.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

c2bfe20d9d58935828e75bc753e2655f240621077408ae64f9b40a20f5125487

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: WrWgdG79ReerxOLSJDvtvA==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 22:55:10 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: Vb2oGPnq5qTX3PplO9hVXRhQiJ7A/TB744hyT+hbKaKpwrZJV/t2vqV/VPcj3VyB0Stn2WYBgofhNJwLNLpVkg==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=33731, tp=35, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 323
origin-agent-cluster: ?1

GET
H3 200 dLi53jE44G4.js Show response
static.xx.fbcdn.net/rsrc.php/v4iLl54/ya/l/en_US-j/ Frame DACA 30 KB
9 KB 237ms
155ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4iLl54/ya/l/en_US-j/dLi53jE44G4.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

e685bee1f5b7b1656705efefa0b5fb7cd931000896f088c3210b6bfcd0ed40e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: dPyTRLx2vt/LB2Z5mGr+Ww==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Fri, 20 Nov 2026 09:31:53 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: 0qTqPGlysvkNKjWpCzd0p1ezPNyoUAXLlap9Sr2OqaQGEHNqKixl2aXvXq9NbO4VbBTiqDw2G3E1Jtqreo9CoA==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=23, mss=1232, tbw=33731, tp=35, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 8777
origin-agent-cluster: ?1

GET
H3 200 302181889_449668210518240_1343224774275673253_n.png
scontent-yyz1-1.xx.fbcdn.net/v/t39.30808-1/ Frame DACA 2 KB
2 KB 131ms
42ms Image
image/png 31.13.80.12
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL: https://scontent-yyz1-1.xx.fbcdn.net/v/t39.30808-1/302181889_449668210518240_1343224774275673253_n.png?stp=cp0_dst-png_s50x50&_nc_cat=105&ccb=1-7&_nc_sid=f907e8&_nc_ohc=pUlyqmnBEAEQ7kNvwE5Xd-D&_nc_oc=AdkA41Wq8ksALzAGrOo7aCWVg4VkKgVEvWuKyfo-xbA8Jaw6mp6_Vkxk5P6jSV-Injc&_nc_zt=24&_nc_ht=scontent-yyz1-1.xx&edm=ADwHzz8EAAAA&_nc_gid=6G9Wz7GdxknqShs1B8KD-w&oh=00_AfifGwnTHAphqCYmyE5wb1owpQSVOPkvlZN136KVcBHSRA&oe=69319395
Requested by: Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 31.13.80.12 Toronto, Canada, ASN32934 (FACEBOOK, US),
Reverse DNS: xx-fbcdn-shv-01-yyz1.fbcdn.net
Software: /
Resource Hash: 352d0915216b13b935f1abedea04d4a039802faaf69153ae71c377410990e322

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://www.facebook.com/

Response headers

x-robots-tag: noarchive, noindex
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
no-vary-search: key-order, params=("_nc_gid" "oh" "oe" "_nc_oc" "_nc_ohc" "_nc_cat" "_nc_ht" "_nc_cb")
last-modified: Tue, 06 Sep 2022 22:20:57 GMT
x-fb-ptm-uuid: 254082AB4932A8F0E38E476FBD4F08AF
content-type: image/png
priority: u=3,i
cache-control: max-age=1209600, no-transform
timing-allow-origin: *
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4962, tp=9, tpl=0, uplat=0, ullat=-1
x-crypto-project: 0
cross-origin-resource-policy: cross-origin
content-digest: adler32=747767112
access-control-allow-origin: *
accept-ranges: bytes
content-length: 2066
x-additional-error-detail

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame EE0E 428 B
912 B 81ms
80ms Fetch
application/json 74.119.117.62
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertag&domain=reurl.cc&sn=ChromeSyncframe&so=0&topUrl=reurl.cc&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=reurl.cc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

52f7db6ace8e174c92e31058de5aec4556a91eb2867d2b6242472006a6f64f24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=reurl.cc

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 1170850
expires: 0
date: Sun, 30 Nov 2025 05:32:43 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 adsrv Show response
onead.onevision.com.tw/v2/ 176 B
478 B 251ms
244ms Script
application/javascript 107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://onead.onevision.com.tw/v2/adsrv?version=20250516&uid=1000480&category=-1&cookie=true&ip=&guid=ff12e431-cdad-11f0-95fe-42010a000008&channel=0&volume=0.5&r=&adid=&response_freq_multiple=native-drive.0&web_location=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&title=Meilleur%20IPTV%20Abonnement%20en%20France&fp=03ec8e90dd0370497af4534e2ce732c9&_t=1764480764216&cb=ONEAD_text_response_4m9bh&pb=0&spid=&player_type=NATIVE_LIST&bgid=0

Requested by

Host: ad-specs.guoshipartners.com
URL: https://ad-specs.guoshipartners.com/static/js/ad-serv.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

e8bc940359085308ba7b8d7107e53f7bbaf18c976e64f0fbbbbbba913543232a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 56992042
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/javascript
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
x-onead-guid: ff12e431-cdad-11f0-95fe-42010a000008
x-onead-force-backend: false
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 176
x-onead-hit-counter: 1
x-onead-backend: onead-http-query-2mz8-gohttp
server: gws
x-powered-by: OneAD

GET
H3 200 UXtr_j2Fwe-.png
static.xx.fbcdn.net/rsrc.php/v4/yw/r/ Frame DACA 573 B
716 B 65ms
63ms Image
image/png 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yw/r/UXtr_j2Fwe-.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Response headers

content-md5: 07aG/2AEtDHVAZ5LUajMDQ==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 18 Nov 2026 10:34:41 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: lgEQ4sPLRPPf4KRe74pPPYTSRBJUErOrHwG4yVPZ5ZAmoF0JI/bOnRbMbIAqpIrAxExEC6UOIg0PWeJ6Np+lzA==
priority: u=3,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=2332, tp=5, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 573
origin-agent-cluster: ?1

GET
H3

200

ltm
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://bcp.crwdcntrl.net/map/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://bcp.crwdcntrl.net/map/ct=y/c=15135/tp=ONEA/lac=y?https://onead.onevision.com.tw/v2/pixel/ltm?id=${profile_id}
https://onead.onevision.com.tw/v2/pixel/ltm?id=fb7f07780678ec69d6ef9ea37093b314

170 B
203 B

237ms
236ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/ltm?id=fb7f07780678ec69d6ef9ea37093b314

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
x-vendor: ltm
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 85496939
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:45 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: fb7f07780678ec69d6ef9ea37093b314
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-035s-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
location: https://onead.onevision.com.tw/v2/pixel/ltm?id=fb7f07780678ec69d6ef9ea37093b314
pragma: no-cache
expires: 0
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Sun, 30 Nov 2025 05:32:44 GMT

GET
H3

200

ttd
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=r1jlltl&ttd_tpi=1
https://onead.onevision.com.tw/v2/pixel/ttd?id=1478f59a-f97a-4394-91ab-26594eb7c4f1

170 B
203 B

238ms
236ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/ttd?id=1478f59a-f97a-4394-91ab-26594eb7c4f1

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
x-vendor: ttd
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 501487413
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: 1478f59a-f97a-4394-91ab-26594eb7c4f1
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-lk5g-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

location: https://onead.onevision.com.tw/v2/pixel/ttd?id=1478f59a-f97a-4394-91ab-26594eb7c4f1
content-length: 197
date: Sun, 30 Nov 2025 05:32:44 GMT
server: Kestrel

GET
H/1.1

200
OK

/
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=3m51m51&uid=ff12e431-cdad-11f0-95fe-42010a000008&t=ajs
https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=ff12e431-cdad-11f0-95fe-42010a000008&t=ajs

1 KB
1 KB

71ms
69ms

Image
application/javascript

44.218.64.233
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=3m51m51&uid=ff12e431-cdad-11f0-95fe-42010a000008&t=ajs
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Server: 44.218.64.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-64-233.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

Content-Length: 1228
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sun, 30 Nov 2025 05:32:45 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=3m51m51&uid=ff12e431-cdad-11f0-95fe-42010a000008&t=ajs
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sun, 30 Nov 2025 05:32:44 GMT

GET
H3

200

taboola
onead.onevision.com.tw/v2/pixel/
Redirect Chain

https://trc.taboola.com/sg/onedata/1/cm
https://onead.onevision.com.tw/v2/pixel/taboola?id=e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c

170 B
203 B

229ms
228ms

Image
image/png

107.178.241.176
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://onead.onevision.com.tw/v2/pixel/taboola?id=e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Server

107.178.241.176 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

176.241.178.107.bc.googleusercontent.com

Software

gws / OneAD

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-onead-version: c93c1c91
x-vendor: taboola
age: 0
access-control-allow-methods: GET,POST,OPTIONS,PUT
expires: Mon, 01 Jan 1990 00:00:00 GMT
x-varnish: 500046014
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: image/png
last-modified: Tue, 27 Oct 2020 13:57:49 GMT
x-vendor-client-id: e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-status: okay
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
accept-ranges: bytes
access-control-allow-origin: *
content-length: 170
x-onead-backend: onead-http-event-lk5g-gohttp
server: gws
x-powered-by: OneAD

Redirect headers

x-fastly-to-nlb-rtt: 20879
location: https://onead.onevision.com.tw/v2/pixel/taboola?id=e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c
x-timer: S1764480765.635666,VS0,VE22
x-vcl-time-ms: 22
via: 1.1 varnish
accept-ranges: bytes
x-cache: MISS
content-length: 0
date: Sun, 30 Nov 2025 05:32:44 GMT
x-service-version: v1
server: nginx
x-cache-hits: 0
x-served-by: cache-yul1970029-YUL

GET
H3 200 fEQL6-wrdkC.js Show response
static.xx.fbcdn.net/rsrc.php/v4/yq/r/ Frame DACA 247 KB
69 KB 67ms
66ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yq/r/fEQL6-wrdkC.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

d7968e9beff2ccb96c1a30e8e5db2373a8486550fbb63179e59e7e674542e1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: wzBVv9s5vIHMgrYGY8cYwg==
content-encoding: zstd
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 21 Nov 2026 21:58:49 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: lC+qoBeeCvjMt+pRL0UOrRYsr7BVeMypCBE4XsidsYQJbddgydoE5W5yKgTH4Lb2Ri79U7H47xkb4trHMBTZgg==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=67, rtx=0, c=166, mss=1232, tbw=182667, tp=159, tpl=0, uplat=1, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 70712
origin-agent-cluster: ?1

GET 2025112917574367.jpg
img.racingcharger.tw/wp-content/uploads/2025/11/ 0
0

GET
H3 200 result_MYSTIC_0bf7dcfe-1d44-4bb5-9a0f-67d84d5aa23d_0-390x220.jpeg
nearbymed.com/wp-content/uploads/2025/06/ 15 KB
15 KB 168ms
79ms Image
image/jpeg 172.67.222.174
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://nearbymed.com/wp-content/uploads/2025/06/result_MYSTIC_0bf7dcfe-1d44-4bb5-9a0f-67d84d5aa23d_0-390x220.jpeg
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.222.174 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c201eb317c703e75ae773af6c02f4b1fdbb99accb18c53faf302d7c37e69881

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: HIT
etag: "68d811d0-3a83"
age: 50913
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cAsBBgmTSC9i8ZDO8ZEdNOfTCc5EzRA19leJrZOiElaA9rxSmC4YPvVGIH27RovaFdPhwWHQPH0qdrTNC3f18KhCN2B%2BaALYDPJMauc%3D"}]}
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: image/jpeg
last-modified: Sat, 27 Sep 2025 16:33:20 GMT
vary: accept-encoding
priority: u=1,i
cache-control: public, max-age=31536000
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9a67f74bba8ba2d9-YYZ
accept-ranges: bytes
content-length: 14979
server: cloudflare

GET Logo.jpg
mma.prnasia.com/media2/2826383/ 0
0

GET
H2 200 1764323595-29b7b23631db049d43716cb16d4ca31a-840x525.png
img.gbyhn.com.tw/2025/11/ 548 KB
549 KB 1387ms
43ms Image
image/png 104.21.96.9
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://img.gbyhn.com.tw/2025/11/1764323595-29b7b23631db049d43716cb16d4ca31a-840x525.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.96.9 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bdb0de47ae1b8fb74591873384f7c81d22af3ab6afc5f5f1dde7266a8039dc8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

cf-cache-status: HIT
age: 156257
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ORK%2BFvzpVeHslzrfonnLE%2F0tqkymW3NwhNrx0EmqY48JDh07UXPwnRBna4vBOnV3DZwEjdy86KM5gpKkFxOFNZohNRnmUFEvY1J4L%2FTF"}]}
expires: Fri, 05 Dec 2025 10:00:17 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:46 GMT
content-type: image/png
last-modified: Fri, 28 Nov 2025 09:53:15 GMT
vary: accept-encoding
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-ray: 9a67f7537820a2bb-YUL
accept-ranges: bytes
content-length: 560907
x-turbo-charged-by: LiteSpeed
server: cloudflare

GET %E6%97%A5%E6%9C%AC%E9%9F%93%E5%9C%8B%E6%8E%A8%E8%96%A6%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1-1080x630.jpg
creditcards.com.tw/wp-content/uploads/2025/08/ 0
0

GET
H2 200 renews-title1.png
re-news.tw/images/ 24 KB
24 KB 1111ms
559ms Image
image/png 35.185.136.122
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://re-news.tw/images/renews-title1.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.185.136.122 Taipei, Taiwan, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 122.136.185.35.bc.googleusercontent.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

accept-ranges: bytes
content-length: 24493
date: Sun, 30 Nov 2025 05:32:45 GMT
etag: "61a30347-5fad"
content-type: image/png
last-modified: Sun, 28 Nov 2021 04:19:19 GMT
server: nginx/1.18.0 (Ubuntu)

GET
H3 200 file.png
static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/ 1010 KB
1010 KB 155ms
48ms Image
image/png 18.238.55.64
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.wixstatic.com/media/9a254c_bd6ab9dc57c349009b5f1eedc6fb236d~mv2.png/v1/fit/w_1000,h_1000,al_c,q_80/file.png
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 18.238.55.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-55-64.jfk52.r.cloudfront.net
Software: openresty/1.27.1.2 /
Resource Hash: 76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

x-amz-cf-id: 9Vf9sxiijOz42sSEm7BgMi0KTziA2rltZggHix30Y7Kgng-Gn24lQA==
cache-control: public, max-age=2592000, immutable
timing-allow-origin: *
age: 1824455
via: 1.1 google, 1.1 c1ba88066bcaf9ff8fd777e3d54f5c7e.cloudfront.net (CloudFront)
x-wixmp-trace: projects/wix-media-infrastructure/traces/35Dt8Qoidk0tC1qjV9mRs96nQUp
access-control-allow-origin: *
x-seen-by: image-manipulator-698889fbf5-2qccr
content-length: 1033732
alt-svc: h3=":443"; ma=86400
date: Sun, 09 Nov 2025 02:45:09 GMT
content-type: image/png
x-cache: Hit from cloudfront
server: openresty/1.27.1.2
x-amz-cf-pop: JFK52-P4

GET
H3 200 / Show response
www.facebook.com/platform/plugin/tab/renderer/ Frame DACA 69 KB
18 KB 298ms
298ms XHR
application/x-javascript 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/platform/plugin/tab/renderer/?key=timeline&config_json=%7B%22app_id%22%3A%22776730922422337%22%2C%22href%22%3A%22https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F%22%2C%22width%22%3A340%2C%22height%22%3A500%2C%22has_cta%22%3Atrue%2C%22has_small_header%22%3Afalse%2C%22has_adapt_container_width%22%3Atrue%2C%22has_cover%22%3Atrue%2C%22has_posts%22%3Afalse%2C%22tabs%22%3A%22timeline%22%2C%22can_personalize%22%3Afalse%2C%22is_xfbml%22%3Afalse%2C%22referer_uri%22%3A%22https%3A%2F%2Freurl.cc%2F%22%7D&fb_dtsg_ag&__user=0&__a=1&__req=1&__hs=20422.BP%3Aplugin_default_pkg.2.0...0&dpr=1&__ccg=GOOD&__rev=1030435471&__s=%3A%3Ahylacm&__hsi=7578387171520645857&__dyn=7wKxa13wt8K2Wmh0Sw8W5U4e1Fx-ewpU3WwvE3vx609vCwjE0AC1xwEw7Bx61vw5zw78w5Uw64w8W1uw2oE17U2ZwrU1Xo1UU3jwea&__sp=1

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yW/l/en_US-j/gJtoJCnaERC.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

ac4dc31e31766b86bd824d300ee7bb9985be61a5da7976b134e984e0e394340a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-ASBD-ID: 359341
X-FB-LSD: oZx5MV-PRi-SPFM0B2aQEO
Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7578387177780290608&cpp=C3&cv=1030435471&st=1764480764756"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
x-fb-debug: ImMBfHI+OqkMNKuFSMrDbq+pinnkbOPLBKbGrNwB2Gf03CElERIQcUq8xvrdcihfM2UOIi3IbttIv4zN0aXWig==
priority: u=1,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7578387177780290608&cpp=C3&cv=1030435471&st=1764480764756", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
cache-control: private, no-cache, no-store, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=39, mss=1232, tbw=35508, tp=44, tpl=0, uplat=218, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
origin-agent-cluster: ?1

POST
H3 200 / Show response
www.facebook.com/platform/plugin/page/logging/ Frame DACA 1021 B
719 B 139ms
138ms XHR
application/x-javascript 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/platform/plugin/page/logging/

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4iEpO4/yW/l/en_US-j/gJtoJCnaERC.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

4c88ac025727a86ecebfac82247199619c8a1fbb42b3ba13cd77baac10e434ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-ASBD-ID: 359341
X-FB-LSD: oZx5MV-PRi-SPFM0B2aQEO
Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

access-control-expose-headers: X-FB-Debug, X-Loader-Length, X-Stack, Error-MID
content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7578387176633489697&cpp=C3&cv=1030435471&st=1764480764787"}]}
x-content-type-options: nosniff
access-control-allow-methods: OPTIONS
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
vary: Origin, Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=1,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7578387176633489697&cpp=C3&cv=1030435471&st=1764480764787"
cache-control: private, no-cache, no-store, must-revalidate
x-fb-debug: 7ALcVprfgucavovzZD/aLm6BIwqQefjIdwvMPVjs2T2o2qOXpw5dU1I+3sdd2aj6SJG1np/bheA/l1Qi40T6yQ==
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=58, rtx=0, c=39, mss=1232, tbw=34116, tp=41, tpl=0, uplat=62, ullat=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
origin-agent-cluster: ?1

GET
H3 200 xgVgalBG80z.png
static.xx.fbcdn.net/rsrc.php/v4/yH/r/ Frame DACA 1 KB
1 KB 86ms
86ms Image
image/png 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/yH/r/xgVgalBG80z.png

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://static.xx.fbcdn.net/rsrc.php/v5/yg/l/0,cross/iXGJEr7Orjl.css

Response headers

content-md5: rB4cTW8WNZcBsFntToJGtA==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 19 Nov 2026 07:27:11 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: image/png
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: N9LBvGFlYWfQdbTdtHd/TemoGpeP9NYXpI+PJvMMkJCVdYE0nScfrsftnyL5LfYWL2HF1t/wejo+tQAWNkiGyw==
priority: u=3,i
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=63, rtx=0, c=23, mss=1232, tbw=4867, tp=12, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: *
content-length: 1315
origin-agent-cluster: ?1

GET
H3 200 6tpzuzEODHB.js Show response
static.xx.fbcdn.net/rsrc.php/v4/y8/r/ Frame DACA 213 B
352 B 70ms
69ms Script
application/x-javascript 57.144.180.128
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v4/y8/r/6tpzuzEODHB.js

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

57.144.180.128 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-03-lga3.fbcdn.net

Software

Resource Hash

f21233ebfc628748be56e544ee831e6723e5534227b3d48b06b77a7bda1f6e28

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

content-md5: Cz7JW2XPt8zqYMcsXYdDQg==
report-to: {"max_age":21600,"endpoints":[{"url":"https:\/\/www.xx.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 18 Nov 2026 15:28:56 GMT
alt-svc: h3=":443"; ma=86400
date: Sun, 30 Nov 2025 05:32:44 GMT
content-type: application/x-javascript; charset=utf-8
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
x-fb-debug: F1AackGykBmKFLSobg5U4CEnTB3JPmV/1UVv1ydMdNxJ1ITOomvlFdKUtnRLiz8Q16FE40M+wbJeN4UBgIVNeQ==
priority: u=1
vary: Origin
reporting-endpoints: permissions_policy="https://www.xx.facebook.com/ajax/browser_error_reports/"
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
x-fb-connection-quality: GOOD; q=0.7, rtt=67, rtx=0, c=184, mss=1232, tbw=255179, tp=221, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin: https://www.facebook.com
content-length: 213
origin-agent-cluster: ?1

GET
H3 400 / Show response
www.facebook.com/login/ Frame DACA 178 KB
178 KB 133ms
132ms Document
text/html 31.13.71.36
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://www.facebook.com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fplugins%2Fpage.php%3Fhref%3Dhttps%253A%252F%252Fwww.facebook.com%252Freurl.cc%252F%26tabs%3Dtimeline%26width%3D340%26height%3D500%26small_header%3Dfalse%26adapt_container_width%3Dtrue%26hide_cover%3Dfalse%26show_facepile%3Dtrue%26appId

Requested by

Host: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/8WauLuHIUmG.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.36 New York, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

311ddea6faecd14a9067b12c853cbc9737ae2a1af53854a0429feb3dc7230242

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-Qn5eJy7T' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com .accounts.meta.com https://trustly.one/ https://.trustly.one/ https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2Freurl.cc%2F&tabs=timeline&width=340&height=500&small_header=false&adapt_container_width=true&hide_cover=false&show_facepile=true&appId
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: zstd
content-length: 856
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-Qn5eJy7T' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
date: Sun, 30 Nov 2025 05:32:45 GMT
document-policy: include-js-call-stacks-in-crash-reports
expires: Sat, 01 Jan 2000 00:00:00 GMT
origin-agent-cluster: ?1
pragma: no-cache
priority: u=0,i
proxy-status: http_request_error; e_fb_vipaddr="AcPSRBKbk3RkciIFwYgNhSJkUR3_u6kvG3eWcqpbPZVWcLFp_w83VczeYyIS4hxf1TIuy1GWtv573Uuv6mNsVmlAs7omkr_vc2-CdA"; e_clientaddr="AcNHkaqSPhrzd2fwFoR4E_aq-f_Y1-2E9f2Ry7IF82HuSdwIjHJDNBp6qGzb9LkvoEylrgjjGmHHmjkkgzw3RH9YT5Bep2l6Ouv9RD-D2dCjTFmh"; e_upip="AcP0ROR_NYjkOcLo5k8pE9CLkridUtkpzkjfkZ_Rh7wxbmN-WWjs8g3N2veoaAjxCB1S_z5C6Sm9iCNQLiy3L_9aiCDgsZ_llo_JVghy5z0"; e_fb_zone="AcM2bxKPE3_YCVezpixw73slNq2D4SB7UGSh4RH1W6TUZnkV5XwM7kXDxvYs76LN"; e_fb_twtaskhandle="AcMjrgzDCQdVvCX975r30yRDr0QF9HC2MW0ajXFk5o5AnBc2oFzJM7iyLTmCQm4X4MF_v3JiXuLZVdriVAQbbJJZbU98-Z37U9yzpeFhBt-cXD4"; e_proxy="AcN1IwSk2rXGfUcg3aC1vnTXymK8mNKmtBw4smBqVi0lwDwJOARKVWoJXynlq1BUiXNFiHhtkdy8_qPyf-x3", http_request_error; e_fb_vipaddr="AcNSWeOYURO8TyjjI1qCzAwOgCwblvGET_kDYf2F-xyj7vu4iKNLevlx59wT2kJi-tZZt9s"; e_clientaddr="AcO73XECI-dzp7S1GG_HgSDVLiOkhtY1EprC-FGMQfibWvW2CZtG5kNmqnHgZ6S2zg6sPvuAokxDwMmC_A"; e_upip="AcM_zfHaMUAzwaj4VKS9hvavl25OtHT81uKcVtb0StzkOmmUkcTsZj9dzdD1mascWxBKr2KC6MinXkABFYnVVNuXHza7o-Br03clpw"; e_fb_zone="AcPdKTXV0scIf3_jcu9TRm5XCgVd0dPvvmPbt7y7VlPQuG5eLQUeowne3qhCWg"; e_fb_twtaskhandle="AcOAqJIoFFPDsOKkpJ-wajkdb4bqfXIGI_gXbOeJP7cM1tzSVsqCfSXVmM4OClafsiBEFdB0hCjD9dSqNn4ezkWI4xWxl7ocYtik"; e_proxy="AcOVnTK0e8DZEfHZiO9f9r6NCEI1xAFBNGwnQbnFA6z3pnRPdyVUgoFlnEZQqg_BTMsJvztz_-gV2svR"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7578387182068212043&cpp=C3&cv=1030435471&st=1764480765006"}]}
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7578387182068212043&cpp=C3&cv=1030435471&st=1764480765006"
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-connection-quality: GOOD; q=0.7, rtt=62, rtx=0, c=39, mss=1232, tbw=54836, tp=60, tpl=0, uplat=63, ullat=0
x-fb-debug: hAEOXdL8jBQvvdSeoPTMk0smoe7N95Oa1IJOuPIIQ6Ye0u4ncaYEnXjwIufQar11bEZ/BSmk1Z7r+HogKZXflg==
x-frame-options: DENY
x-xss-protection: 0

GET yPX6-M9P-xt.css
static.xx.fbcdn.net/rsrc.php/v5/yy/l/0,cross/ Frame DACA 0
0

GET
DATA 200
OK truncated
/ Frame DACA 1 KB
0 Stylesheet
text/css

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c1642a7b402e888a16272cd16de45afc68b34c918aed03cbcbce55d74f21a2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin: https://www.facebook.com
Referer: https://www.facebook.com/

Response headers

Content-Type: text/css;charset=utf-8

GET YwXP_-ww9iI.js
static.xx.fbcdn.net/rsrc.php/v4/yh/r/ Frame DACA 0
0

GET SaX6oTFSjNg.js
static.xx.fbcdn.net/rsrc.php/v4/yl/r/ Frame DACA 0
0

GET atv-3qMDl2i.js
static.xx.fbcdn.net/rsrc.php/v4/yd/r/ Frame DACA 0
0

GET hM4SycfTajT.js
static.xx.fbcdn.net/rsrc.php/v4izx64/y4/l/en_US-j/ Frame DACA 0
0

GET v_kkAv_-wGQ.js
static.xx.fbcdn.net/rsrc.php/v4/yx/r/ Frame DACA 0
0

GET
DATA 200
OK truncated
/ Frame DACA 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame DACA 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame DACA 155 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

POST
H3 204 AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 212ms
86ms XHR
text/html 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog==

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.YuPzVux5xnc.es5.O/d=1/rs=AJlcJMzXRkGhK1SzoL5mPHKF3E2p3YVyJA/m=kernel_loader,loader_js_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mkP9eaJ0Cc_uGeCZjS-iMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmJw1pBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBwt69afZBN4MP3SQkYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpoaGihZ2AeX2AAAECLNLQ"
content-security-policy: script-src 'report-sample' 'nonce-mkP9eaJ0Cc_uGeCZjS-iMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-kvd6DlsPtFDoJYrrOJIouQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw05Bi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBwt69afZBN40Hd1IaOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjU0NLTQMzCPLzAAAET8NLk"
content-security-policy: script-src 'report-sample' 'nonce-kvd6DlsPtFDoJYrrOJIouQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxXOvGeUYtRnM5yXd-9q-YxgfKW6IV-kdojLOEhkej8xR3p_CLB9PLUzU12YOypqLqC6aprI3hv8vbjD-GcvhglEUYfw1m0dUo9fQxjdvGW7vSqUaJ9EmKrzGuKTpDqHaH5RcAvE1A== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 100ms
91ms Script
application/javascript 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXOvGeUYtRnM5yXd-9q-YxgfKW6IV-kdojLOEhkej8xR3p_CLB9PLUzU12YOypqLqC6aprI3hv8vbjD-GcvhglEUYfw1m0dUo9fQxjdvGW7vSqUaJ9EmKrzGuKTpDqHaH5RcAvE1A==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0NDgwNzcyLDE5ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9yZXVybC5jYy83Yms4ck4iLG51bGwsW1s4LCJZdVB6VnV4NXhuYyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

1b4f701186759a5135c90d4b89282be37f2c6001a3f53a8a2f5379a59fbf4ad1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-uhcopGYY2YqR-d9oUYLMNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJi8NeQYmi9eY51OhB3LTrPOgeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWJ_SZrCRCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwcJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRAPR8u69SfZBB6c-9DMqKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRqaGhooWdgGl9gAADcJUfT"
content-security-policy: script-src 'report-sample' 'nonce-uhcopGYY2YqR-d9oUYLMNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET esp.js
oa.openxcdn.net/ 0
0

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 43 KB
13 KB 1180ms
52ms Script
text/javascript 108.138.128.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-34.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"a01b40a9ecb8db243294facf32753015"
age: 58667
via: 1.1 57eada8217c838cfdc4ec177bbe3523c.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: A41DH1Q-ufCUXo3_2HDLJNuZC5ImEEc4wjDYth3avo9v4uDkJCXlxQ==
date: Sat, 29 Nov 2025 13:15:07 GMT
content-type: text/javascript
last-modified: Thu, 16 Oct 2025 16:30:59 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET encrypted-tag-g.js
invstatic101.creativecdn.com/encrypted-signals/ 0
0

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 3520ms
185ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

67a778f801768d97bfcb66203b1514caee341e49fd334fc7660fa3a3a6ccc852

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
expires: Mon, 01 Dec 2025 05:32:55 GMT
access-control-allow-origin: *
date: Sun, 30 Nov 2025 05:32:55 GMT
content-type: text/javascript
vary: x-geo-country
server: nginx

GET ob.js
cdn-ima.33across.com/ 0
0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 139 KB
48 KB 504ms
503ms Fetch
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=6634617518333578&correlator=1585729833707050&eid=31095252%2C31095716%2C31095821%2C83321072&output=ldjh&gdfp_req=1&vrg=202511120101&ptt=17&impl=fifs&gdpr=0&iu_parts=21787810958%2CTW_reurl.cc_res_all_truvid_1x1%2CTW_reurl.cc_res_allsite_top_avs&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=300x250%7C336x280%7C1x1%2C1x1&ifi=1&didk=3347717449~2825456951&dids=ats-slider-10~ats-insert_ads-8&adfs=2335287240~3992581161&sfv=1-0-45&sc=1&cookie_enabled=1&abxe=1&dt=1764480772233&lmt=1764480772&adxs=15%2C800&adys=33%2C171&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=1%7C2&oid=2&u_his=3&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Freurl.cc%2F7bk8rN%23Politique&vis=1&psz=1570x0%7C1600x0&msz=1570x0%7C1600x0&fws=0%2C0&ohw=0%2C0&a3p=EhwKDWNyd2RjbnRybC5uZXQY-tD_ma0zSABSAghkEhQKBW9wZW54GPrQ_5mtM0gAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRj70P-ZrTNIAFICCGQSGwoMMzNhY3Jvc3MuY29tGPvQ_5mtM0gAUgIIZBIXCghydGJob3VzZRj60P-ZrTNIAFICCGQ.&psd=WzMxLFtdXQ..&dlt=1764480754396&idt=1234&cust_params=url%3D%252F7bk8rN%26ref%3Dnull&adks=3936558959%2C940499867&frm=20&eoidce=1&pgls=CAs.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

e442c1ebd96ba765ac415cb0cb17efffd13e89f87243af7b53deb689f264a2db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: dcb
google-lineitem-id: -1,-2
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1,-2
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://reurl.cc
content-length: 48820
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame CC05 7 KB
3 KB 228ms
76ms Document
text/html 142.250.80.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:32:52 GMT
expires: Sun, 30 Nov 2025 05:32:52 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxVKd3fOQEo3Oau3S0vQ3GrihcWvaQnZWwLiJEceP0vQJwp4X-iu5elLOn2wGgC85RRyY7AVyvcYmndxFUSMKstfbh9bTfyspUxgr0Kp3g8AwEiKisCJFp2_EhYISfxR77A8V07WAA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 86ms
84ms XHR
text/html 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVKd3fOQEo3Oau3S0vQ3GrihcWvaQnZWwLiJEceP0vQJwp4X-iu5elLOn2wGgC85RRyY7AVyvcYmndxFUSMKstfbh9bTfyspUxgr0Kp3g8AwEiKisCJFp2_EhYISfxR77A8V07WAA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tZJyb_uu2JQgxxue7Wha1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmII1pBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPBwt69afZBM4cfn5BkYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpoaGihZ2AeX2AAAF4QNQw"
content-security-policy: script-src 'report-sample' 'nonce-tZJyb_uu2JQgxxue7Wha1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 AGSKWxUOpdnZou9BkdlGL_hWzXgV6qjj3OB1ybl2p5I6k8gqlyVZ_vFx5zVqoUU8tJaHruB6vqUu0vlMhcxiilyOwIlAU_lg9GZ4o-ieVeSWzSaO6ChnjCGDlKH3hKExMHg5Ujm-DZ0BlA== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 91ms
90ms Script
application/javascript 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUOpdnZou9BkdlGL_hWzXgV6qjj3OB1ybl2p5I6k8gqlyVZ_vFx5zVqoUU8tJaHruB6vqUu0vlMhcxiilyOwIlAU_lg9GZ4o-ieVeSWzSaO6ChnjCGDlKH3hKExMHg5Ujm-DZ0BlA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0NDgwNzcyLDMxMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcmV1cmwuY2MvN2JrOHJOIixudWxsLFtbOCwiWXVQelZ1eDV4bmMiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

cba2d90658ffd2cc5f9aa0170424e74f3c73c7a6bd955155a25b23fce88e964d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Dyu0CN4R2wvfnJtczRhtnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:52 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsCoxSXF4KwhxXDi1m2mC0DcevMc63Qg7lp0nnUOEBsqXGJ1BuIP9ZdZfwBxkcQV1hYg_lR1g1Wk-gZrEvtN1hIgNvO7zWoHxNXuXmzNQGzr78PmCsTfin3ZOEp82fb992U7BsR7c_zYjgJxZqcfWyEQr77px7YZiFd4-bNtAGIhHo6WdetPsgnseN-3hVFJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1NDQ0ELPwDS-wAAAkBlMnQ"
content-security-policy: script-src 'report-sample' 'nonce-Dyu0CN4R2wvfnJtczRhtnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 container.html Show response
9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 644C 7 KB
0 1ms
1ms Document
text/html 142.250.80.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s36-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:32:52 GMT
expires: Sun, 30 Nov 2025 05:32:52 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ 273 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 716041efdb4414a3094243ecd3725ea02dd514734d7183e1b746c47b50da5005

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C73F 652 B
257 B 198ms
88ms Document
text/html 142.250.72.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CGUQ78nTAhjonsW_AjAB&v=APEucNXXUdA-xptDGQGM1Ak_zs-YC07U0L8JlMHEOPyqJGb_Tm77n-JywmVViWJr_YSfYRyFTTPFLFz1L6qCog_55uG4aLGyIaoCUXODlZive4l8JZMn5hQ

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:32:53 GMT
expires: Sun, 30 Nov 2025 05:32:53 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 644C 530 KB
106 KB 173ms
57ms Script
text/javascript 23.57.90.112
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: reurl.cc
URL: https://reurl.cc/7bk8rN
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.57.90.112 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-57-90-112.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca73cb9900b7f4a2cc7d5ba2794e4d0a6250f0aff3db3bed8cef9d7eade13ba7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "1be0473f1e61597f490d9491282c5db6"
Connection: keep-alive
Expires: Sun, 30 Nov 2025 05:47:53 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 108421
Date: Sun, 30 Nov 2025 05:32:53 GMT
Content-Type: text/javascript
Last-Modified: Tue, 25 Nov 2025 14:40:41 GMT

GET express_html_inpage_rendering_lib_200_287.js
s0.2mdn.net/879366/ Frame 644C 0
0

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/elements/html/ Frame 644C 8 KB
3 KB 274ms
158ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

d4441ece945f2f14f46d1c462345ee2ba1c2e028e13137da40824116ee90b0f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14517498748587259827
age: 1575
x-content-type-options: nosniff
expires: Sun, 14 Dec 2025 05:06:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 30 Nov 2025 05:06:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3198
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/ Frame 644C 21 KB
8 KB 256ms
152ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20251117/r20110914/abg_lite_fy2021.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11386605814003084292
age: 18998
x-content-type-options: nosniff
expires: Sun, 14 Dec 2025 00:16:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 30 Nov 2025 00:16:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H2 200 VFc2VJAc.js Show response
ep2.adtrafficquality.google/sodar/ Frame 644C 43 KB
14 KB 1491ms
56ms Script
text/javascript 142.251.40.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/7bk8rN

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f1.1e100.net

Software

sffe /

Resource Hash

54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2005
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 05:49:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 04:59:29 GMT
last-modified: Thu, 13 Mar 2025 04:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 14328
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/ Frame 644C 3 KB
1 KB 1282ms
140ms Script
text/javascript 142.251.40.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/window_focus_fy2021.js

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f1.1e100.net

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 19479
x-content-type-options: nosniff
expires: Sun, 14 Dec 2025 00:08:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 30 Nov 2025 00:08:15 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DE0D 1 KB
837 B 153ms
69ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

age: 83465
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 812
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 29 Nov 2025 06:21:48 GMT
etag: 9725182468138058862
expires: Sun, 30 Nov 2025 06:21:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/ Frame 644C 21 KB
9 KB 1211ms
71ms Script
text/javascript 142.251.40.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20251117/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.161 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f1.1e100.net

Software

cafe /

Resource Hash

3539a82b4664c18c51201b6b35a296282250e6cfb16f3355c61d949797c56529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 2622203621575094117
age: 76338
x-content-type-options: nosniff
expires: Sat, 13 Dec 2025 08:20:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 29 Nov 2025 08:20:36 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8688
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 644C 42 B
63 B 259ms
161ms Image
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CCH_YP5OHICdJyUORjVNzggsP3ofpL68idjShtC1zui6VCvBchr46msVtBII2vGTEiLRXsKFpg_Ot3oLjOJLD-8lv1UH2Nx5qpLc2U3YVzs4hVFqE

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET l
www.google.com/ads/measurement/ Frame 644C 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 644C 223 KB
69 KB 225ms
128ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

1ca0d5744e4f39ea464be06f38e214eabd97b2ca934e919a3673f0a62f76368c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11779502037942753168
age: 3300
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 05:37:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 30 Nov 2025 04:37:53 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 70282
x-xss-protection: 0
server: cafe

GET
H3 200 peel.js Show response
fundingchoicesmessages.google.com/f/AGSKWxX86T4QWqglmC3mnBc_d78tGxGxoj1z1yOcCA0oaWyRa17Y17XYOZKGr0q2y1mkRoOlWcqLdeRTUrsGj5zdfSdZvh-0TStPp2mh1OqrDSDHwtKwqzflXd0LR93tS4SJZXaUmUGZYFtX_4MngeNIA9VOGbdHi... 54 B
109 B 82ms
80ms Script
application/javascript 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX86T4QWqglmC3mnBc_d78tGxGxoj1z1yOcCA0oaWyRa17Y17XYOZKGr0q2y1mkRoOlWcqLdeRTUrsGj5zdfSdZvh-0TStPp2mh1OqrDSDHwtKwqzflXd0LR93tS4SJZXaUmUGZYFtX_4MngeNIA9VOGbdHiInQgN8LyToG2lJSsLQvRWBGuQ-foFLD/__438x60_/adbar_/rawtubelivead./contextads./peel.js

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.YuPzVux5xnc.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMzXRkGhK1SzoL5mPHKF3E2p3YVyJA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

c795c6a488ad463d7bba940565dcecd7643c2def513f1b45596e458f2f4632fd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-c9NCsMDo--u8HiwoJoHoJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjmsCoxSXF4KAhxdB68xzrdCDuWnSedQ4QGypcYnUG4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiA287vNagfE1e5ebM1AbOvvw-YKxN-Kfdk4SnzZ9v33ZTsGxHtz_NiOAnFmpx9bIRCvvunHthmIV3j5s20AYT9_th1ALMTN0bpu_Uk2gY4dc3WUNJLyC-OT8_NKijKTSkvyi9KS01KLU4vKUovijQyMTA0NDS30DEzjCwwAqfhJYQ"
content-security-policy: script-src 'report-sample' 'nonce-c9NCsMDo--u8HiwoJoHoJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 256 KB
80 KB 179ms
57ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.YuPzVux5xnc.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMzXRkGhK1SzoL5mPHKF3E2p3YVyJA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

82a247f672adb559f24d58f05099def66a04e408f4bcdd846d616bc09b23ca17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: br
etag: 7390385033211318415
age: 2671
x-content-type-options: nosniff
expires: Sun, 30 Nov 2025 05:48:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sun, 30 Nov 2025 04:48:22 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 82356
x-xss-protection: 0
server: cafe

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-J1dnK7o8nq5DZdqFGME17w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmJw0ZBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRC3Byt69afZBNY8fmJrpJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyNTQ0tNAzMI8vMAAAFC80dg"
content-security-policy: script-src 'report-sample' 'nonce-J1dnK7o8nq5DZdqFGME17w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame C73F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1&gdpr=0&C=1

43 B
304 B

77ms
73ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CGUQ78nTAhjonsW_AjAB&v=APEucNXXUdA-xptDGQGM1Ak_zs-YC07U0L8JlMHEOPyqJGb_Tm77n-JywmVViWJr_YSfYRyFTTPFLFz1L6qCog_55uG4aLGyIaoCUXODlZive4l8JZMn5hQ
Protocol: H2
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=z3ffVwqboNtVbz%2B42AdIvUrrGegfnQ%2BgMwkqJlhUym7g5JrXRo7%2BcwhRcj%2FcXCqlzewe7VZS1p9eJIi1UTS4vOFJkuWqUbwh6Sc2VsrOkM%2F9eNbesOik"}]}
cf-ray: 9a67f781cd34b400-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: image/gif
vary: accept-encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1&gdpr=0&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sI7mg530HZmrnfnN4A1hz0e%2B3Vkvy53rij1nA2caPsMiQltXeC8VsJ1tjIMFhn1%2FHrv9tZDvYFOcYBHy6fvqlhhbbNKgzn9kBRX%2FF69kJQWhwJwAEO4g"}]}
cf-ray: 9a67f7814cd4b400-YYZ
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sun, 30 Nov 2025 05:32:53 GMT
vary: accept-encoding
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C73F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aSvXBdHM6zwABJ12Ak9TgQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1

43 B
753 B

71ms
70ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CGUQ78nTAhjonsW_AjAB&v=APEucNXXUdA-xptDGQGM1Ak_zs-YC07U0L8JlMHEOPyqJGb_Tm77n-JywmVViWJr_YSfYRyFTTPFLFz1L6qCog_55uG4aLGyIaoCUXODlZive4l8JZMn5hQ
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LsEZ1ZIcDN5EJLs28b98G58Anz9ukTOzC9q8hdWEwZi2DSlQlIhorjqtHWPD7B7GlORUa%2BlyCgbIrlZWXLG%2FTtc6qLdeSDfTk%2BO1vr6ri6DShzDyfD0p"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: image/gif
vary: accept-encoding
priority: u=2,i
cache-control: no-cache
nel: {"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
pragma: no-cache
cf-ray: 9a67f782a964f00c-YYZ
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK-_9keRSuChJhx3Mk8vEh8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bounce
ib.adnxs.com/ Frame C73F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEJa99m5Ogcb7tNJ-awfEd6U&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEJa99m5Ogcb7tNJ-awfEd6U%26google_cver%3D1

43 B
1 KB

47ms
45ms

Image
image/gif

68.67.160.76
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEJa99m5Ogcb7tNJ-awfEd6U%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CGUQ78nTAhjonsW_AjAB&v=APEucNXXUdA-xptDGQGM1Ak_zs-YC07U0L8JlMHEOPyqJGb_Tm77n-JywmVViWJr_YSfYRyFTTPFLFz1L6qCog_55uG4aLGyIaoCUXODlZive4l8JZMn5hQ

Protocol

Server

68.67.160.76 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.25.5 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 86.106.90.214; 86.106.90.214; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a55e88d4-0779-4f3a-b593-66d6cfcdc088
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.25.5

Redirect headers

cache-control: no-store, no-cache, private
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26gdpr%3D0%26code%3DCAESEJa99m5Ogcb7tNJ-awfEd6U%26google_cver%3D1
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 86.106.90.214; 86.106.90.214; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 9475fddd-6882-4be8-8a5e-9900c4ba0c1d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C73F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D%26gdpr%3D0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAxMTQ3NjEyNzk4OTExNTI5MQ%3D%3D&gdpr=0

170 B
188 B

77ms
75ms

Image
image/png

142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAxMTQ3NjEyNzk4OTExNTI5MQ%3D%3D&gdpr=0

Requested by

Protocol

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODAxMTQ3NjEyNzk4OTExNTI5MQ%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 86.106.90.214; 86.106.90.214; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 17fb08a5-68eb-4f10-aab4-3d9d6e16aa2c
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.25.5

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-W756CnvKONKmCzl7uODrAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmJw15Bi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRC3Byt69afZBO4cfp7sJJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyNTQ0tNAzMI8vMAAAKDY0ug"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-W756CnvKONKmCzl7uODrAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET verify.js
rtb0.doubleverify.com/ Frame 644C 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DE0D
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESENa1h98yEGHvDaxUxuVoduw&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjY2ZjlmOWYtNmM3Ny00ZWZjLTgyZTItZTZjYzNiNjEwMmVl&google_gid=CAESENa1h98yEGHvDaxUxuVoduw&google_cver=1&google_push=AXcoOmQn...

170 B
188 B

84ms
83ms

Image
image/png

142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjY2ZjlmOWYtNmM3Ny00ZWZjLTgyZTItZTZjYzNiNjEwMmVl&google_gid=CAESENa1h98yEGHvDaxUxuVoduw&google_cver=1&google_push=AXcoOmQn90lO3A2M9e94vvLG1dq-QI0Z4fUocIIOMhL6BlPlMLV6LSithRKKg4fFFUi8jw1O1avko_kgtkEt54ODklGChSsgs1N6lw

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sun, 30 Nov 2025 05:33:01 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZjY2ZjlmOWYtNmM3Ny00ZWZjLTgyZTItZTZjYzNiNjEwMmVl&google_gid=CAESENa1h98yEGHvDaxUxuVoduw&google_cver=1&google_push=AXcoOmQn90lO3A2M9e94vvLG1dq-QI0Z4fUocIIOMhL6BlPlMLV6LSithRKKg4fFFUi8jw1O1avko_kgtkEt54ODklGChSsgs1N6lw
content-length: 0
date: Sun, 30 Nov 2025 05:33:01 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DE0D
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmR9Wh...
https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1DM280OFd0RnVGb0NzQnBwRjVzeGtYdkF5LXlxclVncHpwblcydw&google_push=AXcoOmR9WhS9su5_B2Yf2pl2TqJeKTUyANixeR0V0cZEB9e_xlcjRidPOD8-OrEqDuRaFj...

170 B
188 B

96ms
94ms

Image
image/png

142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1DM280OFd0RnVGb0NzQnBwRjVzeGtYdkF5LXlxclVncHpwblcydw&google_push=AXcoOmR9WhS9su5_B2Yf2pl2TqJeKTUyANixeR0V0cZEB9e_xlcjRidPOD8-OrEqDuRaFjpGJSKtcOvWwjQWSCPRk2_99hvFTSfcFA

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_hm=ay1DM280OFd0RnVGb0NzQnBwRjVzeGtYdkF5LXlxclVncHpwblcydw&google_push=AXcoOmR9WhS9su5_B2Yf2pl2TqJeKTUyANixeR0V0cZEB9e_xlcjRidPOD8-OrEqDuRaFjpGJSKtcOvWwjQWSCPRk2_99hvFTSfcFA
pragma: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1181251
expires: Sun, 30 Nov 2025 00:00:00 GMT
x-errorlevel: 0
content-length: 0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
date: Sun, 30 Nov 2025 05:32:52 GMT
server: Kestrel

GET sync.php
pixel.rubiconproject.com/exchange/ Frame DE0D 0
0

GET us
sync.go.sonobi.com/ Frame DE0D 0
0

GET ebda
eb2.3lift.com/ Frame DE0D 0
0

GET rtset
bh.contextweb.com/bh/ Frame DE0D 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DE0D
Redirect Chain

https://www.temu.com/api/adx/cm/pixel?google_gid=CAESEDsTdIgRO0DabIk8px73jWY&google_cver=1&google_push=AXcoOmSe2ubOHonRbnd9D4-MFL_2aWLyRDDED6jWFba8ZcIVnKYOelTM0Ro5-GwVXaskklMWCuQjg36BGx0rfi1DnDRvJt...
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSe2ubOHonRbnd9D4-MFL_2aWLyRDDED6jWFba8ZcIVnKYOelTM0Ro5-GwVXaskklMWCuQjg36BGx0rfi1DnDRvJt-_u3yFjRw&google_nid=whaleco_services_llc

170 B
188 B

82ms
81ms

Image
image/png

142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSe2ubOHonRbnd9D4-MFL_2aWLyRDDED6jWFba8ZcIVnKYOelTM0Ro5-GwVXaskklMWCuQjg36BGx0rfi1DnDRvJt-_u3yFjRw&google_nid=whaleco_services_llc

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sun, 30 Nov 2025 05:32:54 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1764480774464|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSe2ubOHonRbnd9D4-MFL_2aWLyRDDED6jWFba8ZcIVnKYOelTM0Ro5-GwVXaskklMWCuQjg36BGx0rfi1DnDRvJt-_u3yFjRw&google_nid=whaleco_services_llc
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1764480774464-00006309830895360000000013539784-20
cip: 86.106.90.214
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Sun, 30 Nov 2025 05:32:54 GMT
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DE0D 0
12 B 71ms
68ms Image
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IKpdF4c28_JFqK2nCtH8MEYPh2ND6XEqDSZw4j6L-ZGv_7bHn8eWNiOxDYskumxsVIXAdL3V4

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sun, 30 Nov 2025 05:32:53 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 140ms
78ms Fetch
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202511120101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga34s37-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-GC8TUFuI8WZitZKas3LZ6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmLw1ZBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPByt69afZBOY8e7rDkYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpoaGihZ2AeX2AAAFr9NQg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-GC8TUFuI8WZitZKas3LZ6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWjJsoZkwE_PimaGn8AefrYcRT8I8GsgyT_5EDt46ZkcMXaYP-W06IEgM_AqCZ8qVenZtdfKmTIhzW7mzFgykQojkHSE0en-s_vTV_vpHJ_bn2zqI2tI--m0a3EgWjHPslMTDQdog==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-qwAl56pbpwCQR1WLUyNQNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmII1pBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPByt69afZBNYseXkLkYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpoaGihZ2AeX2AAAEZNNLo"
content-security-policy: script-src 'report-sample' 'nonce-qwAl56pbpwCQR1WLUyNQNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxXAE_VGduPM7wTJNLqC_1I6VZ9j23J4dc2o5sqXmBK3_0ZagsZXJCeT18fKJvLhM-5e2_4GeWDgpjGAkacMcPwTj3WLFcWSHP5y5dc8tK5lW9_5-L6L6ge1Y71EF_YCjOPhtcQIHQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 88ms
86ms Script
application/javascript 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXAE_VGduPM7wTJNLqC_1I6VZ9j23J4dc2o5sqXmBK3_0ZagsZXJCeT18fKJvLhM-5e2_4GeWDgpjGAkacMcPwTj3WLFcWSHP5y5dc8tK5lW9_5-L6L6ge1Y71EF_YCjOPhtcQIHQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzY0NDgwNzczLDMzNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9yZXVybC5jYy83Yms4ck4iLG51bGwsW1s4LCJZdVB6VnV4NXhuYyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

1b0f332b4886177235d6d6fdbfe2b9a8690d4905f02c30ed676fc04687e1ce2d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TjEpztgWhgexQQOVEBr-RA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://reurl.cc/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzj6mDU4pJiCNKQYmi9eY51OhB3LTrPOgeIDRUusToD8Yf6y6w_gLhI4gprCxB_qrrBKlJ9gzWJ_SZrCRCb-d1mtQPiancvtmYgtvX3YXMF4m_FvmwcJb5s-_77sh0D4r05fmxHgTiz04-tEIhX3_Rj2wzEK7z82TYAsRAPR-u69SfZBBZsu7OXUUkjKb8wPjk_r6QoM6m0JL8oLTkttTi1qCy1KN7IwMjU0NDQQs_ANL7AAADU8kel"
content-security-policy: script-src 'report-sample' 'nonce-TjEpztgWhgexQQOVEBr-RA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
611 B 57ms
53ms XHR
application/json 52.204.123.3
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://bcp.crwdcntrl.net/6/map?xcid=16589

Requested by

Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.204.123.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-204-123-3.compute-1.amazonaws.com

Software

Resource Hash

d70f437c1e2945867649d590022f0305df19875909167a1359ce20bbbcbd9958

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://reurl.cc/

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://reurl.cc
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: application/json;charset=utf-8

POST
H3 204 AGSKWxW-2y7AszxrHMM6VsJMNm_ZUmdqJUzxxbFvIx2f6jq22M8QndyplPPB6GERnzvCO0Gj3wGxj7lZqZdbAE-36qmt0CfmNJBqklyEiZ_FQ6-s_JUoTIu_oh-46uvpqEeQEkteeCBwoQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 68ms
68ms XHR
text/html 142.250.80.78
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxW-2y7AszxrHMM6VsJMNm_ZUmdqJUzxxbFvIx2f6jq22M8QndyplPPB6GERnzvCO0Gj3wGxj7lZqZdbAE-36qmt0CfmNJBqklyEiZ_FQ6-s_JUoTIu_oh-46uvpqEeQEkteeCBwoQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3feuVePB4ofvl-N3Ed4wbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://reurl.cc/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 30 Nov 2025 05:32:53 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjctDikmII1JBi-FB_mfUHEJv53Wa1A-Jqdy-2ZiC29fdhcwXivTl-bEeBOLPTj60QiFff9GPbDMRCPByt69afZBO4sL3jKaOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjU0NLTQMzCPLzAAAEtSNM0"
content-security-policy: script-src 'report-sample' 'nonce-3feuVePB4ofvl-N3Ed4wbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://reurl.cc
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 644C 0
0 89ms
86ms Fetch
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 30 Nov 2025 05:32:54 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 644C 0
0 82ms
81ms Fetch
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 30 Nov 2025 05:32:54 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 644C 217 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a98e78ab91454e26b8d1fccca5b1dd582745827c4a1839934b7684d8dea42d59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 644C 0
0 77ms
77ms Fetch
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 30 Nov 2025 05:32:54 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 Klz6NWr5.html Show response
ep2.adtrafficquality.google/sodar/ Frame CD64 35 KB
12 KB 54ms
52ms Document
text/html 142.251.40.193
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f1.1e100.net

Software

sffe /

Resource Hash

2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1934
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 12007
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:00:40 GMT
expires: Sun, 30 Nov 2025 05:50:40 GMT
last-modified: Thu, 13 Mar 2025 04:28:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 _sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js Show response
ep1.adtrafficquality.google/bg/ Frame CD64 53 KB
20 KB 134ms
59ms Script
text/javascript 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/bg/_sfiGRWlcmmPZw-MhEAWYL4c1o1z8W5Cy8UFy-j49wg.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

sffe /

Resource Hash

fec7e21915a572698f670f8c84401660be1cd68d73f16e42cbc505cbe8f8f708

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 361883
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 26 Nov 2026 01:01:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 26 Nov 2025 01:01:31 GMT
last-modified: Tue, 18 Nov 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20897
x-xss-protection: 0
server: sffe

GET
H3 204 gen_204
ep1.adtrafficquality.google/pagead/ Frame CD64 0
20 B 88ms
87ms Image
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar&v=46&t=2&bgai=BKoo4BNcrabiXFvDO6toP85XpgQkAAAAAOAHgBAI&bg=!xMelx4jNAAZKVVKRalU7ADQBe5WfODx5F-cgLVKoCBxUTOgev3hlRuOU5V3y9ksmqtqF25isdhDFkneu1YyviEWvSNFWAgAAAHhSAAAABGgBB34ANVydy3ZgIDYnNJfqISZ8VXYUVPkgXZwXyS9EPUz-anVwefCb_bAynb4scnijYnIRnV3Rn1STCgAfWR1HS8ajffscWNOmMdhmd8X4ELL3upUR3tpQ_tIOd5kCnJfkVWKEf0F1GYFST5KBJbHzxHubV2k4IIxrsHExTsF-8Bu3Rbt-bLv7TH14cxyCwO7NWyFAIFMThNyabgq3ExWIRUK2W0Tc0SPB1vxDzyE3w3tsxUJO2KD-bnxMC6Z-Zntj1NqQCGPgBxm9HThDgxcECjxhMTbzXUD7DkzYq1LFuqs7O0bRKaEleaK8wAT5lwerWxi7hdyUN3b2RlvPKeMESeyH54-NQrJ1MB413-fvFzCf_vhqK-B6Kzn2oyS8vrtvhCGTsy1m6mfQe9uIJ4yosR8lpsKSmKw_q8OrAXZ5Me_IfLHspB7LxaF-QDh3uWbI1vIMHIIufujfsHhgOEJiaxeHXWdmxpc9iNuVVGWOY6tZD0RNbfAodJZXmliqOgmMvYARMT-8OtbLqePhCvCoC_YaoEUn7Q0Lp-EqNC16cbg-Q8sPC37bezZUEb8G83MEyZGaL39qy8JBwbuDHxDFl0Og9mBkupn9WZCSc9p-RRl7Lud4sNonXCXE4l-yGnjlry1WvCfeKK_xP4mm-sDoozuu62ySlprCFPg6v4zbQrejc1hOPey3B0hrpZGWT96lG-vVjdfIuUV1v6-6WRAVxlhQxtjUeoHH5kqX9-qLawdDjgF2GdV1SezfVOQpbvOTCFE6V31IDXM12JvWuxqpAKVNHS__b2-JwZ5vrYxwY9eClCVkPY2K_xkwvKaZ8OPpHGvNu29UZVw15cs6Ipmv2FrbOtDMv-zDC7aZDzF2pw4JMYnmAk8VHo0zuICtcIpagKQGvw9jtA5F0eX3uot2FXM_m-Mgjd9YsOuGb8m1faQ5vrOZpyY7ISdspBDURUVw0RsvKc3xxY-u-Yc4fVfjaG8FO1a_Tdd70XVvES2nT3eZpUhkmGUAIgLr

Requested by

Host: 9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
URL: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sun, 30 Nov 2025 05:32:54 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 644C 42 B
65 B 102ms
100ms Fetch
image/gif 142.250.176.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstNLRhulY2XzzaB1AwuKl2ptLTH66dMOu2SCIMyen0zktdbKnpsEcrDmIeaHTSUVB0fc8mclBEJwrLR69RBapeJQ1iXF87YMx0HjMU0_7UVqaPnDgf_DKKh4uCARTo0w0NY_PCaZpZTYEC03uOJtLFcjdoOr5JjJ5dWctKNMoUnfCaxweQTi2FihFWx1rMo-WLf5feL_S2Rbl8f-9GV&sai=AMfl-YSbR3Do0DSeqqRxmbPelZNIfh4gOkTkE8ZKfARv3U4KTsGZw3cUGXRjOyv_yQl_RDJqaOj4zLMoZPwqUgijCJYpHvUsxebvlsLwOUvq8Sdb4iUFFyVu1mE2yW03OYmX_45fdU51yIfl5YZFKWq3qac92Dg5-LNzN4qeCq1I-7T81b4nd5XPoQZWGUlCJdUaw8CZ3v21zFx9ArpTSbmGNsdqPXIKJEzCaRzkSHWFRTEaNVaia7CgbcEJpQJrBHWPhox-Cnk&sig=Cg0ArKJSzMAkrI67f3_uEAE&cid=CAQSoAEAwksa0YIznuHJ2LBr-rwS2tklCgQwAL3us34gg4thIxwWPpXSsxurn-NoRqtDIwMy0zG2MclhGL_M67KoSXW2wKIQWqws-ixCdRNwefKmZjnfu_Wd4Dda78y0PF9i-r37GU9ioECvAvgP7llGWf84YtfQUv37lZVmsrfnZp-XfV8O4_Gd3iQIo7ErbEJFdT0C2DvBbus2sfOQbPRUZ865GAE&id=lidar2&mcvt=1000&p=997,10,1247,310&tm=1028.099998474121&tu=28&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20251105&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3936558959&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=6041357400&rst=1764480772808&rpt=1452&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sun, 30 Nov 2025 05:32:55 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 512F 15 KB
6 KB 3375ms
114ms Document
text/html 74.119.117.62
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

dac56831476fb5f3f2c40c74e494002b792f5797910296d14c354be48995e136

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://reurl.cc/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Nov 2025 05:32:59 GMT
server: Kestrel
server-processing-duration-in-ticks: 669992
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 4D45 46 B
227 B 3650ms
431ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=en-CA&ht=1764480777355&evtid=403ff84f-f2c9-4986-ac2d-48122e2d663e&tid=5&cid=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 09585355f53e08ec6d7ffa4d1bf783d5d08af046c3bd9251b0b5b965e9e4cca4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:00 GMT
x-cloud-trace-context: c29d1d1021a3646b9a377af6206e19a6
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame CFEB 46 B
418 B 3502ms
285ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=en-CA&ht=1764480777358&evtid=a13ceb60-930a-4f11-9dd8-e8f7f813dcdd&tid=5&cid=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: ec24975f4b89df691cfc7d6779e1e2f062521c1af6537f76b7aa172a8e609e65

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:00 GMT
x-cloud-trace-context: 8ca35a6ae1d5e9f69a377af6206e1993
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame 54C6 46 B
227 B 3583ms
368ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=en-CA&ht=1764480777360&evtid=978863d2-86e9-424c-ba31-8634942c4710&tid=5&cid=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 81d6bbf98766c014149ca92b1db896bff1e6a4ee5a311254184587f74533d74d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:00 GMT
x-cloud-trace-context: c5f813fb8ad6afbe9a377af6206e10de
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame AE7E 46 B
227 B 3583ms
368ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=en-CA&ht=1764480777361&evtid=03f3e701-4f58-40ed-82d2-53c8a70fec8a&tid=5&cid=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 91eb03e1676300edaf13dd35ded98ff9b4a62b27c2ce47c58f85c7aa44c76508

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:00 GMT
x-cloud-trace-context: e06477c2f49722ca9a377af6206e1542
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 collect Show response
track.91app.io/ext/v1/ Frame C651 46 B
227 B 3582ms
370ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/collect?v=1&ch=web&ul=en-CA&ht=1764480777362&evtid=d543f9f7-aa3f-4cb6-ae48-bfe06de6824e&tid=5&cid=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&evtn=pixel
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: e21a8fe77107729338cc7eb1a5dba53b530d7289a9b0563372e0a077ca830fcb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:00 GMT
x-cloud-trace-context: ab3249aa548c88309a377af6206e1c8d
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 did Show response
track.91app.io/ext/v1/ Frame 4D45 46 B
228 B 3450ms
365ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: ea83707c446590a401656b6fbf33c33ae0afeecd22e669c3cfaca67fadb6145f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:00 GMT
x-cloud-trace-context: b02d8c2fd786757b9a377af6206e1df7
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 did Show response
track.91app.io/ext/v1/ Frame CFEB 46 B
227 B 3645ms
279ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 5b4c3cdeb28d06d429cf100856d93896536a2720b8a94b0687a90797d82fd5ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:01 GMT
x-cloud-trace-context: bce9b048fc5cd18b9a377af6206e1cff
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame 54C6 46 B
66 B 3784ms
223ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 720c8fed042ab770d2ced55408d82f2fd5a47dde5f3f37098d68e60eeb41ea74

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:01 GMT
x-cloud-trace-context: 4d5987c37e710a1c2e80fec6b9470d84
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame AE7E 46 B
66 B 3916ms
273ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 2b61d16af7f9b1e4cecad14e2c6422e832f6937aadb41c7d2abdba44fb9a4b8b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:01 GMT
x-cloud-trace-context: add21eb60a7cd28c2e80fec6b9470bc7
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H3 200 did Show response
track.91app.io/ext/v1/ Frame C651 46 B
66 B 4067ms
256ms Fetch
application/json 35.201.76.198
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://track.91app.io/ext/v1/did
Requested by: Host: tracking-client.91app.com
URL: https://tracking-client.91app.com/1.2.0/nineyi.tracking.client.iife.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.201.76.198 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 198.76.201.35.bc.googleusercontent.com
Software: Google Frontend / Express
Resource Hash: 47fb55898bb404427fc15426475fce1ee6ef8be9d7354dcfb4e3558a09a1de25

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://cdn.holmesmind.com/

Response headers

cache-control: no-cache
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://cdn.holmesmind.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46
date: Sun, 30 Nov 2025 05:33:01 GMT
x-cloud-trace-context: 293d3d8de7a5ad632e80fec6b9470a11
content-type: application/json; charset=utf-8
x-powered-by: Express
server: Google Frontend
vary: Accept-Encoding

GET
H2 200 json Show response
gum.criteo.com/sid/ Frame 512F 422 B
914 B 53ms
53ms Fetch
application/json 74.119.117.62
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=publishertagids&domain=reurl.cc&sn=ChromeSyncframe&so=3&topUrl=reurl.cc&bundle=37Zmyl9MV3RWem1MUnhFM0NranhjY2l5OEJJJTJGUUdPUG9xWTZqUUViSnBLbzk5aEVsQjYzUjlPYTN0ZFRiTFhza01ZT1RSMk1SdGVFRzFPMzhzQmtsYWRoanExcldaZ3VEQXFxYUc1UmcycWlET01DSmdHZEpYTFJPVERiJTJCSkJGM1RHZnIlMkZUa25DVmNDWUFIQXhzYkRGaWp6WlElM0QlM0Q&topicsavail=1&fledgeavail=1

Requested by

Host: gum.criteo.com
URL: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.62 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b7e4fb85f556dee40b9c61e822b194ab8a35d2ed2d56568445838bb0bfa6c3b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=reurl.cc&gdpr=0&gdpr_consent=

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
server-processing-duration-in-ticks: 981871
expires: 0
date: Sun, 30 Nov 2025 05:32:58 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET cm
ad.holmesmind.com/adserver/ Frame 4D45 0
0

GET cm
ad.holmesmind.com/adserver/ Frame CFEB 0
0

GET cm
ad.holmesmind.com/adserver/ Frame 54C6 0
0

GET cm
ad.holmesmind.com/adserver/ Frame AE7E 0
0

GET cm
ad.holmesmind.com/adserver/ Frame C651 0
0

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 644C 29 B
344 B 697ms
87ms Fetch
text/javascript 34.117.228.201

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=1&ee_dp_ctx=3886119&ee_dp_cmp=33746413&ee_dp_plc=425599211&ee_dp_sid=5775970&ctx=818052&cmp=1619415&dvp_isLostImp=1&ssl=1&gdpr=&gdpr_consent=&ver=9023&cerrt=2
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 242790a1bbb9b44ddd847db109e997631cf452ab6d74cb97dfd9cae3395c9e3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 0
Expires: 11/29/2025 05:33:06
Date: Sun, 30 Nov 2025 05:33:06 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 644C 29 B
344 B 457ms
99ms Fetch
text/javascript 34.117.228.201

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=1&ee_dp_ctx=3886119&ee_dp_cmp=33746413&ee_dp_plc=425599211&ee_dp_sid=5775970&ctx=818052&cmp=1619415&dvp_isLostImp=1&ssl=1&gdpr=&gdpr_consent=&ver=9023&cerrt=512&cemsg=AdRenderedUponVerifyFailure__VFTL
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 242790a1bbb9b44ddd847db109e997631cf452ab6d74cb97dfd9cae3395c9e3e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer: https://9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 0
Expires: 11/29/2025 05:33:06
Date: Sun, 30 Nov 2025 05:33:06 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: gocm.c.appier.net
URL: https://gocm.c.appier.net/apnet?url=ad2.apx.appier.net%2Fv1%2Fprebid%2Fbid

Domain: img.racingcharger.tw
URL: https://img.racingcharger.tw/wp-content/uploads/2025/11/2025112917574367.jpg

Domain: mma.prnasia.com
URL: https://mma.prnasia.com/media2/2826383/Logo.jpg?p=medium600

Domain: creditcards.com.tw
URL: https://creditcards.com.tw/wp-content/uploads/2025/08/%E6%97%A5%E6%9C%AC%E9%9F%93%E5%9C%8B%E6%8E%A8%E8%96%A6%E9%AB%98%E5%9B%9E%E9%A5%8B%E4%BF%A1%E7%94%A8%E5%8D%A1-1080x630.jpg?crop=1

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v5/yy/l/0,cross/yPX6-M9P-xt.css

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yh/r/YwXP_-ww9iI.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yl/r/SaX6oTFSjNg.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yd/r/atv-3qMDl2i.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4izx64/y4/l/en_US-j/hM4SycfTajT.js

Domain: static.xx.fbcdn.net
URL: https://static.xx.fbcdn.net/rsrc.php/v4/yx/r/v_kkAv_-wGQ.js

Domain: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js

Domain: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js

Domain: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ob.js

Domain: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_287.js

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ2tAjWQqn4Z0z6KhxFuUef1nmx4AZZekSCwW87rCSDTl9DFfZrhMijUxy-FvcBCYNba44hUQLIjfH85qK1xB0GxYq1Wg

Domain: rtb0.doubleverify.com
URL: https://rtb0.doubleverify.com/verify.js?ctx=3886119&cmp=33746413&sid=5775970&plc=425599211&crt=243874856&advid=9683519&adsrv=1&mon=1&blk=1&cawf=crtwrp&cm360cw=1&unit=300x250&prr=1&turl=https://reurl.cc/7bk8rN&aucmp=22801025973&auevent=ABAjH0g53QdzDnaifulRxWDUOo-j&autt=1&ppid=103&aucrtv=670125928&auorder=1022097983&pltfrm=1&ausite=449233607217&auxch=1&aufilter1=Insert_SeatID_Here&c1=Insert_SeatID_Here&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=-1&brid=96&bridua=3&brver=&brh=3&vavbkt=&lvvn=28&fcifrms=18&winh=250&winw=300&chro=1&noc=16&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=9023&uid=1764480773186303&srcurlD=0&ttfrms=70&num=6&dvp_isOnHead=0&flvr=1&ver=9023&jsCallback=__verify_callback_1764480773186303&jsTagObjCallback=__tagObject_callback_1764480773186303&ssl=1&prndr=1&m1=96&blkmode=2&ee_dp_rdystreq=loading&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=319247636.64315134&ee_dp_sukv=319247636.64315134&dvp_tukv=208829156481.11777&ee_dp_tukv=208829156481.11777&dvp_strhd=1.4000015258789062&dvpx_strhd=1.4000015258789062&eparams=DC4FC%3Dl9EEADTbpTauTauC6FC%3D%5D44TauU2%3F4r92%3A%3Fl9EEADTbpTauTauC6FC%3D%5D44Tar9EEADTbpTauTauh3hh_e%60a323ee%6074_g6d6b4e3chcha_d%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3EU2%26C%3Dl9EEADTbpTauTauC6FC%3D%5D44Tauf3%3CgC%7D&referrer=https%3A%2F%2F9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html

Domain: pixel.rubiconproject.com
URL: https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_push=AXcoOmQ-OgVbTO3cpx3-Op7-155R_wOr3KLWTC_2t-LGXoh5yoghBFcfViQV-CHt8eXLKWUvknT7apYukHjfz2dD7x5TUu0097Yn&google_gid=CAESEHKw5pZbSrRmUysXT9gQRfo&google_cver=1

Domain: sync.go.sonobi.com
URL: https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAXcoOmTWm4AJPnizp4KF9afZhLt416KTGA3BjdMhud59Ea0Delq7WPtVt2xc9OWmcb5b7T_UUgrsn91ETz64go16STS83CP7iFeDeA%26google_hm%3D%5BUID64%5D&google_gid=CAESEEcyBUX3qr_fGsN9BjyQTo8&google_cver=1

Domain: eb2.3lift.com
URL: https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEJCNcs8RJac5nZcnecc6rNg&google_cver=1&google_push=AXcoOmTMSUZGE_-_xx8jbiSDndv3_kJCispG2aliU3m5EwSWJOtmWgARBo-PJay38fihSWKqvH4Mzm-let089QaAxBl79H_DZlR3NA

Domain: bh.contextweb.com
URL: https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_gid=CAESEFCzLW_oC88xfT3haplremc&google_cver=1&google_push=AXcoOmRZndz4wlhpkFOKoDZFya6rg3A407bn4mbBRQ4StJqJhTwdIhGPcstzXUk7CF0fQ5W8xgQyDOMJv5bMDx-UZxL7WE_UV33Smdw

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&uid=040f81c1-2c48-4823-8369-954b03d645d2

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&uid=9516c6f0-ee87-4ef8-b392-e7e6fa885fc8

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&uid=e4c0c624-02c3-4594-9395-57436d837d0f

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&uid=a0ac51d4-d222-49ac-84dc-d3a018a12aff

Domain: ad.holmesmind.com
URL: https://ad.holmesmind.com/adserver/cm?app=91app&P=722255-gia8ByWVB70N82PsqkkD99X68SLixy1e&uid=2d002284-d7cf-47f7-a324-6b2bf0027182

Verdicts & Comments Add Verdict or Comment

210 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

56 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
web.alipearlhair.com/	1970-01-21 10:08:07	Name: XSRF-TOKEN Value: eyJpdiI6Ik5tMjJyYmV1bWVQam1UNmxjdmFBZHc9PSIsInZhbHVlIjoiRU5OcmRpNURKM043OWhLbkpYVTVPOXlOVnNHajZldk5rZDhxQ2NTR0Q4djBMdnp5TDJxZEJuVkVzXC9tZURWbGluVTFKTWl0cUJjSXRibzhxcTl2VDRBPT0iLCJtYWMiOiIwNmQzZGM2ODA0YmVkYWYyN2QwNjhhODBjYmJiMjFlN2EwOGY4Yzg4MjgyNjRhYzA3MTEzY2MzYzkzM2VlMmJlIn0%3D
web.alipearlhair.com/	1970-01-21 10:08:07	Name: laravel_session Value: eyJpdiI6Ikp2ZWcwdFlYYkpOQ2paWWRBNTVZc1E9PSIsInZhbHVlIjoia1hCczJxMXM5b2NYZkdkQnpFenpcL2FjbzRoSDUyQlFEaWR0V0d6T1JmT3RqejRxZWJyQzUzamF1ZGtXcFwvTkxENGJZZTk2UVB4YmlpVVwvSm96YWVhVkE9PSIsIm1hYyI6IjhhNGJiNDJkYmNmYTI2YWM4MTM3NzA5NjEzNDYwYTk3YWE3NjFiZDcwNTY0NjQ5MjE0ZTk3MzNkMmFlZjYyOWYifQ%3D%3D
.reurl.cc/	1970-01-21 10:51:12	Name: ISMD5VERSION Value: 1
.reurl.cc/	1970-01-21 10:51:12	Name: CFFPCKUUID Value: 5877-HV71zhtcHksmauOfPVXt6PzhUwgSBm7M
.reurl.cc/	1970-01-21 10:51:12	Name: CFFPCKUUIDMAIN Value: 4227-jEYK1ms1qIDpsteD4sb96tqg7LmVUY2T
.reurl.cc/	1970-01-21 10:51:12	Name: FPUUID Value: 4227-b0ca5392653471f39ae4271cc53733de
.holmesmind.com/	1970-01-21 10:09:27	Name: fcm Value: 1
.reurl.cc/	1970-01-21 12:17:36	Name: _fbp Value: fb.1.1764480756518.716817845210233222
.reurl.cc/	1970-01-21 19:44:00	Name: _ga_S9B9ZLEX4D Value: GS2.1.s1764480756$o1$g0$t1764480756$j60$l0$h0
.reurl.cc/	1970-01-21 19:44:00	Name: _ga_ZDFZCDVDK1 Value: GS2.1.s1764480756$o1$g0$t1764480756$j60$l0$h140072146
.reurl.cc/	1970-01-21 19:44:00	Name: _ga_N394QBRGC0 Value: GS2.1.s1764480757$o1$g0$t1764480757$j60$l0$h0
.reurl.cc/	1970-01-21 18:53:36	Name: __htid Value: aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9
.reurl.cc/	1970-01-21 10:08:04	Name: _ht_em Value: 1
.reurl.cc/	1970-01-21 19:44:00	Name: _ga Value: GA1.2.800170221.1764480757
.reurl.cc/	1970-01-21 10:09:27	Name: _gid Value: GA1.2.1141108092.1764480758
.reurl.cc/	1970-01-21 10:08:00	Name: _gat Value: 1
.reurl.cc/	1970-01-21 19:44:00	Name: _ga_M4J67EDHV2 Value: GS2.1.s1764480757$o1$g0$t1764480757$j60$l0$h0
.reurl.cc/	1970-01-21 10:09:27	Name: _ht_50ef57 Value: 1
.lndata.com/	1970-01-21 18:54:05	Name: admckid Value: 2511301332371943060
.hinet.net/	1970-01-21 19:44:00	Name: uuid Value: 342edee7-5b82-489a-af0c-b9c91dd3c292
.criteo.com/	1970-01-21 19:29:36	Name: uid Value: dc39d5eb-ed91-41c7-8123-b2f98a09235c
onead.onevision.com.tw/	1970-01-21 18:53:36	Name: onevision_guid Value: ff12e431-cdad-11f0-95fe-42010a000008
onead.onevision.com.tw/	1970-01-21 18:53:36	Name: oid Value: ff12e427-cdad-11f0-95fe-42010a000008
reurl.cc/	1970-01-21 18:53:36	Name: oid Value: %257B%2522oid%2522%253A%2522ff12e431-cdad-11f0-95fe-42010a000008%2522%252C%2522ts%2522%253A-62135596800%252C%2522v%2522%253A%252220201117%2522%257D
.taboola.com/	1970-01-21 18:53:36	Name: t_gid Value: e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c
.taboola.com/	1970-01-21 18:53:36	Name: t_pt_gid Value: e355eb4b-5566-4217-995d-b08eed1395a8-tuct10255c7c
.adsrvr.org/	1970-01-21 18:53:36	Name: TDID Value: 1478f59a-f97a-4394-91ab-26594eb7c4f1
.adsrvr.org/	1970-01-21 18:53:36	Name: TDCPM Value: CAEYBSABKAIyCwiSssbrk_fXPhAFOAE.
.eyeota.net/	1970-01-21 18:53:36	Name: mako_uid Value: 19ad33fcc3d-19900000010a53b9
.eyeota.net/	1970-01-21 10:08:01	Name: SERVERID Value: 21433~DM
.crwdcntrl.net/	1970-01-21 16:36:47	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 16:36:47	Name: _cc_id Value: fb7f07780678ec69d6ef9ea37093b314
.doubleclick.net/	1970-01-21 19:44:00	Name: IDE Value: AHWqTUkIXYkJEOS0Xq31Q9SPGyfwWUxiLby9oDTkO1Tq_C2B8cLfHLprhDGgYGbGB1E
.reurl.cc/	1970-01-21 19:29:36	Name: FCCDCF Value: %5Bnull%2Cnull%2Cnull%2Cnull%2Cnull%2Cnull%2C%5B%5B32%2C%22%5B%5C%229a469197-7abe-4a88-96f7-6d185e265e7a%5C%22%2C%5B1764480772%2C152000000%5D%5D%22%5D%5D%5D
.reurl.cc/	1970-01-21 19:29:36	Name: __gads Value: ID=835777a14b51e3db:T=1764480772:RT=1764480772:S=ALNI_Ma3BtJvXmHqePqbtnJSpHm2-9qJew
.reurl.cc/	1970-01-21 19:29:36	Name: __gpi Value: UID=000012a903a71d0f:T=1764480772:RT=1764480772:S=ALNI_MYgylDC1RwMHAxArPm1h3-eQZjbYQ
.reurl.cc/	1970-01-21 14:27:12	Name: __eoi Value: ID=0b818a48a3199f34:T=1764480772:RT=1764480772:S=AA-AfjYiMd0WcWco34vPNy1os2Un
.casalemedia.com/	1970-01-21 18:53:36	Name: CMID Value: aSvXBdHM6zwABJ12Ak9TgQAA
.casalemedia.com/	1970-01-21 12:17:36	Name: CMPS Value: 6040
.casalemedia.com/	1970-01-21 12:17:36	Name: CMPRO Value: 6040
.reurl.cc/	1970-01-21 18:53:36	Name: FCNEC Value: %5B%5B%22AKsRol-lwuYwJuRNODxptwsrVgoRYbKVCwh-o9wTugWJzqMcrPMgbbT6j-f_OXOYJyMTI3RiYBXANJazN8gUW3mk43_OpY8Ja6UI4SqCOcYZvrEGd7IICx06Q-QiHS1RRDjjI4UcX3NiWSpCfKYvGEfx__B_RduliQ%3D%3D%22%5D%5D
.reurl.cc/	1970-01-21 16:36:48	Name: _cc_id Value: fb7f07780678ec69d6ef9ea37093b314
.reurl.cc/	1970-01-21 10:09:27	Name: panoramaId_expiry Value: 1764567173454
.reurl.cc/	1970-01-21 10:09:27	Name: panoramaId Value: 70ca210a742079df312970306894a9fb927abefe1430b4201ca3046d4482de3b
.reurl.cc/	1970-01-21 10:09:27	Name: panoramaIdType Value: panoDevice
.adnxs.com/	1970-01-21 12:17:36	Name: anj Value: dTM7k!M41.D>6NRF']wIg2HaQpQDMo!@wnfH8K6pQK`!5=E<*L5?%K3iJ)k'j6C+Zfm8V@=2o.@gw-Lp@4sFnvRKd1%nugO%v4VB%nm_b)uEYy
.adnxs.com/	1970-01-21 12:17:36	Name: XANDR_PANID Value: 2N45wcTQ0O8IDidrHXzexsxXCQjbwuioxh3w3r46KDEiLAApZXJ7XDQjJEHT3PE3Z7k0THl-jzzmjDLhQ_4MmaX4JetrHTGHPA6stUctfbI.
.adnxs.com/	1970-01-21 12:17:36	Name: uuid2 Value: 8011476127989115291
.holmesmind.com/	1970-01-21 10:29:07	Name: Vision Value: 20251130-23:59,20251130-16,20251130-16,20251130-23:59
.holmesmind.com/	1970-01-21 10:29:07	Name: C Value: null
.holmesmind.com/	1970-01-21 12:32:58	Name: RK Value: null
.holmesmind.com/	1970-01-21 19:44:00	Name: P Value: 722255-gia8ByWVB70N82PsqkkD99X68SLixy1e
.criteo.com/	1970-01-21 19:29:36	Name: cto_bundle Value: GFVpNV91a3pTR0JzcTlBeWVDRUxrUVJUQWdYdDBXUTVTYzklMkZoU3ZBV3JVdmhXNEIlMkZld3FrUElSUklXS3dIZncyNVNlRXFFUUY4d2ZQeVA3Tmh6SXJ6TkNQM2NNSDJZc01GQzRwejZtS09KbkFrRHZDRiUyRjBJN3dFaTA5VkxTa0J5cUcwb3k4cTRrMGVFT0dHTWFEc2IzMmk2cWclM0QlM0Q
.reurl.cc/	1970-01-21 19:29:36	Name: cto_bundle Value: 1K7SG181SEtMNUtXQXFvcnFVc1lQaDNyclFjUWNMNU9mTFJKZzlBazUzenhVbkpqRWdsJTJCJTJGek1aS3pETlpBa2FlaWR3eWIwNEJOTHViNFI0TlgwV3JETURYQVc5OXg1V1FtR2lLeW9MV3kxJTJCZmxnWlhQbXNqeU5GVTNkVER4Z3h6RGdiUXpCeGloYWR2ZnZ2S1VNQ0FrRmtCRHclM0QlM0Q
.inmobi.com/	1970-01-21 12:17:36	Name: idsp_c Value: f66f9f9f-6c77-4efc-82e2-e6cc3b6102ee
track.91app.io/	1970-01-21 19:44:00	Name: deviceid Value: 2d002284-d7cf-47f7-a324-6b2bf0027182

13 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://reurl.cc/7bk8rN#Politique(Line 206) Message: [GroupMarkerNotSet(crbug.com/242999)!:A0C08216BC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'bluetooth'.
network	error	URL: https://fcm.holmesmind.com/cm.php Message: Failed to load resource: the server responded with a status of 502 ()
network	error	URL: chrome-error://chromewebdata/ Message: Failed to load resource: the server responded with a status of 400 ()
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://www.facebook.com/' in a frame because it set 'X-Frame-Options' to 'deny'.
network	error	URL: https://fcm.holmesmind.com/cm.php Message: Failed to load resource: the server responded with a status of 502 ()
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0902D20BC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A0101900BC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A090881FBC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A0002D20BC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A060881FBC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
rendering	warning	URL: https://cdn.holmesmind.com/js/capmapping.htm Message: [GroupMarkerNotSet(crbug.com/242999)!:A030B819BC0C0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://fcm.holmesmind.com/cm.php Message: Failed to load resource: the server responded with a status of 502 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

342edee7-5b82-489a-af0c-b9c91dd3c292.t.ssp.hinet.net
9b990612bab661fc08e5e3c6b4949205.safeframe.googlesyndication.com
ad-specs.guoshipartners.com
ad.holmesmind.com
aeb29aee-0a6e-4f1c-9fe9-2ba8329618f9.t.ssp.hinet.net
analytics.google.com
anymind360.com
bcp.crwdcntrl.net
bh.contextweb.com
bidder.criteo.com
c.holmesmind.com
cdn-ima.33across.com
cdn.doubleverify.com
cdn.holmesmind.com
cdn.jsdelivr.net
cm-dev-poc.holmesmind.com
cm.g.doubleclick.net
cm.lndata.com
connect.facebook.net
creditcards.com.tw
dis.criteo.com
dsum-sec.casalemedia.com
eb2.3lift.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
fcm.holmesmind.com
fcm2.holmesmind.com
fundingchoicesmessages.google.com
gocm.c.appier.net
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
img.gbyhn.com.tw
img.racingcharger.tw
invstatic101.creativecdn.com
m.holmesmind.com
match.adsrvr.org
mma.prnasia.com
mweb.ck.inmobi.com
nearbymed.com
oa.openxcdn.net
onead.onevision.com.tw
pagead2.googlesyndication.com
pixel.rubiconproject.com
prebid-asia.creativecdn.com
prebid.scupio.com
ps.eyeota.net
re-news.tw
reurl.cc
rtb0.doubleverify.com
s0.2mdn.net
scontent-yyz1-1.xx.fbcdn.net
securepubads.g.doubleclick.net
static.criteo.net
static.wixstatic.com
static.xx.fbcdn.net
stats.g.doubleclick.net
sync.go.sonobi.com
t.ssp.hinet.net
tags.crwdcntrl.net
tpc.googlesyndication.com
track.91app.io
tracking-client.91app.com
trc.taboola.com
web.alipearlhair.com
www.facebook.com
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.temu.com
ad.holmesmind.com
bh.contextweb.com
cdn-ima.33across.com
creditcards.com.tw
eb2.3lift.com
gocm.c.appier.net
img.racingcharger.tw
invstatic101.creativecdn.com
mma.prnasia.com
oa.openxcdn.net
pixel.rubiconproject.com
rtb0.doubleverify.com
s0.2mdn.net
static.xx.fbcdn.net
sync.go.sonobi.com
www.google.com
103.132.192.30
104.18.27.193
104.21.96.9
107.178.241.176
108.138.128.34
116.50.36.71
142.250.176.194
142.250.64.104
142.250.72.98
142.250.80.34
142.250.80.46
142.250.80.78
142.250.80.97
142.250.81.238
142.251.40.130
142.251.40.161
142.251.40.193
142.251.40.227
15.197.193.217
151.101.1.229
151.101.193.44
151.101.65.55
170.106.34.222
172.67.222.174
18.173.132.10
18.173.132.120
18.238.55.64
18.238.55.90
192.178.218.154
20.33.69.37
203.74.220.3
203.75.214.136
210.59.219.34
23.57.90.112
3.114.255.95
31.13.66.19
31.13.71.36
31.13.80.12
34.117.228.201
34.95.67.231
35.185.136.122
35.201.76.198
35.201.76.93
35.212.100.6
35.227.249.156
35.229.143.32
35.75.180.237
44.218.64.233
52.204.123.3
54.238.82.241
57.144.180.128
68.67.160.76
74.119.117.47
74.119.117.5
74.119.117.57
74.119.117.62
00a7ef012629016b7f2394532363ae619fe50c67b2b02f2e6f3d041f41abaf9f
034a343ec2e700d84a251d2657c40db2206eac06c5da8d6e25be2fd8ce7f33d5
03ea453e540e7075dbd901d5e2b48b9e1a57d2ad6e65f06c553ba4e020531417
04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747
09585355f53e08ec6d7ffa4d1bf783d5d08af046c3bd9251b0b5b965e9e4cca4
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e83a8ffdd161a80e179732ca1f514ee08dcc3c4a128baa9c92bcffebc2a7c52
0ee151ada12b93957bcf5c7247f51a778b859b267c686651564cb17bccc6e45c
0efa8291235243ad1438d266932112aecf4e7dca1963545a22d118cbe5d5d6e2
100d72a28123bcee974e8642b8bf1c0865bf1034c9b59f59597d53809e192fdc
1b0f332b4886177235d6d6fdbfe2b9a8690d4905f02c30ed676fc04687e1ce2d
1b3784d7c83388d37f8b129a71e16ba4e4ea1c5b81a72aaaa90e1357ad7fa4e9
1b4f701186759a5135c90d4b89282be37f2c6001a3f53a8a2f5379a59fbf4ad1
1ca0d5744e4f39ea464be06f38e214eabd97b2ca934e919a3673f0a62f76368c
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
242790a1bbb9b44ddd847db109e997631cf452ab6d74cb97dfd9cae3395c9e3e
25355805f44af99037c6b951f9afd762f5fd74eb126aba4b2f82cafa563c0f90
26d3d203e8d69454f28e5a533b1655d0d9c72b3c65ac2d3b2992fba82ae2f96c
2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9
2b61d16af7f9b1e4cecad14e2c6422e832f6937aadb41c7d2abdba44fb9a4b8b
311ddea6faecd14a9067b12c853cbc9737ae2a1af53854a0429feb3dc7230242
31b4d2ac4928b0129a5a969594be92783dbbb13112dd350f128de1b8d7215f30
351966dece7214af3b43d9a94f07c1c936176ad5dd81f0bbe1f6b319b4cd96d1
352d0915216b13b935f1abedea04d4a039802faaf69153ae71c377410990e322
3539a82b4664c18c51201b6b35a296282250e6cfb16f3355c61d949797c56529
365fc555dbd2149871a77b9485dbb0cbd487a0553f7a90163444349fee756f60
3733ce04a5c4dbb8b07b847650fd68e82f93ab8abf6b35ca294d6d40130f06c0
3774a7ce325859b32b6b0b01bde2879c75b81131fafe4a584b18b744711bd75d
37cd16af9680e2eac2b065fe88fbc0ca6d80583c67a9d8c69969e5dcbe27b14d
40eaab61bd7f8b876f54d3cf16fda515c06a2b41544bd9ebf7fb7b6b75938558
414dce8a0db9728e64e0b5fdcbc98179039f70813b2de2797e3c3594d4583e99
45444d590a67d30e8b2fde01bb6482f829383b64bf14a4b19b86e22fdc319fbb
47fb55898bb404427fc15426475fce1ee6ef8be9d7354dcfb4e3558a09a1de25
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c88ac025727a86ecebfac82247199619c8a1fbb42b3ba13cd77baac10e434ec
4da2dc78cc23591a9ee3285ba8f3891fa57b506b7902fbdd35fa5a2172566c55
52f7db6ace8e174c92e31058de5aec4556a91eb2867d2b6242472006a6f64f24
54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d
5618883e3468f8daa896fc9604056aaf627d804aa06b8e7ff9417b4ec2ecf82e
57e3fef09cab4680c25c4a06c9c1ce195325f5d502d4d75b5d53a7c2f14e2916
5a7cab09518c7073fc12ca5cde808431a4d77ad7901d6a63565328758b3034ab
5a871b13ede1754dec51e91e8f3ee35b98ff71fe42cf57d51cb574b004e3d4cd
5b4c3cdeb28d06d429cf100856d93896536a2720b8a94b0687a90797d82fd5ce
5d14cef2e46d075101b98d83e530a9255ce5cc10258f4c12caabc91a3237aa34
5d22fcaeba7c8a239fb38bd4458dd20b275b1251463be32cc6dbc741fece3dc3
5dc19081cdce4b73414b31adbb769fb102317dc1b313d001fa29575e703057ea
60280ebcf60053f7d378a772ecfabb60b0b69b9634e19105cb2307b126918447
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
60c40f5a2b4a1bda580470e816bb3996eb9ce9e8d2f689604856ecb5bf75036d
620a382665ff035abb643a19e12f088aef2bc27b55398d4ae3f131b773be6355
6215cea030001547475bd19ec624e50c85af367309e115d7813ae4eaff664d32
651219c93cab2078fb7f9f5f3d091d56009b1108ff95b312d5b518a8639fbf2a
67a778f801768d97bfcb66203b1514caee341e49fd334fc7660fa3a3a6ccc852
6a6929a82c3850f9f3ffef5a46cab9ba58ce13985d87e456a39032a84f82a765
6d4c444108925dc2ec8fe761f55a6760241c123740591e1348f0f94a653a3985
6e9ab8ab1d57a0695a66577e348ae4343e1a92f70cb4835a52c4863f11114037
716041efdb4414a3094243ecd3725ea02dd514734d7183e1b746c47b50da5005
720c8fed042ab770d2ced55408d82f2fd5a47dde5f3f37098d68e60eeb41ea74
72c0aa484ed554c7f385deb14edc6fa6afe7eedf0d04d3235a3dff61cf408f28
73ae392d3e6fd2a480cd5e6eb0077f17af084abfda5e3bb5487f76c0277be87c
76e0fe9b59aa81409567a77b7f5cfaebcbe6d1a5586d4979c5a83a327f68d517
7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521
7c201eb317c703e75ae773af6c02f4b1fdbb99accb18c53faf302d7c37e69881
8101a269966f8ab95a4be6dcf7822960e4f375c3c5b91ecfaf5179f5d5378620
8128514a9917b6dcdf20f7ee24d6b00a27b2a6aa0f971acb988f358f25ac4005
81d6bbf98766c014149ca92b1db896bff1e6a4ee5a311254184587f74533d74d
82a247f672adb559f24d58f05099def66a04e408f4bcdd846d616bc09b23ca17
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
834b68c690ad07a8043013788c16c639128d421a11df1b3732956360c81463a8
86a34eac25d67a687571efa9bed73b4b3c06a046793da56e628b22e2f90c9c85
873b90cdbff7dcb26e9ea34c647a5d15e83daecca768a816619dd38a503c09b5
88bbcb7b270d247e3df12b221bfe724c3f82b50faac44496fda002026121694f
8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6
8f73a10773dae7dadd7ca1e735ae7da6028aca748f9d01cff8aeebb462767c6e
91eb03e1676300edaf13dd35ded98ff9b4a62b27c2ce47c58f85c7aa44c76508
96e3e8dfde6b1042514824bac1b44282d4a76bac028f2d767f6534dce2cf3db0
9aa92a9a076fd2e55f339cd82c8b540e96ea0a4e4c7c12da6602edfadf2a0819
9d35f3cb72814df4a7a25ad51fc38b7b850e2fff9f097098d8f6840dd9cb5aba
9dec12836d28734d1512f635b6230a60342f4c84548d5ad1d133fd57531dc59b
9efa10def9440708715bcf0cb1456c74c1a413b17622d8f2675a2260679489b8
a67f70f5267c6b49abda64f77b70c38610c06060a56253aaab4dbab53860d093
a7c26694861bbd926c7d903f707b406aa8eaa6a5065a3acb6c8e0028e8eaee6e
a98e78ab91454e26b8d1fccca5b1dd582745827c4a1839934b7684d8dea42d59
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab187b70940d331c60646d5731fa8e86d6958ba69dfa241361e39d30d81c2d31
ac4dc31e31766b86bd824d300ee7bb9985be61a5da7976b134e984e0e394340a
b03f03d95ea5dbeee74fab42fb0c534164191a9998c5aa7b6d898b462ebd077f
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2eb8d16fc7f414112b0ac4fa8d6d946fd133dc7480c7e4b05fc2822b3b4fae6
b370b8d683152966f79b803de60d576023a93a975436e766409283f7de7b6d34
b638cc2de9f4bf30cd980830ebfba0b586d5ce5da10903f126d0dd4350e5aea3
b7e4fb85f556dee40b9c61e822b194ab8a35d2ed2d56568445838bb0bfa6c3b4
b7f74d42b2dec65c32cd2b08bd521b2f3d470ebd19e6659b32c9602174279240
b97b6a79b734e9323aa8c3847d0b2a1bb5db32fc6a7df92ac69653d1c8ba13c5
bc321999eef0d543e7a78351fb9bc32c7a6175165a80a9fc106a93c865053400
bca7ee31fc622c935a1ba3d3d012111f3aab926dc898ed011513fc7a9145f90e
bd04667d5d5feb14319f345a1a8e7486d8ab5aea560fb8be53cae5f6bc9d0e20
bdb0de47ae1b8fb74591873384f7c81d22af3ab6afc5f5f1dde7266a8039dc8e
bea1c5ab168f662fc9eb5bda3474e5b1bbd0d3ecc1d9c68e2a753f613c2ae0c2
c205c874491530a4288b8f643e5da8fbcf7c54bee71bb787f4444e77de90e821
c2bfe20d9d58935828e75bc753e2655f240621077408ae64f9b40a20f5125487
c6fe9e62123588f4b2647f97b8ba61cef5cc4b1ffaf8f74b033236c2a8af023f
c795c6a488ad463d7bba940565dcecd7643c2def513f1b45596e458f2f4632fd
ca73cb9900b7f4a2cc7d5ba2794e4d0a6250f0aff3db3bed8cef9d7eade13ba7
ca85f617678aa83dca8799aafc5569c3f6b99149e03ac742644b21436151c074
cba2d90658ffd2cc5f9aa0170424e74f3c73c7a6bd955155a25b23fce88e964d
cef005a7925817203365e696b47631a1bb7741d6b22f19399f5b958069a09eda
d4441ece945f2f14f46d1c462345ee2ba1c2e028e13137da40824116ee90b0f5
d51ae4a1096fac36fe9055d5c3f4daa85de0120b567636c89327b544a2a6a795
d70f437c1e2945867649d590022f0305df19875909167a1359ce20bbbcbd9958
d7627bee7b263ac39dc5cf783096e2581b6f03eccdd4e9b403a2e7f0689aa81a
d7968e9beff2ccb96c1a30e8e5db2373a8486550fbb63179e59e7e674542e1b7
dac56831476fb5f3f2c40c74e494002b792f5797910296d14c354be48995e136
e1c1642a7b402e888a16272cd16de45afc68b34c918aed03cbcbce55d74f21a2
e21a8fe77107729338cc7eb1a5dba53b530d7289a9b0563372e0a077ca830fcb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2
e442c1ebd96ba765ac415cb0cb17efffd13e89f87243af7b53deb689f264a2db
e58972f14e60ff958243af170ac82cb4075e26c8c252caf713b47c9872b5285c
e685bee1f5b7b1656705efefa0b5fb7cd931000896f088c3210b6bfcd0ed40e9
e84a7bc53b8aab520d59e605a9c0d50617c03029688e099ece2422aa00ff2b47
e8bc940359085308ba7b8d7107e53f7bbaf18c976e64f0fbbbbbba913543232a
e9b96bc538ceb220fc5caff0d0a67916b74cf07b2bada0b3296a17b1b99c9990
ea83707c446590a401656b6fbf33c33ae0afeecd22e669c3cfaca67fadb6145f
eb33059cdf158ecd0bae78dfa7762313529cd1bf089205f6821699b2c037e423
ec24975f4b89df691cfc7d6779e1e2f062521c1af6537f76b7aa172a8e609e65
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
f21233ebfc628748be56e544ee831e6723e5534227b3d48b06b77a7bda1f6e28
f31502bd8b58a334acc32b695f096fde6dd136fa1106f2d2d9fb4825d41b1abb
f3c5e5a0064eec4419f514718f35b3eb4ff163a77ebf16445041f5498a84638b
f8bcd058a4fbee6f8b68a5ff2930470c1890fc714914c226cf950b4e11ffdcdb
fdef8acb7e3dbb6cb32783cb67afbe528299489fd6d5eb5ec6e72ea0677c2daf
fe9e76db635452c2538363c0891c91976d44c183947c365b19bd053c6fc01490
fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e
fec7e21915a572698f670f8c84401660be1cd68d73f16e42cbc505cbe8f8f708

reurl.cc Open in urlscan Pro 35.229.143.32 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

293 Requests

84 %HTTPS

0 %IPv6

49 Domains

71 Subdomains

51 IPs

6 Countries

4540 kBTransfer

13396 kBSize

56 Cookies

22 Outgoing links

Page URL History

Redirected requests

293 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

reurl.cc Open in urlscan Pro
35.229.143.32 Public Scan

Screenshot
Live screenshot

Full Image

293
Requests

84 %
HTTPS

0 %
IPv6

49
Domains

71
Subdomains

51
IPs

6
Countries

4540 kB
Transfer

13396 kB
Size

56
Cookies

293 HTTP transactions
7 data transactions